## Semantic subtyping with an SMT solver (2010)

### Cached

### Download Links

Citations: | 19 - 1 self |

### BibTeX

@TECHREPORT{Bierman10semanticsubtyping,

author = {Gavin M. Bierman and Andrew D. Gordon and Catalin Hritcu and David Langworthy},

title = {Semantic subtyping with an SMT solver},

institution = {},

year = {2010}

}

### OpenURL

### Abstract

We study a first-order functional language with the novel combination of the ideas of refinement type (the subset of a type to satisfy a Boolean expression) and type-test (a Boolean expression testing whether a value belongs to a type). Our core calculus can express a rich variety of typing idioms; for example, intersection, union, negation, singleton, nullable, variant, and algebraic types are all derivable. We formulate a semantics in which expressions denote terms, and types are interpreted as first-order logic formulas. Subtyping is defined as valid implication between the semantics of types. The formulas are interpreted in a specific model that we axiomatize using standard first-order theories. On this basis, we present a novel type-checking algorithm able to eliminate many dynamic tests and to detect many errors statically. The key idea is to rely on an SMT solver to compute subtyping efficiently. Moreover, interpreting types as formulas allows us to call the SMT solver at run-time to compute instances of types.

### Citations

791 | Constraint logic programming: a survey - Jaffar, Maher - 1994 |

783 |
Eiffel : The language
- Meyer
- 1991
(Show Context)
Citation Context ... checking [20] that allows particular expressions to have their type-check deferred until run-time. The idea of hybrid types is to strike a balance between runtime checking of contracts, as in Eiffel =-=[32]-=- and DrScheme [18], and static typing. Compared to purely static typing this can reduce the number of false alarms generated by type-checking. In spite of early work on semantic subtyping by Aiken and... |

753 |
Types and Programming Languages
- Pierce
- 2002
(Show Context)
Citation Context ...yping environment. This technique is known as semantic subtyping [2, 22], as opposed to the more common alternative, syntactic subtyping, which is to define syntax-driven rules for checking subtyping =-=[34]-=-. The idea of using an external solver for type-checking with refinement types is not new. Several recent type-checkers for functional languages, such as SAGE [20, 26], F7 [6], and Dsolve [38], rely o... |

670 |
Systematic Software Development using VDM
- Jones
- 1990
(Show Context)
Citation Context ...ype systems. Refinement types have their origins in early work in theorem proving systems and specification languages, such as subset types in constructive type theory [33], set comprehensions in VDM =-=[25]-=-, and predicate subtypes in PVS [39]. In PVS, constraints found when checking predicate subtypes become proof obligations to be proved interactively. More recently, Sozeau [41] extends Coq with subset... |

564 | A syntactic approach to type soundness - Wright, Felleisen - 1994 |

519 | Symbolic Execution and Program Testing - King - 1976 |

469 | Z3: An efficient SMT solver
- Moura, Bjørner
(Show Context)
Citation Context ...er logic plus various standard theories such as equality, real and integer (linear) arithmetic, bit vectors, and (extensional) arrays. Some of the leading systems include CVC3 [5], Yices [17], and Z3 =-=[13]-=-. There are common input formats such as Simplify’s [15] unsorted S-expression syntax and the SMT-LIB standard [36] for sorted logic. Hence, first-order logic with standard theories is emerging as a c... |

466 | Combining Monads
- King, Wadler
- 1993
(Show Context)
Citation Context ...lways listed according to a fixed, given ordering on the string labels. Collection expressions in the style of the nested relational calculus (NRC) [11] (which is closely related to the monad algebra =-=[48]-=-). Collections in M are bags but in order to simplify the presentation of the logical semantics in the following section we will treat Minim collections as heterogeneous lists. The collection operatio... |

380 | SIMPLIFY: A theorem prover for program checking
- Detlefs, Nelson, et al.
- 2003
(Show Context)
Citation Context ..., real and integer (linear) arithmetic, bit vectors, and (extensional) arrays. Some of the leading systems include CVC3 [5], Yices [17], and Z3 [13]. There are common input formats such as Simplify’s =-=[15]-=- unsorted S-expression syntax and the SMT-LIB standard [36] for sorted logic. Hence, first-order logic with standard theories is emerging as a computing platform. Software written to generate problems... |

298 | Dependent types in practical programming
- Xi, Pfenning
- 1999
(Show Context)
Citation Context ... systems such as the one of Dminor this is not possible. In other dependently-typed languages, either the programmer is required to insert casts to force the type into the appropriate syntactic shape =-=[43]-=-, or types are first executed until a normal form is reached [3]. Unfortunately, neither approach is acceptable in Dminor: the former forces too many casts on the programmer, and the latter is not fea... |

230 | Boogie: A modular reusable verifier for object-oriented programs - Barnett, Chang, et al. - 2006 |

223 | Type inclusion constraints and type inference
- Aiken, Wimmers
- 1993
(Show Context)
Citation Context ...espectively, and ask the solver whether the formula F[[S]](x) =⇒ F[[T ]](x) is valid, given any additional constraints known from the typing environment. This technique is known as semantic subtyping =-=[2, 22]-=-, as opposed to the more common alternative, syntactic subtyping, which is to define syntax-driven rules for checking subtyping [34]. The idea of using an external solver for type-checking with refine... |

201 | Soft Typing - Cartwright, Fagan |

191 | Soft typing with conditional types - Aiken, Wimmers, et al. - 1994 |

185 | Regular expression types for XML
- Hosoya, Vouillon, et al.
(Show Context)
Citation Context ..., ?, and |) and subtyping between two types becomes inclusion between the set of sequences that are denoted by the regular expression types. Hosoya and Pierce first defined such a type system for XML =-=[24]-=- and their language, XDuce. Frisch, Castagna, and Benzaken [22] extended semantic subtyping to function types and propositional types, with type-test, but not refinement types, resulting in the langua... |

182 | Refinement types for ML
- Freeman, Pfenning
- 1991
(Show Context)
Citation Context ...gations to be proved interactively. More recently, Sozeau [41] extends Coq with subset types; as in PVS the proofs of subset type membership have to be constructed using tactics. Freeman and Pfenning =-=[21]-=- extended ML with a form of refinement type, and Xi and Pfenning [43] considered applications of dependent types in an extension of ML. In both of these systems, decidability of type checking is maint... |

170 | Local type inference
- Pierce, Turner
(Show Context)
Citation Context ...aneous induction on the derivations of E ⊢ T and E ⊢ e : T , with appeal to Theorem 3 and Lemma 4.✷ 5.2 Bidirectional Typing Rules The Dminor type system is implemented as a bidirectional type system =-=[35]-=-. The key concept of bidirectional type systems is that there are two typing relations, one for type checking, and one for type synthesis. The chief characteristic of these relations is that they are ... |

165 | Towards a mathematical science of computation - McCarthy - 1962 |

157 | XDuce: A statically typed XML processing language - Hosoya, Pierce |

144 | Mechanized metatheory for the masses: the POPLMARK challenge
- Aydemir, Bohannon, et al.
(Show Context)
Citation Context ...ns are directly extracted from the library imported into our external solver during Minim typechecking. These facts have been proved informally. We are close to being able to mechanize our metatheory =-=[5]-=-, by developing proofs of the background theory from the model within a theorem-prover, but this remains future work. Our ML definitions can be interpreted directly in higher-order logic. A.1 Simple V... |

132 | Principles of programming with complex objects and collection types. Theor
- Buneman, Naqvi, et al.
- 1995
(Show Context)
Citation Context ...o values. We represent these as association lists, always listed according to a fixed, given ordering on the string labels. Collection expressions in the style of the nested relational calculus (NRC) =-=[11]-=- (which is closely related to the monad algebra [48]). Collections in M are bags but in order to simplify the presentation of the logical semantics in the following section we will treat Minim collect... |

126 |
Hybrid type checking
- Flanagan
- 2006
(Show Context)
Citation Context ...-driven rules for checking subtyping [34]. The idea of using an external solver for type-checking with refinement types is not new. Several recent type-checkers for functional languages, such as SAGE =-=[20, 26]-=-, F7 [6], and Dsolve [38], rely on various SMT solvers. However, these systems all rely on syntactic subtyping, with the solver being used as a subroutine to check constraints during subtyping. To the... |

121 | Contracts for Higher-order Functions
- Findler, Felleisen
(Show Context)
Citation Context ...t allows particular expressions to have their type-check deferred until run-time. The idea of hybrid types is to strike a balance between runtime checking of contracts, as in Eiffel [32] and DrScheme =-=[18]-=-, and static typing. Compared to purely static typing this can reduce the number of false alarms generated by type-checking. In spite of early work on semantic subtyping by Aiken and Wimmers [2] and D... |

113 | A Practical Soft Type System for Scheme - Wright, Cartwright - 1997 |

111 | Design of the programming language Forsythe
- Reynolds
- 1996
(Show Context)
Citation Context ...ntity △ = !(General | Collection) The primitive type of entities is unary: the type {ℓ : T } is the set of entities with a field ℓ whose value belongs to T (and possibly other fields). As in Forsythe =-=[37]-=-, we derive multiple-field entity types as an intersection type. One advantage of this approach is that it immediately entails width subtyping for entities. Encoding of Multiple-Field Entity Types: {ℓ... |

95 | Data on the web - Abiteboul, Buneman, et al. - 2000 |

93 |
The application/json media type for JavaScript Object Notation (JSON). RFC 4627
- Crockford
- 2006
(Show Context)
Citation Context ...kell, we would use the built-in notion of algebraic type to represent such statements. But like many data formats, including relational databases, S-expressions, and JavaScript Object Notation (JSON) =-=[11]-=-, the data structures of M and Dminor do not take as primitive the idea of data tagged with data constructors. Instead, we need to follow an idiom such as shown above, of taking the union of entity ty... |

83 | Refinement types for secure implementations
- Bengtson, Bhargavan, et al.
- 2008
(Show Context)
Citation Context ... for checking subtyping [34]. The idea of using an external solver for type-checking with refinement types is not new. Several recent type-checkers for functional languages, such as SAGE [20, 26], F7 =-=[6]-=-, and Dsolve [38], rely on various SMT solvers. However, these systems all rely on syntactic subtyping, with the solver being used as a subroutine to check constraints during subtyping. To the best of... |

70 | Subtyping dependent types
- Aspinall, Compagnoni
- 1996
(Show Context)
Citation Context ... dependently-typed languages, either the programmer is required to insert casts to force the type into the appropriate syntactic shape [43], or types are first executed until a normal form is reached =-=[3]-=-. Unfortunately, neither approach is acceptable in Dminor: the former forces too many casts on the programmer, and the latter is not feasible because refinements often refer to potentially very large ... |

67 | The design and implementation of typed scheme - Tobin-Hochstadt, Felleisen |

62 | Efficient static analysis of XML paths and types. Long version of [9], Research Report 6590 - Genevès, Layäıda, et al. - 2008 |

61 |
The Essence of XML
- Siméon, Wadler
- 2003
(Show Context)
Citation Context ...subtyping in the context of querying XML documents was given by Castagna [14].) In the end, the XQuery working group resorted to a more conventional (but less precise) nominal, structural type system =-=[46]-=-. Neither XDuce nor CDuce provides general refinement types, and their subtype algorithm is purpose-built. As far as we are aware, our use 12 2009/7/22of a general-purpose theorem prover to determine... |

60 |
an experimental applicative language
- HOPE
- 1980
(Show Context)
Citation Context ...le"]; test:Expression; body:Statement;} | {kind:["if"]; test:Expression; tt:Statement; ff:Statement;} | {kind:["seq"]; s1:Statement; s2:Statement;} | {kind:["skip"];}; In languages influenced by HOPE =-=[10]-=-, such as ML and Haskell, we would use the built-in notion of algebraic type to represent such statements. But like many data formats, including relational databases, S-expressions, and JavaScript Obj... |

52 | Deciding Validity in a Spatial Logic for Trees
- Calcagno, Cardelli, et al.
- 2005
(Show Context)
Citation Context ...y adding labels and pointers to labels. We intend to add support for first-class functions by generalizing the mixture of syntactic and semantic subtyping introduced by Calcagno, Cardelli, and Gordon =-=[13]-=-. We also intend to implement a form of hybrid type checking, as supported by SAGE, to allow particular programs that can not be type-checked at compiletime, to be checked at run-time instead. Finally... |

52 | Programming with intersection types, union types, and polymorphism
- Pierce
- 1991
(Show Context)
Citation Context ...ns, which are efficiently manipulated by the solver. Hence, we avoid the implementation effort of explicit propagation of known equalities, and of syntax-driven rules for union and intersection types =-=[40]-=-. 1.5 Contributions of the Paper Our aim is to formalize the core of M, especially the novel features of its type system, and to devise an efficient type-checking algorithm. We introduce a core calcul... |

48 | Subtyping with singleton types - Aspinall - 1994 |

43 | C.: The SMT-LIB standard: Version 1.2 - Ranise, Tinelli - 2006 |

40 | Efficient E-matching for SMT Solvers - Moura, Bjorner - 2007 |

40 | Termination of nested and mutually recursive algorithms - Giesl - 1997 |

40 | D.Sannella: “Hope: an Experimental Applicative Language - Burstall - 1980 |

39 | Tridirectional typechecking
- Dunfield, Pfenning
- 2004
(Show Context)
Citation Context ...are efficiently manipulated by the solver. Hence, we avoid the implementation effort of explicit propagation of known equality constraints, and of syntax-driven rules for union and intersection types =-=[16]-=-. Moreover, we exploit the theories of extensional arrays [14], integer arithmetic, and algebraic datatypes. 1.4 Contributions of the Paper (1) Investigation of semantic subtyping for a core functiona... |

39 | Subset Coercions in Coq
- Sozeau
- 2007
(Show Context)
Citation Context ...t comprehensions in VDM [25], and predicate subtypes in PVS [39]. In PVS, constraints found when checking predicate subtypes become proof obligations to be proved interactively. More recently, Sozeau =-=[41]-=- extends Coq with subset types; as in PVS the proofs of subset type membership have to be constructed using tactics. Freeman and Pfenning [21] extended ML with a form of refinement type, and Xi and Pf... |

39 | Union types for semistructured data - Buneman, Pierce - 2000 |

36 | The next 700 data description languages
- Fisher, Mandelbaum, et al.
- 2006
(Show Context)
Citation Context ... types and notions of visible and latent predicates to type-check Scheme programs. It would be interesting to see if these idioms can be internalized in the Dminor type system using refinements. PADS =-=[19]-=- develops a type theory for ad hoc data formats such as system traces, together with a rich range of tools for learning such formats and integrating into existing programming languages. The PADS type ... |

36 | Liquid Types
- Rondon, Kawaguchi, et al.
- 2008
(Show Context)
Citation Context ...btyping [34]. The idea of using an external solver for type-checking with refinement types is not new. Several recent type-checkers for functional languages, such as SAGE [20, 26], F7 [6], and Dsolve =-=[38]-=-, rely on various SMT solvers. However, these systems all rely on syntactic subtyping, with the solver being used as a subroutine to check constraints during subtyping. To the best of our knowledge, o... |

36 | Towards a high-level machine configuration system
- Anderson
- 1994
(Show Context)
Citation Context ...he Oslo repository holds a model of a data centre, that is, the configuration data for each server, and M can be used to check existing configurations and to compute new ones. Various bespoke systems =-=[2, 12]-=- have proven the worth of model-based systems configuration. Each of these systems has a domain-specific language (DSL) for describing intended configurations. (The mechanisms of configuration managem... |

36 | Provenance as dependency analysis
- Cheney, Ahmed, et al.
- 2007
(Show Context)
Citation Context ...sion bind x ← e1 in e2 is a collection, and so the meaning of this comprehension is e2{v1/x} + ··· + e2{vn/x} where e1 is the collection {v1,...,vn}. Variants, such as that presented by Cheney et al. =-=[15]-=-, require an additional unnesting operation. In Minim this extra unnesting operation is unnecessary as a collection of collections, e, can be unnested as follows: bind x ← e in x. We often rely on the... |

34 | Subtypes for specifications: Predicate subtyping in pvs
- Rushby, Owre, et al.
- 1998
(Show Context)
Citation Context ...heir origins in early work in theorem proving systems and specification languages, such as subset types in constructive type theory [33], set comprehensions in VDM [25], and predicate subtypes in PVS =-=[39]-=-. In PVS, constraints found when checking predicate subtypes become proof obligations to be proved interactively. More recently, Sozeau [41] extends Coq with subset types; as in PVS the proofs of subs... |

33 | A Unified System of Type Refinements - Dunfield - 2007 |

32 | Lost in translation: formalizing proposed extensions to C
- Bierman, Meijer, et al.
- 2007
(Show Context)
Citation Context ... e checks against type T Bidirectional type systems are relatively simple to implement, but remain quite expressive; for example, the type system for C ♯ can be defined as a bidirectional type system =-=[10]-=-, and a number of dependently-typed languages have bidirectional type systems [32, 29]. Interestingly, our bidirectional type system is different to these other systems. The algorithmic nature of bidi... |