## Polymorphism and separation in Hoare type theory (2006)

### Cached

### Download Links

- [www.it-c.dk]
- [www.itu.dk]
- [www.itu.dk]
- [www.it-c.dk]
- [www.eecs.harvard.edu]
- [research.microsoft.com]
- [ynot.cs.harvard.edu]
- [software.imdea.org]
- [software.imdea.org]
- DBLP

### Other Repositories/Bibliography

Venue: | In icfp |

Citations: | 66 - 14 self |

### BibTeX

@INPROCEEDINGS{Nanevski06polymorphismand,

author = {Aleksandar Nanevski and Greg Morrisett and Lars Birkedal},

title = {Polymorphism and separation in Hoare type theory},

booktitle = {In icfp},

year = {2006},

pages = {62--73},

publisher = {ACM Press}

}

### Years of Citing Articles

### OpenURL

### Abstract

In previous work we have proposed a Dependent Hoare Type Theory (HTT) as a framework for development and reasoning about higher-order functional programs with effects of state, aliasing and nontermination. The main feature of HTT is the type of Hoare triples {P}x:A{Q} specifying computations with precondition P and postcondition Q, that return a result of type A. Here we extend HTT with predicative type polymorphism. Type quantification is possible in both types and assertions, and we can also quantify over Hoare triples. We show that as a consequence it becomes possible to reason about disjointness of heaps in the assertion logic of HTT. We use this expressiveness to interpret the Hoare triples in the “small footprint ” manner advocated by Separation Logic, whereby a precondition tightly describes the heap fragment required by the computation. We support stateful commands of allocation, lookup, strong update, deallocation, and pointer arithmetic. 1

### Citations

1422 | An axiomatic basis for computer programming
- Hoare
- 1969
(Show Context)
Citation Context ...ms, however, only address very simple properties and cannot handle precise specifications about program correctness. Reasoning about such specifications is the task of program logics like Hoare Logic =-=[12]-=-. While significant efforts have been devoted to bridging this gap between type systems and Hoare-like logics – we list ESC/Java [10, 19], Splint [11], and Cyclone [16], among others – it is clear tha... |

1332 | Monads for functional programming
- Wadler
- 1993
(Show Context)
Citation Context ...T can support strong updates, whereby a location can point to values of different types in the course of the execution. From the type-theoretic standpoint, the Hoare type {P }x:A{Q} of HTT is a monad =-=[24, 25, 17, 41]-=-, and it internalizes the process of generating the verification condition for an effectful computation by calculating strongest postconditions. If the verification condition is provable, then the com... |

1122 | Proof-carrying code
- Necula
- 1997
(Show Context)
Citation Context ...f generating the verification condition for an effectful computation by calculating strongest postconditions. If the verification condition is provable, then the computation matches its specification =-=[28]-=-. Verification conditions are obtained from the computation in a syntax-directed and compositional manner; there is no need for whole-program reasoning. As a consequence, an HTT computation can be see... |

864 |
A Formulation of the Simple Theory of Types
- Church
- 1940
(Show Context)
Citation Context ...s, and new types of data. Often in assertions, one needs to talk about a type of lists and a predicate describing that a heap contains a linked lists. All of these are definable in higher-order logic =-=[8, 31, 40]-=-. For purposes of HTT, the higher-order logic will also require polymorphic quantification over monotypes. Furthermore, higher-order assertion logic should be the appropriate framework for studying Co... |

743 | Notions of computation and monads
- Moggi
- 1991
(Show Context)
Citation Context ...T can support strong updates, whereby a location can point to values of different types in the course of the execution. From the type-theoretic standpoint, the Hoare type {P }x:A{Q} of HTT is a monad =-=[24, 25, 17, 41]-=-, and it internalizes the process of generating the verification condition for an effectful computation by calculating strongest postconditions. If the verification condition is provable, then the com... |

728 | Separation logic: a logic for shared mutable data structures
- Reynolds
- 2002
(Show Context)
Citation Context ...d disjoint heap portions remain invariant throughout the computation. This is known as the “small footprint” approach to specification, and has been advocated recently by the work on Separation Logic =-=[29, 35, 30, 36]-=-. In this paper, we extend HTT with type polymorphism (including abstraction over Hoare triples) and small footprints. It is interesting that these two additions significantly overlap. At first, we co... |

452 |
The formulae-as-types notion of construction
- Howard
- 1980
(Show Context)
Citation Context ... HTT computation can be seen as a proof of its own specification. In other words, the effectful fragment of HTT satisfies the Curry-Howard correspondence between computations and specification proofs =-=[15]-=-. There is another way to interpret Theorem 7. As explained in Section 4, the collection of assertion logic sequents encountered during typechecking may be considered as the verification condition for... |

450 | Computational Lambda-Calculus and Monads
- Moggi
- 1989
(Show Context)
Citation Context ...T can support strong updates, whereby a location can point to values of different types in the course of the execution. From the type-theoretic standpoint, the Hoare type {P }x:A{Q} of HTT is a monad =-=[24, 25, 17, 41]-=-, and it internalizes the process of generating the verification condition for an effectful computation by calculating strongest postconditions. If the verification condition is provable, then the com... |

333 | Cyclone: A safe dialect of C
- JIM, MORRISETT, et al.
- 2002
(Show Context)
Citation Context ...program logics like Hoare Logic [12]. While significant efforts have been devoted to bridging this gap between type systems and Hoare-like logics – we list ESC/Java [10, 19], Splint [11], and Cyclone =-=[16]-=-, among others – it is clear that foundational issues abound, arising from the complexity of higher-order functions, polymorphism and imperative features, which are all indispensable in modern program... |

303 | Extended Static Checking
- Detlefs, Leino, et al.
- 1997
(Show Context)
Citation Context ...such specifications is the task of program logics like Hoare Logic [12]. While significant efforts have been devoted to bridging this gap between type systems and Hoare-like logics – we list ESC/Java =-=[10, 19]-=-, Splint [11], and Cyclone [16], among others – it is clear that foundational issues abound, arising from the complexity of higher-order functions, polymorphism and imperative features, which are all ... |

271 | Local reasoning about programs that alter data structures
- O’Hearn, Reynolds, et al.
- 2001
(Show Context)
Citation Context ...d disjoint heap portions remain invariant throughout the computation. This is known as the “small footprint” approach to specification, and has been advocated recently by the work on Separation Logic =-=[29, 35, 30, 36]-=-. In this paper, we extend HTT with type polymorphism (including abstraction over Hoare triples) and small footprints. It is interesting that these two additions significantly overlap. At first, we co... |

176 | Improving security using extensible lightweight static analysis
- Evans, Larochelle
- 2002
(Show Context)
Citation Context ...ns is the task of program logics like Hoare Logic [12]. While significant efforts have been devoted to bridging this gap between type systems and Hoare-like logics – we list ESC/Java [10, 19], Splint =-=[11]-=-, and Cyclone [16], among others – it is clear that foundational issues abound, arising from the complexity of higher-order functions, polymorphism and imperative features, which are all indispensable... |

175 | Alias types, in
- Smith, Walker, et al.
(Show Context)
Citation Context ...sed, due to the use of ∗ which forces x and y to appear in disjoint portions of the heap. Similar specifications that insists on non-aliasing are possible in several related systems, like Alias Types =-=[38]-=- and ATS with stateful views [44]. However, in HTT, like in Separation Logic, we can include the non-aliasing case as well. One possible specification which covers both aliasing and non-aliasing has t... |

167 | Local type inference
- Pierce, Turner
- 1998
(Show Context)
Citation Context ...rm activates a suspended computation. However, this elim form is not a term, but a computation, and is described below. The separation into intro and elim terms facilitates bidirectional typechecking =-=[33]-=-, whereby most of the type information can be omitted from the terms, as it can be inferred automatically. In the occasions when the type information must be supplied explicitly, the elim term M : A c... |

164 | A judgmental reconstruction of modal logic
- Pfenning, Davies
- 1999
(Show Context)
Citation Context ...ts for predicative polymorphism. Equational reasoning over the pure fragment admits the usual beta reductions and eta expansions. Equational reasoning over the impure fragment admits the monadic laws =-=[32, 25]-=-. Our formulation of the monads is based on the judgmental reconstruction of Pfenning and Davies [32]. The equational reasoning is organized around hereditary substitutions over canonical forms as dev... |

163 | Towards a mathematical science of computation
- McCarthy
- 1962
(Show Context)
Citation Context ...upport polymorphism, which is necessary for Java, ML or Cyclone. Second, the approach to specifying program heaps – which in HTT is based on functional arrays of Cartwright and Oppen [7] and McCarthy =-=[23]-=- – is itself not modular. Preconditions and postconditions in HTT describe the whole heap, rather than just the heap fragment that any particular program requires. Furthermore, the postconditions must... |

163 | Separation and information hiding
- O’Hearn, Yang, et al.
- 2004
(Show Context)
Citation Context ...d disjoint heap portions remain invariant throughout the computation. This is known as the “small footprint” approach to specification, and has been advocated recently by the work on Separation Logic =-=[29, 35, 30, 36]-=-. In this paper, we extend HTT with type polymorphism (including abstraction over Hoare triples) and small footprints. It is interesting that these two additions significantly overlap. At first, we co... |

128 | A logic of object-oriented programs
- Abadi, Leino
(Show Context)
Citation Context ... an additional heap variable mem, which denotes the current heap of reference 15sthat the assertions are relative to. ∆, α, ∆ ′ ⊢ α ⇐ type [α] ∆ ⊢ bool ⇐ type [bool] ∆ ⊢ nat ⇐ type [nat] ∆ ⊢ 1 ⇐ type =-=[1]-=- ∆ ⊢ A ⇐ type [A ′ ] ∆, x:A ′ ⊢ B ⇐ type [B ′ ] ∆ ⊢ Πx:A. B ⇐ type [Πx:A ′ . B ′ ] ∆ ⊢ Ψ ⇐ ctx [Ψ ′ ] ∆, Ψ ′ ; X, mem ⊢ P ⇐ prop [P ′ ] ∆ ⊢ A ⇐ type [A ′ ] ∆, Ψ ′ , x:A ′ ; X, mem ⊢ Q ⇐ prop [Q ′ ] ∆ ... |

128 |
On the meanings of the logical constants and the justifications of the logical laws
- Martin-Löf
- 1996
(Show Context)
Citation Context ...tion judgment will contain all the information needed to establish its own derivation, as the derivation process is completely guided by the syntax of the computation. In the terminology of MartinLöf =-=[21]-=-, the judgments become analytic. An alternative view of this property is that an HTT computation can be seen as a proof of its own specification. In other words, the effectful fragment of HTT satisfie... |

118 | Soundness and completeness of an axiom system for program verification
- COOK
- 1978
(Show Context)
Citation Context ...the higher-order logic will also require polymorphic quantification over monotypes. Furthermore, higher-order assertion logic should be the appropriate framework for studying Cook completeness of HTT =-=[9]-=-, as with higher-order assertions it should be possible to exactly express the strongest postconditions for any kind of un-annotated looping or recursion construct of HTT. Applications of Hoare Logic ... |

95 | The marriage of effects and monads
- Wadler, Thiemann
(Show Context)
Citation Context |

93 |
ESC/Java user’s manual
- Leino, Nelson, et al.
- 2000
(Show Context)
Citation Context ...such specifications is the task of program logics like Hoare Logic [12]. While significant efforts have been devoted to bridging this gap between type systems and Hoare-like logics – we list ESC/Java =-=[10, 19]-=-, Splint [11], and Cyclone [16], among others – it is clear that foundational issues abound, arising from the complexity of higher-order functions, polymorphism and imperative features, which are all ... |

85 | A type system for certified binaries
- Shao, Trifonov, et al.
(Show Context)
Citation Context ...rt polymorphism, strong updates, deallocation or pointer arithmetic. Both are Hoare-like Logics, rather than type theories, and are thus subject to the criticism we outlined in Section 1. Shao et al. =-=[37]-=- and Xi et al [43, 44] present dependently typed systems for effectful programs, based on singleton types, but they do not allow effectful terms in the specifications. Both systems encode a notion of ... |

71 | Dependently Typed Functional Programs and Their Proofs
- McBride
- 1999
(Show Context)
Citation Context ...roperty, we require a proposition for type equality, and a proposition for equality of terms at different types. While these concepts are standard in type theory (e.g. McBride’s “John Major” equality =-=[22]-=-), exploiting them fully in HTT requires extensions to higher-order logic. For example, it seems that even if we added a proposition for type equality, it would not be possible in the first-order sett... |

63 | Local reasoning about a copying garbage collector
- BIRKEDAL, TORP-SMITH, et al.
(Show Context)
Citation Context ...ticular, it alleviates the need for an additional representation of heaps in assertions as was used in the verification of Cheney’s garbage collection algorithm in Separation Logic by Birkedal et al. =-=[5]-=-. An additional feature admitted by polymorphism is that HTT can support strong updates, whereby a location can point to values of different types in the course of the execution. From the type-theoret... |

63 | An effective theory of type refinements
- Mandelbaum, Walker, et al.
- 2003
(Show Context)
Citation Context ...med into a suitable form (usually a linear product) before the postcondition can be computed at all. The proofs are necessary in order to guide this transformation of preconditions. Mandelbaum et al. =-=[20]-=- develop a theory of type refinements for reasoning about effectful higher-order functions, but their specifications are restricted in order for the type checking to be decidable. In particular, it do... |

58 | A logic for information flow in object-oriented programs
- Amtoft, Bandhakavi, et al.
- 2006
(Show Context)
Citation Context ...all footprint extension that we presented here may be applied to the same problem in a setting with higher-order functions. Another interesting domain is reasoning about information flow and security =-=[2]-=-. 45sLocal state. HTT specifications, as presented in this paper can only describe state that is reachable from the variables that are in scope, or from the return result of a computation. Local state... |

58 | Semantics of separation-logic typing and higherorder frame rules
- BIRKEDAL, TORP-SMITH, et al.
(Show Context)
Citation Context ...ns cannot be proved because the inference rule for let val x = E in F does not allow sufficient interaction between the specifications of E and F . Such problems do not appear in HTT. Birkedal et al. =-=[6]-=- describe a dependent type system for well-specified programs in idealized Algol extended with heaps. The type system includes a wide collection of higher-order frame rules, which are shown sound by a... |

56 | BI hyperdoctrines and higher-order separation logic
- Biering, Birkedal, et al.
- 2005
(Show Context)
Citation Context ...pdβ(updα(h, y, m), x, n)), where h is a logic variable denoting an arbitrary heap. Thus heap variables allow us to express some of the invariance that one may express in higher-order separation logic =-=[4]-=-. We next illustrate how swap can be used in a larger program. For example, swapping the same locations twice in a row does not change anything. identity : ∀α.∀β.Πx:nat.Πy:nat. h.{x ↩→α - ∧ y ↩→β - ∧ ... |

50 |
Extensional concepts in intensional type theory
- Hofmann
- 1995
(Show Context)
Citation Context ...d as well. The rules are restricted to primitive assertions q. ∆; X; Γ1 =⇒ IdA(M, M), Γ2 ∆; X; Γ1, IdA(M, N) =⇒[M/x] p A (q), [N/x]p A (q), Γ2 ∆; X; Γ1, IdA(M, N) =⇒[M/x] p A (q), Γ2 It is well-known =-=[13]-=-, that the equality rules above do not admit extensional equality of functions. The terms M and N must depend only on the variables in ∆ and X, while extensional equality of functions require extendin... |

46 | Possible worlds and resources: the semantics of BI
- Pym, O'Hearn, et al.
- 2004
(Show Context)
Citation Context ...rogram development and reuse, but it is possible that the small footprint extension could have been achieved separately, perhaps by utilizing axiomatizations based on the Logic of Bunched Implication =-=[34]-=-. In the presence of polymorphism we can already define the spatial connectives of Separation Logic, but more is needed to express the strongest postconditions of higher-order computations. In particu... |

39 | An observationally complete program logic for imperative higher-order functions
- Honda, Yoshida, et al.
- 2005
(Show Context)
Citation Context ...value v0, as required (and [v0 ] ∗ is the v that exists). � 8 Related work There has been a significant interest recently in systems for reasoning about effectful higher-order functions. Honda et al. =-=[14, 3]-=- present several Hoare Logics for total correctness, where specifications in the form of 42s[∆; P ⊢ M ⇒ x:A. P ∧ IdA(expandA (x), M ′ ) [ ]] θ = λρ. λh. ([∆ ⊢ M ⇐ A [ ]] θ ρ, h) [∆; P ⊢ let dia x = K ... |

39 | Applied type system (extended abstract
- Xi
(Show Context)
Citation Context ...trong updates, deallocation or pointer arithmetic. Both are Hoare-like Logics, rather than type theories, and are thus subject to the criticism we outlined in Section 1. Shao et al. [37] and Xi et al =-=[43, 44]-=- present dependently typed systems for effectful programs, based on singleton types, but they do not allow effectful terms in the specifications. Both systems encode a notion of pre- and postcondition... |

32 | A concurrent logical framework: the propositional fragment
- Watkins, Cervesato, et al.
- 2004
(Show Context)
Citation Context ...monads is based on the judgmental reconstruction of Pfenning and Davies [32]. The equational reasoning is organized around hereditary substitutions over canonical forms as developed by Watkins et al. =-=[42]-=-, which we here extend with predicative polymorphism. Using hereditary substitutions disentangles the mutual dependence between equational reasoning and typechecking, and thus avoids the major source ... |

29 | A logical analysis of aliasing in imperative higher-order functions
- Berger, Honda, et al.
- 2005
(Show Context)
Citation Context ...value v0, as required (and [v0 ] ∗ is the v that exists). � 8 Related work There has been a significant interest recently in systems for reasoning about effectful higher-order functions. Honda et al. =-=[14, 3]-=- present several Hoare Logics for total correctness, where specifications in the form of 42s[∆; P ⊢ M ⇒ x:A. P ∧ IdA(expandA (x), M ′ ) [ ]] θ = λρ. λh. ([∆ ⊢ M ⇐ A [ ]] θ ρ, h) [∆; P ⊢ let dia x = K ... |

28 | H.: Safe Programming with Pointers through Stateful Views
- Zhu, Xi
- 2005
(Show Context)
Citation Context ...rces x and y to appear in disjoint portions of the heap. Similar specifications that insists on non-aliasing are possible in several related systems, like Alias Types [38] and ATS with stateful views =-=[44]-=-. However, in HTT, like in Separation Logic, we can include the non-aliasing case as well. One possible specification which covers both aliasing and non-aliasing has the precondition (x ↦→α m * y ↦→β ... |

17 | The independence of Peano’s fourth axiom from Martin-Lof’s type theory without universes
- Smith
- 1988
(Show Context)
Citation Context .... This is analogous to the situation in Martin-Löf type theory extended with the inductive set of natural numbers, where it is not possible to prove z �= s z without recourse to higher type universes =-=[39]-=-. Thus, we leave propositional type equality for future work, and instead admit the following, slightly restricted, axiom, which admits functionality of heaps at each given monotype. ∆; X; Γ1, seleq τ... |

14 |
Unrestricted Procedure Calls in Hoare’s Logic
- Cartwright, Oppen
- 1978
(Show Context)
Citation Context ...of HTT does not support polymorphism, which is necessary for Java, ML or Cyclone. Second, the approach to specifying program heaps – which in HTT is based on functional arrays of Cartwright and Oppen =-=[7]-=- and McCarthy [23] – is itself not modular. Preconditions and postconditions in HTT describe the whole heap, rather than just the heap fragment that any particular program requires. Furthermore, the p... |

11 | A formulation of the simple theory of types (for Isabelle - Paulson - 1990 |

10 |
Separation logic for a higher-order typed language
- Krishnaswami
(Show Context)
Citation Context ...; X ⊢ ∃α. P ⇐ prop [ ]] θ (ρ, µ) iff [∆, α; X ⊢ P ⇐ prop [ ]] θ[α↦→τ] ((ρ, ∗), µ) for some monotype τ Figure 6: Interpretation of Propositions 44sHoare triples are taken as propositions. Krishnaswami =-=[18]-=- proposes a version of Separation Logic for a higher-order typed language. Similarly to HTT, Krishnaswami bases his logic on a monadic presentation of the underlying programming language. Both proposa... |

7 | Dependent type theory of stateful higher-order functions
- Nanevski, Morrisett
- 2005
(Show Context)
Citation Context ...ype systems facilitate scalable and modular program development. In contrast, Hoare Logic does not admit mixing of programs and specifications, and cannot make use of this mechanism. In previous work =-=[26]-=-, we proposed a Hoare Type Theory (HTT) which combines Hoare Logic with dependent types, and facilitates reasoning about higher-order imperative functions. It also serves as a model for the internal p... |

4 |
Contextual modal type theory. Under consideration for publication in the
- Nanevski, Pfenning, et al.
- 2005
(Show Context)
Citation Context ...er the local data of the computation. The variables from ∆ can be used in the return type A and in the postcondition Q. This extension may employ some results from the Contextual modal type theory of =-=[27]-=-. Of course, if the local addresses are made explicit as the return result of the computation, they are not local anymore. The second component required for a type system of local state must provide a... |

2 |
The HOL System: Description
- International, DSTO
- 1991
(Show Context)
Citation Context ...s, and new types of data. Often in assertions, one needs to talk about a type of lists and a predicate describing that a heap contains a linked lists. All of these are definable in higher-order logic =-=[8, 31, 40]-=-. For purposes of HTT, the higher-order logic will also require polymorphic quantification over monotypes. Furthermore, higher-order assertion logic should be the appropriate framework for studying Co... |

1 |
Lecture notes for the course ”An introduction to separation logic”. Available at http://www.cs.cmu.edu/~jcr/www15818A4s2005/notes6.ps
- Reynolds
- 2005
(Show Context)
Citation Context |