Constrained Horn Clauses ( and Refinement Types) Toby Cathcart Burn, - - PowerPoint PPT Presentation

β–Ά
constrained horn clauses
SMART_READER_LITE
LIVE PREVIEW

Constrained Horn Clauses ( and Refinement Types) Toby Cathcart Burn, - - PowerPoint PPT Presentation

May 15, 2023 8 likes β€’318 views

Higher-Order Constrained Horn Clauses ( and Refinement Types) Toby Cathcart Burn, Luke Ong and Steven Ramsay University of Oxford l l e e t t add add x y = x + y l l e e t t r e c it iter er f m n = i i f f n 0 t t h h e

slide-1
SLIDE 1

Higher-Order Constrained Horn Clauses (and Refinement Types)

Toby Cathcart Burn, Luke Ong and Steven Ramsay

University of Oxford

slide-2
SLIDE 2

l e t l e t add

add x y = x + y

l e t l e t r e c it

iter er f m n =

i f i f n ≀ 0 t h e n t h e n m e l s e e l s e f n (iter

ter f m (n-1))

i n i n f u n f u n n a s s e r t (n ≀ it

iter er add add 0 n)

slide-3
SLIDE 3

𝑨 = 𝑦 + 𝑧 𝑩𝒆𝒆 𝑦 𝑧 𝑨 π‘œ ≀ 0 𝑱𝒖𝒇𝒔 𝑔 𝑛 π‘œ 𝑛 π‘œ > 0 ∧ 𝑱𝒖𝒇𝒔 𝑔 𝑛 π‘œ βˆ’ 1 π‘ž ∧ 𝑔 π‘œ π‘ž 𝑠 𝑱𝒖𝒇𝒔 𝑔 𝑛 π‘œ 𝑠 𝑱𝒖𝒇𝒔 𝑩𝒆𝒆 0 π‘œ 𝑠 π‘œ ≀ 𝑠

βˆ€ π’š 𝒛 π’œ . βˆ€ π’ˆ 𝒏 𝒐 . βˆ€ π’ˆ 𝒏 𝒐 𝒔 𝒒 . βˆ€ 𝒐 𝒔 . l e t l e t add

add x y = x + y

l e t l e t r e c it

iter er f m n =

i f i f n ≀ 0 t h e n t h e n m e l s e e l s e f n (iter

ter f m (n-1))

i n i n f u n f u n n a s s e r t (n ≀ it

iter er add add 0 n)

slide-4
SLIDE 4

Higher-order β€œunknown” relations: 𝐽𝑒𝑓𝑠 ∢ int β†’ int β†’ int β†’ bool β†’ int β†’ int β†’ int β†’ bool Quantification at higher-sorts: βˆ€ at sort int β†’ int β†’ int β†’ bool Literals headed by variables: 𝑔 π‘œ π‘ž 𝑠 ∢ bool 𝑨 = 𝑦 + 𝑧 𝑩𝒆𝒆 𝑦 𝑧 𝑨 π‘œ ≀ 0 𝑱𝒖𝒇𝒔 𝑔 𝑛 π‘œ 𝑛 π‘œ > 0 ∧ 𝑱𝒖𝒇𝒔 𝑔 𝑛 π‘œ βˆ’ 1 π‘ž ∧ 𝑔 π‘œ π‘ž 𝑠 𝑱𝒖𝒇𝒔 𝑔 𝑛 π‘œ 𝑠 𝑱𝒖𝒇𝒔 𝑩𝒆𝒆 0 π‘œ 𝑠 π‘œ ≀ 𝑠

βˆ€ π’š 𝒛 π’œ . βˆ€ π’ˆ 𝒏 𝒐 . βˆ€ π’ˆ 𝒏 𝒐 𝒔 𝒒 . βˆ€ 𝒐 𝒔 .

slide-5
SLIDE 5

Standard

semantics of sorts

𝑇 𝜏 β†’ 𝜐

All functions from 𝑇 𝜏 to 𝑇 𝜐

𝑇 bool

Two truth values, 𝐺 βŠ† π‘ˆ

𝑇 int

All of the integers

β„³ βŠ¨π‘‡ βˆƒπ‘¦: int β†’ bool β†’ bool. 𝐻

There is some predicate on sets of integers that makes 𝐻 true in β„³

slide-6
SLIDE 6

and the monotone semantics

Least models

slide-7
SLIDE 7

Theorem

Satisfiable systems of higher-order constrained Horn clauses do not necessarily possess least models. (Least with respect to inclusion of relations)

slide-8
SLIDE 8

Theorem

Satisfiable systems of higher-order constrained Horn clauses do not necessarily possess least models. (Least with respect to inclusion of relations)

𝑇 one = ⋆ 𝑸 ∢

  • ne β†’ bool β†’ bool β†’ bool

𝑹 ∢ one β†’ bool

βˆ€π‘¦. 𝑦 𝑹 β‡’ 𝑸 𝑦

slide-9
SLIDE 9

𝑇 one = ⋆ 𝑇 one β†’ bool = 1 𝑇

  • ne β†’ bool

β†’ bool = 𝟏 𝐺 𝟐 π‘ˆ 𝟏 𝐺 𝟐 π‘ˆ 𝟏 𝐺 𝟐 π‘ˆ 𝟏 𝐺 𝟐 π‘ˆ (⋆ 𝐺) (⋆ π‘ˆ)

slide-10
SLIDE 10

𝛽 𝑸 𝟏 𝐺 𝟐 π‘ˆ = 𝐺 𝛽 𝑸 𝟏 𝐺 𝟐 π‘ˆ = 𝐺 𝛽 𝑸 𝟏 𝐺 𝟐 π‘ˆ = π‘ˆ 𝛽 𝑸 𝟏 𝐺 𝟐 π‘ˆ = π‘ˆ 𝛽 𝑹 = 𝟏 𝑸 ∢

  • ne β†’ bool β†’ bool β†’ bool

𝑹 ∢ one β†’ bool

βˆ€π‘¦. 𝑦 𝑹 β‡’ 𝑸 𝑦

slide-11
SLIDE 11

𝛾 𝑸 𝟏 𝐺 𝟐 π‘ˆ = π‘ˆ 𝛾 𝑸 𝟏 𝐺 𝟐 π‘ˆ = 𝐺 𝛾 𝑸 𝟏 𝐺 𝟐 π‘ˆ = 𝐺 𝛾 𝑸 𝟏 𝐺 𝟐 π‘ˆ = π‘ˆ 𝛾 𝑹 = 𝟐 𝑸 ∢

  • ne β†’ bool β†’ bool β†’ bool

𝑹 ∢ one β†’ bool

βˆ€π‘¦. 𝑦 𝑹 β‡’ 𝑸 𝑦

slide-12
SLIDE 12

𝛾 𝑸 𝟏 𝐺 𝟐 π‘ˆ = π‘ˆ 𝛾 𝑸 𝟏 𝐺 𝟐 π‘ˆ = 𝐺 𝛾 𝑸 𝟏 𝐺 𝟐 π‘ˆ = 𝐺 𝛾 𝑸 𝟏 𝐺 𝟐 π‘ˆ = π‘ˆ 𝛾 𝑹 = 𝟐 𝛽 𝑹 = 𝟏 𝛽 𝑸 𝟏 𝐺 𝟐 π‘ˆ = 𝐺 𝛽 𝑸 𝟏 𝐺 𝟐 π‘ˆ = 𝐺 𝛽 𝑸 𝟏 𝐺 𝟐 π‘ˆ = π‘ˆ 𝛽 𝑸 𝟏 𝐺 𝟐 π‘ˆ = π‘ˆ

βˆ€π‘¦. 𝑦 𝑹 β‡’ 𝑸 𝑦

slide-13
SLIDE 13

𝑦 𝑅

𝟏 𝐺 𝟐 π‘ˆ 𝟏 = π‘ˆ 𝟏 𝐺 𝟐 π‘ˆ 𝟐 = 𝐺

βŠ† ⊈

slide-14
SLIDE 14

Monotone

semantics of sorts

𝑁 𝜏 β†’ 𝜐

All monotone functions from 𝑁 𝜏 to 𝑁 𝜐

𝑁 bool

Two truth values, 𝐺 βŠ† π‘ˆ

𝑁 int

All of the integers, ordered discretely

β„³ βŠ¨π‘ βˆƒπ‘¦: int β†’ bool β†’ bool. 𝐻

There is some monotone predicate on sets of integers that makes 𝐻 true in β„³

slide-15
SLIDE 15

βˆƒπ‘§π‘¨. 𝑦 𝑧 ∧ 𝑧 𝑨 𝑦 ↦ 1

𝑁 int β†’ bool All sets of integers 𝑁 int β†’ bool β†’ bool All upward closed sets of sets of integers 𝑁 int β†’ bool β†’ bool β†’ bool All upward closed sets of upward closed sets of sets

  • f integers

⊭

slide-16
SLIDE 16

Standard

semantics

Completely standard satisfiability problem (modulo background theory) in higher-order logic. Bespoke satisfiability problem with highly restricted class of models. No least model Least model arising in the usual way

Monotone

semantics

slide-17
SLIDE 17

Given set of higher-order constrained horn clauses H:

  • For each (standard) model 𝛾 of the standard semantics
  • f H there is a (monotone) model 𝑉(𝛾) of the monotone

semantics of H.

  • For each (monotone) model 𝛽 of the monotone

semantics of H, there is a (standard) model 𝐽(𝛽) of the standard semantics of H.

Theorem

slide-18
SLIDE 18

Mapping models means mapping relations:

𝑁 int β†’ bool β†’ bool β†’ bool 𝑇 int β†’ bool β†’ bool β†’ bool

slide-19
SLIDE 19

Mapping models means mapping relations:

𝑁 int β†’ bool β†’ bool β†’ bool

From monotone to standard: inclusion?

𝛽 βŠ¨π‘ βˆ€π‘¦: int β†’ bool β†’ bool. 𝑒𝑠𝑣𝑓 β‡’ 𝑸 𝑦 𝛽 𝑸 = {π‘Œ ∈ 𝒬 𝒬 β„€ ∢ X upward closed } 𝛽 βŠ­π‘‡ βˆ€π‘¦: int β†’ bool β†’ bool. 𝑒𝑠𝑣𝑓 β‡’ 𝑸 𝑦 𝑇 int β†’ bool β†’ bool β†’ bool

slide-20
SLIDE 20

Inclusion: constructs relations that are typically too small

𝐾 𝑠 𝑒 = α‰Šπ‘ (𝑒) 𝑗𝑔 𝑒 ∈ 𝑁 int β†’ bool β†’ bool 𝐺 π‘π‘’β„Žπ‘“π‘ π‘₯𝑗𝑑𝑓 𝑁 int β†’ bool β†’ bool β†’ bool 𝑇 int β†’ bool β†’ bool β†’ bool 𝑇 int β†’ bool β†’ bool 𝑇 int β†’ bool β†’ bool β†’ bool 𝐾

slide-21
SLIDE 21

Complementary inclusion: constructs relations that are typically too large

𝐾𝑑 𝑠 𝑒 = α‰Šπ‘ (𝑒) 𝑗𝑔 𝑒 ∈ 𝑁 int β†’ bool β†’ bool π‘ˆ π‘π‘’β„Žπ‘“π‘ π‘₯𝑗𝑑𝑓 𝑁 int β†’ bool β†’ bool β†’ bool 𝑇 int β†’ bool β†’ bool β†’ bool 𝑇 int β†’ bool β†’ bool 𝑇 int β†’ bool β†’ bool β†’ bool 𝐾𝑑

slide-22
SLIDE 22

Determine the value of standard relation 𝐾(𝑠) on non-(hereditarily) monotone input 𝑒 by considering the value of 𝑠 on: The largest (hereditarily) monotone relation of at most 𝑒 The smallest (hereditarily) monotone relation of at least 𝑒

𝐽 𝑠 1 = 𝑠 1 , 1,2 , 1,2,3 , … 𝐾 𝑠 1 = 𝑠 βˆ…

slide-23
SLIDE 23

𝑁 𝜍 𝑇 𝜍 𝑇 𝜍 𝐽𝜍 π‘‰πœ π‘€πœ 𝐾𝜍

The uniquely determined upper adjoint of 𝐾𝜍 The uniquely determined lower adjoint of 𝐽𝜍

π½π‘π‘π‘π‘š(𝑐) π½π‘—π‘œπ‘’β†’πœ(𝑠) 𝐽𝜍1β†’πœ2(𝑠) 𝑐 𝐽𝜍 ∘ 𝑠 𝐽𝜍2 ∘ 𝑠 ∘ π‘€πœ1 = = = πΎπ‘π‘π‘π‘š(𝑐) πΎπ‘—π‘œπ‘’β†’πœ(𝑠) 𝐾𝜍1β†’πœ2(𝑠) 𝑐 𝐾𝜍 ∘ 𝑠 𝐾𝜍2 ∘ 𝑠 ∘ π‘‰πœ1 = = =

For each sort of relations 𝜍:

slide-24
SLIDE 24

Given set of higher-order constrained horn clauses H:

  • For each (standard) model 𝛾 of the standard

interpretation of H there is a (monotone) model 𝑉(𝛾) of the monotone interpretation of H.

  • For each (monotone) model 𝛽 of the monotone

interpretation of H, there is a (standard) model 𝐽(𝛽) of the standard interpretation of H.

𝑁 𝜍 𝑇 𝜍 𝑇 𝜍 𝐽𝜍 π‘‰πœ π‘€πœ 𝐾𝜍

Theorem

slide-25
SLIDE 25

in the rest of the paper

Refinement Types

slide-26
SLIDE 26

A refinement type system for solving the monotone satisfiability problem:

Ξ“ ⊒ 𝐻 ∢ π‘π‘π‘π‘š 𝜚

In models satisfying Ξ“ … … the truth of goal 𝐻 … … is bounded above by constraint 𝜚 Typability reduces to first-order constrained Horn clause solving Given any refinement type π‘ˆ and any goal term 𝐻, 𝐻 ∢ π‘ˆ can be expressed as a higher-order constrained Horn clause.

slide-27
SLIDE 27

work

Future

slide-28
SLIDE 28

Higher-order program safety problem Higher-order constrained Horn clause problem First-order constrained Horn clause problem π‘—π‘œπ‘’ refined by 𝑄 ∢ π‘—π‘œπ‘’ β†’ π‘π‘π‘π‘š 𝑀𝑗𝑑𝑒 refined by 𝑄 ∢ 𝛽 β†’ π‘π‘π‘π‘š β†’ 𝑀𝑗𝑑𝑒 𝛽 β†’ π‘π‘π‘π‘š relative completeness? problem reduction? Refinements of type constructors:

slide-29
SLIDE 29

Thanks.

slide-30
SLIDE 30

𝐸 ∷= 𝑒𝑠𝑣𝑓 𝐻 β‡’ π‘Œπ‘§1 … 𝑧𝑙 𝐸 ∧ 𝐸 | βˆ€π‘¦: 𝜏. 𝐸 𝐻 ∷= 𝐡 𝐻 ∧ 𝐻 𝐻 ∨ 𝐻 𝜚 βˆƒπ‘¦: 𝜏. 𝐻

Constraint e.g. x > 3 Atom e.g. Iter f m (n-1) p e.g. f n p r Relational β€œunknown” e.g. Iter

slide-31
SLIDE 31

At π‘π‘π‘π‘š: 𝑁 π‘π‘π‘π‘š = 𝑇 π‘π‘π‘π‘š πΎπ‘π‘π‘π‘š is the identity with upper adjoint π‘‰π‘π‘π‘π‘š also the identity At π‘—π‘œπ‘’ β†’ π‘π‘π‘π‘š: 𝑁 π‘—π‘œπ‘’ β†’ π‘π‘π‘π‘š = 𝑇 π‘—π‘œπ‘’ β†’ π‘π‘π‘π‘š πΎπ‘—π‘œπ‘’β†’π‘π‘π‘π‘š 𝑠 = πΎπ‘π‘π‘π‘š ∘ 𝑠 = 𝑠 is the identity with upper adjoint π‘‰π‘—π‘œπ‘’β†’π‘π‘π‘π‘š also the identity At π‘—π‘œπ‘’ β†’ π‘π‘π‘π‘š β†’ π‘π‘π‘π‘š: 𝑁 π‘—π‘œπ‘’ β†’ π‘π‘π‘π‘š β†’ π‘π‘π‘π‘š βŠ† 𝑇 π‘—π‘œπ‘’ β†’ π‘π‘π‘π‘š β†’ π‘π‘π‘π‘š 𝐾 π‘—π‘œπ‘’β†’π‘π‘π‘π‘š β†’π‘π‘π‘π‘š 𝑠 = πΎπ‘π‘π‘π‘š ∘ 𝑠 ∘ π‘‰π‘—π‘œπ‘’β†’π‘π‘π‘π‘š = 𝑠 is an inclusion 𝑉 π‘—π‘œπ‘’β†’π‘π‘π‘π‘š β†’π‘π‘π‘π‘š 𝑑 = ራ 𝑒 ∈ 𝑁 π‘—π‘œπ‘’ β†’ π‘π‘π‘π‘š β†’ π‘π‘π‘π‘š 𝐾 π‘—π‘œπ‘’β†’π‘π‘π‘π‘š β†’π‘π‘π‘π‘š 𝑒 βŠ† 𝑑 πΎπ‘π‘π‘π‘š(𝑐) πΎπ‘—π‘œπ‘’β†’πœ(𝑠) 𝐾𝜍1β†’πœ2(𝑠) 𝑐 𝐾𝜍 ∘ 𝑠 𝐾𝜍2 ∘ 𝑠 ∘ π‘‰πœ1 = = = = ራ 𝑒 ∈ 𝑁 π‘—π‘œπ‘’ β†’ π‘π‘π‘π‘š β†’ π‘π‘π‘π‘š 𝑒 βŠ† 𝑑