Game semantics, recursion schemes and collapsible pushdown automata: a new approach to the algorithmics of infinite structures

Lead Research Organisation: University of Oxford
Department Name: Computer Science

Abstract

Despite considerable progress over the past decade, the computer-aided verification of software remains a hugely challenging problem. There are two main reasons. First, programs are infinite-state systems, but verification tools of industrial scale are essentially finite-state technologies. Secondly, modern programs -- in which unbounded data types, complex memory operations, non-local control flow, higher-order constructs, and name bindings of various kinds etc. are key features -- can only be accurately modelled using highly-structured mathematical models, as studied in semantics. Relatively little is known about the algorithmic properties of such rich, often higher-order'', mathematical structures.This project concerns an approach to software verification by developing automatic techniques which deal directly with infinite-state systems that are highly accurate models of programs. Striking examples of such infinite-state models are fully abstract game semantics of higher-order procedural programs; these models can be represented as (variant classes of higher-order) pushdown automata. In recent years, there have been remarkable advances in the study of algorithmic properties of hierarchies of generically-defined infinite structures. A notable result is that ranked trees that are generated by higher-order recursion schemes have decidable monadic second-order theories (Ong LICS'06). Further there is a new variant hierarchy of higher-order pushdown automata, called collapsible pushdown automata, that are equi-expressive with higher-order recursion schemes (in the sense that they generate the same class of trees), subsuming well-known structures at low orders: trees at order 0 and 1 are respectively the regular (Rabin 1969) and algebraic (Courcelle 1995) trees. The discovery of this rich, unifying and robust hierarchy of trees with excellent model-checking properties sparked the present research proposal.We have two general goals: - First we plan to study the connexions between the two closely-related higher-order families of generators (i.e. recursion schemes and collapsible pushdown automata), to explore the logical-algorithmic theory of infinite structures generated by them, and to derive (local and global) model checking algorithms. - Secondly we aim to develop verification techniques and construct efficient implementations of symbolic model-chekcers of reachability and temporal logics for these infinite structures of low orders. Why is it important to pursue these goals?- First, these hierarchies of infinite structures lie at the very frontier of infinite-state verification. The family of ranked trees thus generated is, to date, the largest generically-defined family of trees known to have decidable monadic second-order (MSO) theories; the family of transition graphs thus generated (does not have decidable MSO theories but) is, to date, the largest that is known to have decidable modal mu-calculus theories. These are significant indicators of our understanding of the subject, as MSO logic is the gold standard of languages for describing model-checking properties in computer-aided verification. - Secondly, these hierarchies of infinite structures are (representations of) highly accurate models of computation for higher-order procedural programs (such as OCAML, Haskell and F#). Recent results in (algorithmic) game semantics have shown that they underpin the computer-aided verification of these programs, an important and challenging direction for the next generation of software model checkers.
 
Description We developed and constructed a prototype implementation of a fixed-parameter polynomial time higher-order model checking algorithm, called PREFACE, based on a novel, type-directed form of abstraction refinement. PREFACE readily scales to recursion schemes of several thousand rules, well beyond the capabilities of current state-of-the-art higher-order model checkers. More generally, though our research publications and the tool PREFACE, we have made substantial contributions to the growing field of Higher-order Model Checking in particular, and the verification of higher-order programs in general.

In addition we have introduced an algorithm for computing directly the denotation of a modal µ-calculus formula over the configuration graph of a pushdown system. Our method gives the first extension of the saturation technique to the full modal µ-calculus. Our algorithm is relatively simple and direct, and avoids an immediate exponential blow up. We show experimentally that the direct algorithm is more efficient than via a reduction to parity games.
Exploitation Route The next step is to integrate PREFACE as a key component of a verification tool chain.
Sectors Digital/Communication/Information Technologies (including Software)

URL http://mjolnir.cs.ox.ac.uk/web/preface/index.php
 
Description EPSRC Platform Grant: Centre for Metacomputation
Amount £431,107 (GBP)
Funding ID EP/D037085/1 
Organisation Engineering and Physical Sciences Research Council (EPSRC) 
Sector Public
Country United Kingdom
Start 03/2006 
End 02/2010
 
Description Impact Acceleration Account Award
Amount £20,522 (GBP)
Funding ID EP/K503769/1 
Organisation Engineering and Physical Sciences Research Council (EPSRC) 
Sector Public
Country United Kingdom
Start 05/2014 
End 10/2014
 
Description JSPS Postdoctoral Fellowship for Research Abroard
Amount £72,600 (GBP)
Organisation Japan Society for the Promotion of Science (JSPS) 
Sector Public
Country Japan
Start 10/2013 
End 09/2015
 
Description Microsoft PhD Scholarship: Verifying Properties of the ML Family of Languages
Amount £66,000 (GBP)
Organisation PMG Research 
Sector Private
Country United States
Start  
 
Description Validation of Firmware
Amount $1,000,000 (USD)
Organisation Intel Corporation 
Sector Private
Country United States
Start  
 
Title HOMER 
Description An implementation of an observational equivalence model checker for Reynold's Idealized Algol using game semantics by reduction to the equivalence of visibly pushdown automata. 
Type Of Material Improvements to research infrastructure 
Year Produced 2009 
Provided To Others? Yes  
Impact First observational equivalence model checker for functional programs. 
 
Title Hector 
Description Hector (with David Hopkins and Andrzej Murawski, ICALP 2011 and CAV 2012): This is an implementation of an algorithm that decides observational equivalence of a fragment of RML-a canonical restriction of Standard ML to ground-type references-by reduction to the equivalence of visibly pushdown automata. 
Type Of Material Improvements to research infrastructure 
Year Produced 2011 
Provided To Others? Yes  
Impact First observational equivalence model checker for Call-by-value programs 
 
Title PREFACE 
Description A prototype implementation of a fixed-parameter polynomial time higher-order model checking algorithm, based on a novel, type-directed form of abstraction refinement. Preface readily scales to recursion schemes of several thousand rules, well beyond the capabilities of current state-of-the-art higher-order model checkers. Web interface: http://mjolnir.cs.ox.ac.uk/web/preface/ 
Type Of Material Improvements to research infrastructure 
Year Produced 2014 
Provided To Others? Yes  
Impact State-of-the-art tool for higher-order model checkingA prototype implementation of a fixed-parameter polynomial time higher-order model checking algorithm, based on a novel, type-directed form of abstraction refine- ment. Preface readily scales to recursion schemes of several thousand rules, well beyond the capabilities of current state-of-the-art higher-order model checkers. Web interface: http://mjolnir.cs.ox.ac.uk/web/preface/ 
URL http://mjolnir.cs.ox.ac.uk/web/preface/
 
Title Soter 
Description A tool that verifies coverability properties of (a substantial fragment of) Erlang by first performing an abstract interpretation, followed by Petri Net model checking as a back-end implemented by the BFC tool. Web interface: http://mjolnir.cs.ox.ac.uk/soter/ 
Type Of Material Improvements to research infrastructure 
Year Produced 2013 
Provided To Others? Yes  
Impact First infinite-state model checker for Erlang programs 
URL http://mjolnir.cs.ox.ac.uk/soter/
 
Title TravMC 
Description A prototype implementation of a higher-order model checking algorithm based on the fully abstract game semantics of recursion schemes, but specified as a goal-directed approach to intersection type inference. See http://mjolnir.cs.ox.ac.uk/web/ for the tool HORSC, and the extension to alternating parity tree automata, TravMC2. 
Type Of Material Improvements to research infrastructure 
Year Produced 2014 
Provided To Others? Yes  
Impact Higher-order model checker for liveness properties 
URL http://mjolnir.cs.ox.ac.uk/web/