Hoare type theory, polymorphism and separation

Aleksandar Nanevski, Greg Morrisett, Lars Birkedal

Journal of Functional Programming · 2008 · 132 citations · 51 references

DOIFull text

Open access

Concepts

TL;DR

The paper addresses reconciling a dependently typed functional language with imperative features such as mutable higher‑order state, pointer aliasing, and nontermination. The authors propose Hoare type theory (HTT) to statically track and enforce correct use of side effects by incorporating Hoare‑style specifications into types. HTT introduces Hoare types { P } x : A { Q } that specify pre‑ and postconditions for computations, and supports nesting, combination, abstraction, and integration with higher‑order functions and type polymorphism. The authors show that HTT supports small‑footprint specifications in the presence of polymorphism and that the system is sound and compositional, allowing separate verifications of components to guarantee overall correctness.

Abstract

Abstract We consider the problem of reconciling a dependently typed functional language with imperative features such as mutable higher-order state, pointer aliasing, and nontermination. We propose Hoare type theory (HTT), which incorporates Hoare-style specifications into types, making it possible to statically track and enforce correct use of side effects. The main feature of HTT is the Hoare type { P } x : A { Q } specifying computations with precondition P and postcondition Q that return a result of type A . Hoare types can be nested, combined with other types, and abstracted, leading to a smooth integration with higher-order functions and type polymorphism. We further show that in the presence of type polymorphism, it becomes possible to interpret the Hoare types in the “small footprint” manner, as advocated by separation logic, whereby specifications tightly describe the state required by the computation. We establish that HTT is sound and compositional, in the sense that separate verifications of individual program components suffice to ensure the correctness of the composite program.

References

51