[Paper Review] Higher-Order Program Verification via HFL Model Checking

Naoki Kobayashi, Takeshi Tsukada+1 more|arXiv (Cornell University)|Oct 24, 2017

Formal Methods in Verification45 references3 citations

TL;DR

This paper presents a novel, uniform approach to higher-order program verification by reducing diverse verification problems—such as may/must-reachability, trace properties, and linear-time temporal logic properties—to extended Higher-Order Model Checking (HFL) model checking. The key contribution is a sound and complete logical characterization of program properties via HFL formulas, enabling uniform reasoning through purely logical techniques, with improved expressiveness and correctness for infinite-data programs compared to prior HORS-based methods.

ABSTRACT

There are two kinds of higher-order extensions of model checking: HORS model checking and HFL model checking. Whilst the former has been applied to automated verification of higher-order functional programs, applications of the latter have not been well studied. In the present paper, we show that various verification problems for functional programs, including may/must-reachability, trace properties, and linear-time temporal properties (and their negations), can be naturally reduced to (extended) HFL model checking. The reductions yield a sound and complete logical characterization of those program properties. Compared with the previous approaches based on HORS model checking, our approach provides a more uniform, streamlined method for higher-order program verification.

Motivation & Objective

• To address the limited application of Higher-Order Fixpoint Logic (HFL) model checking in program verification despite its expressive power.
• To provide a uniform, logically grounded method for verifying higher-order functional programs with recursion, integers, and non-determinism.
• To overcome the limitations of HORS-based approaches in handling infinite-data programs by preserving semantic information about data domains in the verification process.
• To enable verification of complex properties such as linear-time temporal logic and their negations through a systematic reduction to HFL model checking.
• To demonstrate that HFL model checking can serve as a foundational logical framework for diverse verification tasks, replacing ad hoc reductions.

Proposed method

• Reduces program verification problems to HFL model checking by translating program behaviors into logical formulas expressing 'valid behavior'.
• Uses modal operators (e.g., ⟨read⟩, ⟨close⟩) to encode transitions in a system, with logical conjunctions and implications to represent non-deterministic and conditional choices.
• Employs fixpoint formulas—particularly greatest fixpoints (ν) and least fixpoints (μ)—to express recursive program behaviors and liveness properties.
• Extends HFL with integer predicates to handle finite-data programs and enables decidable verification for such cases.
• Replaces the traditional two-phase HORS model checking pipeline with a unified approach where procedure summaries are computed first, followed by HFL model checking of the remaining logical formula.
• Leverages the expressive power of HFL to encode complex program properties, including temporal and trace properties, in a logically uniform way.

Experimental results

Research questions

• RQ1 Can HFL model checking be used to uniformly verify a broad class of higher-order program properties, including reachability and temporal logic properties?
• RQ2 How can HFL formulas be constructed to logically characterize program behaviors such as valid file access sequences or recursive function executions?
• RQ3 What are the advantages of HFL-based verification over HORS-based approaches when handling infinite-data programs?
• RQ4 Can the logical characterization of program properties via HFL formulas support complete and sound verification without relying on incomplete transformations?
• RQ5 To what extent can the same logical framework be reused across different verification tasks through a uniform reduction strategy?

Key findings

• The paper establishes a sound and complete reduction from various higher-order program verification problems to extended HFL model checking, providing a logical foundation for program properties.
• The approach enables verification of linear-time temporal logic properties and their negations by encoding them as HFL fixpoint formulas, preserving semantic precision.
• For finite-data programs, the reductions yield pure HFL model checking problems, which are decidable, unlike the undecidable nature of general extended HFL problems.
• The method outperforms prior HORS-based approaches in handling infinite-data programs by retaining essential data-domain information in the second phase of verification.
• The logical characterization allows purely logical reasoning (e.g., via Coq) to prove or disprove program properties, minimizing reliance on domain-specific heuristics.
• Proofs in Coq are significantly shorter and more modular when using the logical characterizations, with only a few key insights required per example.