Refinement Types Research Articles

Safe couplings: coupled refinement types

We enhance refinement types with mechanisms to reason about relational properties of probabilistic computations. Our mechanisms, which are inspired from probabilistic couplings, are applicable to a rich set of probabilistic properties, including expected sensitivity, which ensures that the distance between outputs of two probabilistic computations can be controlled from the distance between their inputs. We implement our mechanisms in the type system of Liquid Haskell and we use them to formally verify Haskell implementations of two classic machine learning algorithms: Temporal Difference (TD) reinforcement learning and stochastic gradient descent (SGD). We formalize a fragment of our system for discrete distributions and we prove soundness with respect to a set-theoretical semantics.

Helmholtz: A Verifier for Tezos Smart Contracts Based on Refinement Types

A smart contract is a program executed on a blockchain, based on which many cryptocurrencies are implemented, and is being used for automating transactions. Due to the large amount of money that smart contracts deal with, there is a surging demand for a method that can statically and formally verify them. This article describes our type-based static verification tool Helmholtz for Michelson, which is a statically typed stack-based language for writing smart contracts that are executed on the blockchain platform Tezos. Helmholtz is designed on top of our extension of Michelson’s type system with refinement types. Helmholtz takes a Michelson program annotated with a user-defined specification written in the form of a refinement type as input; it then typechecks the program against the specification based on the refinement type system, discharging the generated verification conditions with the SMT solver Z3. We briefly introduce our refinement type system for the core calculus Mini-Michelson of Michelson, which incorporates the characteristic features such as compound datatypes (e.g., lists and pairs), higher-order functions, and invocation of another contract. Helmholtz successfully verifies several practical Michelson programs, including one that transfers money to an account and that checks a digital signature.

SolType: refinement types for arithmetic overflow in solidity

As smart contracts gain adoption in financial transactions, it becomes increasingly important to ensure that they are free of bugs and security vulnerabilities. Of particular relevance in this context are arithmetic overflow bugs, as integers are often used to represent financial assets like account balances. Motivated by this observation, this paper presents SolType, a refinement type system for Solidity that can be used to prevent arithmetic over- and under-flows in smart contracts. SolType allows developers to add refinement type annotations and uses them to prove that arithmetic operations do not lead to over- and under-flows. SolType incorporates a rich vocabulary of refinement terms that allow expressing relationships between integer values and aggregate properties of complex data structures. Furthermore, our implementation, called Solid, incorporates a type inference engine and can automatically infer useful type annotations, including non-trivial contract invariants. To evaluate the usefulness of our type system, we use Solid to prove arithmetic safety of a total of 120 smart contracts. When used in its fully automated mode (i.e., using Solid's type inference capabilities), Solid is able to eliminate 86.3% of redundant runtime checks used to guard against overflows. We also compare Solid against a state-of-the-art arithmetic safety verifier called VeriSmart and show that Solid has a significantly lower false positive rate, while being significantly faster in terms of verification time.

Refined avoidable mortality for comparative health systems performance assessment: an impact study

Abstract Background Avoidable mortality is headline indicator of relative health system performance in European Union policy processes. However, the reliability of this indicator for cross-national comparisons of health system performance is limited by the lack of control for cross-country differences in population health status, and the challenges in selecting causes of death and age limits. This study examined the feasibility and impact of several refinements of avoidable mortality addressing these concerns. Methods Using a sample of 30 European countries, including EU Member States, United Kingdom, Norway, and Iceland, we examined the feasibility and impact of adjusting avoidable mortality for cross-country differences in disease prevalence and disease stage, using extended age thresholds, and calculating the avoidable burden of disease. We measured the impact of the feasible adjustments by calculating the average absolute change in country ranks compared to the 2014 country ranking based on the standard avoidable mortality. Results Given publicly available data, only the calculation of years of life lost due to avoidable causes of death and using different age thresholds to calculate avoidable mortality are currently feasible. The impact of the feasible adjustments varied between countries with no visible geographic pattern. Including deaths due to avoidable causes at all ages changed the country ranks by an average of 1.9 places in men and 2.8 in women. Using years of life lost due to avoidable causes of death changed the rank by an average of 8.1 places in men and 8.7 in women. Conclusions Country rankings are highly sensitive to the type of refinement. However, a full assessment of refinements was not possible due to missing data. To ease the implementation of morbidity-based refinements of avoidable mortality, we recommend that a shorter list of avoidable causes of death is developed. Key messages A continuous refinement of relative health system performance measures and improving the availability of internationally comparable health data are critical to effectively support policy making. Updating the age thresholds used to calculate avoidable mortality and using years of life lost due to avoidable causes of death are currently feasible and have a sizeable impact on country rankings.

An existential crisis resolved: type inference for first-class existential types

Despite the great success of inferring and programming with universal types, their dual—existential types—are much harder to work with. Existential types are useful in building abstract types, working with indexed types, and providing first-class support for refinement types. This paper, set in the context of Haskell, presents a bidirectional type-inference algorithm that infers where to introduce and eliminate existentials without any annotations in terms, along with an explicitly typed, type-safe core language usable as a compilation target. This approach is backward compatible. The key ingredient is to use strong existentials, which support (lazily) projecting out the encapsulated data, not weak existentials accessible only by pattern-matching.

Verification of Program Transformations with Inductive Refinement Types

High-level transformation languages like Rascal include expressive features for manipulating large abstract syntax trees: first-class traversals, expressive pattern matching, backtracking, and generalized iterators. We present the design and implementation of an abstract interpretation tool, Rabit, for verifying inductive type and shape properties for transformations written in such languages. We describe how to perform abstract interpretation based on operational semantics, specifically focusing on the challenges arising when analyzing the expressive traversals and pattern matching. Finally, we evaluate Rabit on a series of transformations (normalization, desugaring, refactoring, code generators, type inference, etc.) showing that we can effectively verify stated properties.

Data flow refinement type inference

Refinement types enable lightweight verification of functional programs. Algorithms for statically inferring refinement types typically work by reduction to solving systems of constrained Horn clauses extracted from typing derivations. An example is Liquid type inference, which solves the extracted constraints using predicate abstraction. However, the reduction to constraint solving in itself already signifies an abstraction of the program semantics that affects the precision of the overall static analysis. To better understand this issue, we study the type inference problem in its entirety through the lens of abstract interpretation. We propose a new refinement type system that is parametric with the choice of the abstract domain of type refinements as well as the degree to which it tracks context-sensitive control flow information. We then derive an accompanying parametric inference algorithm as an abstract interpretation of a novel data flow semantics of functional programs. We further show that the type system is sound and complete with respect to the constructed abstract semantics. Our theoretical development reveals the key abstraction steps inherent in refinement type inference algorithms. The trade-off between precision and efficiency of these abstraction steps is controlled by the parameters of the type system. Existing refinement type systems and their respective inference algorithms, such as Liquid types, are captured by concrete parameter instantiations. We have implemented our framework in a prototype tool and evaluated it for a range of new parameter instantiations (e.g., using octagons and polyhedra for expressing type refinements). The tool compares favorably against other existing tools. Our evaluation indicates that our approach can be used to systematically construct new refinement type inference algorithms that are both robust and precise.

A unifying type-theory for higher-order (amortized) cost analysis

This paper presents λ-amor, a new type-theoretic framework for amortized cost analysis of higher-order functional programs and shows that existing type systems for cost analysis can be embedded in it. λ-amor introduces a new modal type for representing potentials – costs that have been accounted for, but not yet incurred, which are central to amortized analysis. Additionally, λ-amor relies on standard type-theoretic concepts like affineness, refinement types and an indexed cost monad. λ-amor is proved sound using a rather simple logical relation. We embed two existing type systems for cost analysis in λ-amor showing that, despite its simplicity, λ-amor can simulate cost analysis for different evaluation strategies (call-by-name and call-by-value), in different styles (effect-based and coeffect-based), and with or without amortization. One of the embeddings also implies that λ-amor is relatively complete for all terminating PCF programs.

Intensional datatype refinement: with application to scalable verification of pattern-match safety

The pattern-match safety problem is to verify that a given functional program will never crash due to non-exhaustive patterns in its function definitions. We present a refinement type system that can be used to solve this problem. The system extends ML-style type systems with algebraic datatypes by a limited form of structural subtyping and environment-level intersection. We describe a fully automatic, sound and complete type inference procedure for this system which, under reasonable assumptions, is worst-case linear-time in the program size. Compositionality is essential to obtaining this complexity guarantee. A prototype implementation for Haskell is able to analyse a selection of packages from the Hackage database in a few hundred milliseconds.

Phase Transition of Hypoxanthinium Nitrate Monohydrate

Structures of hypoxanthinium nitrate monohydrate crystals were determined at 15 different temperatures ranging from 20 to 285 K. Crystals undergo a phase transition from the twinned, low temperature phase of P21/n symmetry into the high temperature Pmnb phase. Sets of X-ray diffraction data acquired at each temperature were subjected to different types of refinement. We found that, as the temperature increases, the layers of hypoxanthinium nitrate monohydrate shift against each other, leading to the negative thermal expansion in one direction and positive one perpendicular to it. Such a phenomenon stops at the point of phase transition when the asymmetry in interactions in the structure disappears.

Statically verified refinements for multiparty protocols

With distributed computing becoming ubiquitous in the modern era, safe distributed programming is an open challenge. To address this, multiparty session types (MPST) provide a typing discipline for message-passing concurrency, guaranteeing communication safety properties such as deadlock freedom. While originally MPST focus on the communication aspects, and employ a simple typing system for communication payloads, communication protocols in the real world usually contain constraints on the payload. We introduce refined multiparty session types (RMPST), an extension of MPST, that express data dependent protocols via refinement types on the data types. We provide an implementation of RMPST, in a toolchain called Session*, using Scribble, a toolchain for multiparty protocols, and targeting F*, a verification-oriented functional programming language. Users can describe a protocol in Scribble and implement the endpoints in F* using refinement-typed APIs generated from the protocol. The F* compiler can then statically verify the refinements. Moreover, we use a novel approach of callback-styled API generation, providing static linearity guarantees with the inversion of control. We evaluate our approach with real world examples and show that it has little overhead compared to a naive implementation, while guaranteeing safety properties from the underlying theory.

Formulog: Datalog for SMT-based static analysis

Satisfiability modulo theories (SMT) solving has become a critical part of many static analyses, including symbolic execution, refinement type checking, and model checking. We propose Formulog, a domain-specific language that makes it possible to write a range of SMT-based static analyses in a way that is both close to their formal specifications and amenable to high-level optimizations and efficient evaluation. Formulog extends the logic programming language Datalog with a first-order functional language and mechanisms for representing and reasoning about SMT formulas; a novel type system supports the construction of expressive formulas, while ensuring that neither normal evaluation nor SMT solving goes wrong. Our case studies demonstrate that a range of SMT-based analyses can naturally and concisely be encoded in Formulog, and that — thanks to this encoding — high-level Datalog-style optimizations can be automatically and advantageously applied to these analyses.

Application of General Unified Threshold Models of Survival Models for Regulatory Aquatic Pesticide Risk Assessment Illustrated with an Example for the Insecticide Chlorpyrifos.

ABSTRACTMathematical models within the General Unified Threshold models of Survival (GUTS) framework translate time‐variable chemical exposure information into expected survival of animals. The GUTS models are species and compound specific and explicitly describe the internal exposure dynamics in an organism (toxicokinetics) and the related damage and effect dynamics (toxicodynamics), thereby connecting the external exposure concentration dynamics with the simulated mortality or immobility over time. In a recent scientific opinion on toxicokinetic–toxicodynamic (TKTD) models published by the European Food Safety Authority (EFSA), the GUTS modeling framework was considered ready for use in the aquatic risk assessment for pesticides and aquatic fauna. The GUTS models are suggested for use in risk assessment, if they are sufficiently validated for a specific substance–species combination. This paper aims to illustrate how they can be used in the regulatory environmental risk assessment for pesticides for a specific type of refinement, that is, when risks are triggered by lower tiers in acute as well as in chronic risk assessment and mortality or immobility is the critical endpoint. This approach involves the evaluation of time‐variable exposure regimes in a so‐called “Tier‐2C” assessment. The insecticide chlorpyrifos was selected as an example compound because a large data set was available. The GUTS models for 13 different freshwater arthropods and 8 different theoretical aquatic exposure profiles were used to calculate a series of GUTS‐based risk estimates, including exposure profile‐specific multiplication factors leading to 50% mortality or immobility at the end of the tested profile (LP50/EP50) as “margins of safety.” To put the use of GUTS models within the tiered aquatic risk assessment into perspective, GUTS models for the 13 aquatic arthropods were also used to predict the environmental risks of a measured chlorpyrifos exposure profile from an experimental ditch study (Tier‐3 approach), and the results are discussed in the context of calibration of the tiered approach. Integr Environ Assess Manag 2021;17:243–258. © 2020 The Authors. Integrated Environmental Assessment and Management published by Wiley Periodicals LLC on behalf of Society of Environmental Toxicology & Chemistry (SETAC)

Refinement Procedures for Clitorolabiaplasty in Male-to-Female Gender-Affirmation Surgery: More than an Aesthetic Procedure

BackgroundAmong the various steps of a penile inversion feminizing genitoplasty, reconstruction of the clitoris and labia minora remains the most challenging procedure. AimThis study aims to evaluate surgical outcomes of neoclitoroplasty performed before and after the introduction of the labia minora’s creation in our surgical technique. MethodsA retrospective analysis was carried out comparing 2 groups of patients that underwent penile inversion feminizing surgery: group A (64 patients) who had labia minora and clitoral hood creation and group B (103 patients) who did not. OutcomesTo describe the surgical technique and outcomes of clitorolabiaplasty in male-to-female gender-affirmation surgery. ResultsConcerning overall complication rates, there were significant differences in the incidence of hemorrhage and urethral stenosis (P < .01). Hemorrhage surrounding the urethra and labia was identified in 40 patients (group A: n = 8 [12.5%]; group B: n = 32 [31%]) (P = .006). Neomeatal stenosis occurred in 17 patients (group A: n = 1 [1.5%]; group B: n = 16 [15.5%]) (P = .003). Partial necrosis of the clitoris occurred in 2 cases (group A: n = 0; group B: n = 2 [1.9%]) (P = .52). Necrosis of the labia majora occurred in 3 cases (group A: n = 0; group B: n = 3 [2.9%]) (P = .28). 5 patients (group A: n = 2 (3.1%); group B: n = 3 [2.9%]) (P = .93) developed rectovaginal fistula. 6 patients experienced neovaginal canal stricture (group A: n = 3 [4.6%]; group B: n = 3 [2.9%]) (P = .54). 2 patients (group A: n = 0; group B: n = 2 [1.9%]) (P = .52) reported introital stenosis; Persistent granulation tissue inside the neovagina that required in-office treatments occurred in 4 cases (group A: n = 2 [3.1%]; group B: n = 2 [1.9%]) (P = .62). Wound dehiscence occurred in 23 patients (group A: n = 13 [20.3%]; group B: n = 10 [9.7%]) (P = .05). 24 patients (group A: n = 3 [4.6%]; group B: n = 21 [20.3%]) (P = .004) underwent 28 different types of aesthetic refinements. Clinical ImplicationsIncorporating the creation of labia minora and clitoral hood in one step is a safe and viable option in patients undergoing male-to-female gender-affirmation surgery. Strengths & LimitationsStrength of the study is the large cohort of patients included and the consistent surgical technique. To our knowledge, this is the first study that compares with a control group, the introduction of labia minora creation in male-to-female gender-affirmation surgery. Limitations include the retrospective nature of the study and the absence of patient-reported outcomes measures. ConclusionTechnical refinements of our technique led to a significative reduction in urethral stenosis and postoperative hemorrhage without an increased risk of major complications.Raigosa M, Avvedimento S, Descarrega J, et al. Refinement Procedures for Clitorolabiaplasty in Male-to-Female Gender-Affirmation Surgery: More than an Aesthetic Procedure. J Sex Med 2020;17:2508–2517.

Liquid resource types

This article presents liquid resource types, a technique for automatically verifying the resource consumption of functional programs. Existing resource analysis techniques trade automation for flexibility – automated techniques are restricted to relatively constrained families of resource bounds, while more expressive proof techniques admitting value-dependent bounds rely on handwritten proofs. Liquid resource types combine the best of these approaches, using logical refinements to automatically prove precise bounds on a program’s resource consumption. The type system augments refinement types with potential annotations to conduct an amortized resource analysis. Importantly, users can annotate data structure declarations to indicate how potential is allocated within the type, allowing the system to express bounds with polynomials and exponentials, as well as more precise expressions depending on program values. We prove the soundness of the type system, provide a library of flexible and reusable data structures for conducting resource analysis, and use our prototype implementation to automatically verify resource bounds that previously required a manual proof.

ICE-Based Refinement Type Discovery for Higher-Order Functional Programs

We propose a method for automatically finding refinement types of higher-order function programs. Our method is an extension of the Ice framework of Garg et al. for finding invariants. In addition to the usual positive and negative samples in machine learning, their Ice framework uses implication constraints, which consist of pairs (x, y) such that if x satisfies an invariant, so does y. From these constraints, Ice infers inductive invariants effectively. We observe that the implication constraints in the original Ice framework are not suitable for finding invariants of recursive functions with multiple function calls. We thus generalize the implication constraints to those of the form \((\{x_1,\dots ,x_k\}, y)\), which means that if all of \(x_1,\dots ,x_k\) satisfy an invariant, so does y. We extend their algorithms for inferring likely invariants from samples, verifying the inferred invariants, and generating new samples. We have implemented our method and confirmed its effectiveness through experiments. Open image in new window

Implementation of an ontological reasoning to support the guideline-based management of primary breast cancer patients in the DESIREE project.

The DESIREE project has developed a platform offering several complementary therapeutic decision support modules to improve the quality of care for breast cancer patients. All modules are operating consistently with a common breast cancer knowledge model (BCKM) following the generic entity-attribute-value model. The BCKM is formalized as an ontology including both the data model to represent clinical patient information and the termino-ontological model to represent the application domain concepts. This ontological model is used to describe data semantics and to allow for reasoning at different levels of abstraction. We present the guideline-based decision support module (GL-DSS). Three breast cancer clinical practice guidelines have been formalized as decision rules including evidence levels, conformance levels, and two types of dependency, "refinement" and "complement", used to build complete care plans from the reconciliation of atomic recommendations. The system has been assessed on 138 decisions previously made without the system and re-played with the system after a washout period on simulated tumor boards (TBs) in three pilot sites. When TB clinicians changed their decision after using the GL-DSS, it was for a better decision than the decision made without the system in 75 % of the cases.

Grain refinement mechanisms in BCC ferritic steel and FCC austenitic steel highly deformed under different temperatures and strain rates

An interstitial free (IF) steel having single-phase bcc-structure (<~900 °C) and a SUS-304 stainless steel having single-phase fcc-structure were deformed to high strains by torsion at different temperatures and strain rates. Various grain sizes ranging from 0.6 μm to 46 μm in the IF steel and those from 0.4 μm to 44 μm in the SUS-304 steel were produced by torsion. The dependence of the ultrafine and fine grain sizes (D) on the torsion flow stresses (σ) was analyzed in both materials. Accordingly, the σ - D relationship could be expressed in a power-law form known as the Derby relation, with multiple power-law exponents. This result indicated that different grain refinement mechanisms, i.e., grain subdivision and dynamic recrystallization, were dominant under different deformation conditions. Differences between the IF steel and the SUS-304 steel with respect to the types of microstructure refinement and the corresponding mechanisms in these steels were also discussed.

Verification of high-level transformations with inductive refinement types

High-level transformation languages like Rascal include expressive features for manipulating large abstract syntax trees: first-class traversals, expressive pattern matching, backtracking and generalized iterators. We present the design and implementation of an abstract interpretation tool, Rabit, for verifying inductive type and shape properties for transformations written in such languages. We describe how to perform abstract interpretation based on operational semantics, specifically focusing on the challenges arising when analyzing the expressive traversals and pattern matching. Finally, we evaluate Rabit on a series of transformations (normalization, desugaring, refactoring, code generators, type inference, etc.) showing that we can effectively verify stated properties.

Indexing Mixed Aperture Icosahedral Hexagonal Discrete Global Grid Systems

Discrete global grid systems (DGGSs) are an emerging multiresolution 3D model used to integrate and analyze big earth data. The characteristic of multiresolution is usually realized by hierarchically subdividing cells on the sphere using certain refinement. This paper introduces mixed aperture three- and four- icosahedral hexagonal DGGSs using two types of refinement, the various combinations of which can provide more resolutions compared with pure aperture hexagonal DGGSs and can flexibly design the aperture sequence according to the target resolutions. A general hierarchy-based indexing method is first designed, and related indexing arithmetics and algorithm are developed based on the indexing method. Then, the grid structure on the surface of the icosahedron is described and by projection spherical grids are obtained. Experiments show that the proposed scheme is superior to pure aperture schemes in choosing grid resolutions and can reduce the data volume by 38.5% in representing 1-km resolution raster dataset; using the proposed indexing arithmetics to replace spherical geometry operations in generating discrete spherical vector lines based on hexagonal cells can improve the generation efficiency.