Higher-Order Constrained Horn Clauses and Refinement Types

TL;DR

This paper introduces higher-order constrained Horn clauses and a refinement type system to automate verification of higher-order functional programs, providing a sound method for satisfiability and model reasoning.

Contribution

It develops a higher-order logic framework for constrained Horn clauses and integrates refinement types for automated reasoning in program verification.

Findings

Canonical models can be obtained via reduction to monotone logic programs.

Refinement types enable automated reasoning about higher-order functions.

The approach is sound but incomplete for the satisfiability decision problem.

Abstract

Motivated by applications in automated verification of higher-order functional programs, we develop a notion of constrained Horn clauses in higher-order logic and a decision problem concerning their satisfiability. We show that, although satisfiable systems of higher-order clauses do not generally have least models, there is a notion of canonical model obtained through a reduction to a problem concerning a kind of monotone logic program. Following work in higher-order program verification, we develop a refinement type system in order to reason about and automate the search for models. This provides a sound but incomplete method for solving the decision problem. Finally, we show that an extension of the decision problem in which refinement types are used directly as guards on existential quantifiers can be reduced to the original problem. This result can be used to show that properties of higher-order functions that are definable using refinement types are also expressible using higher-order constrained Horn clauses.

Tables

(GCst)    $c\in \{\wedge ,\vee ,{\exists }_{\iota }\}\cup \{{\exists }_{\rho }\mid \rho \}$               $\Delta ⊢c:{\rho }_c$		(GVar)                 ${\Delta }_1,x:\rho ,{\Delta }_2⊢x:\rho$
$\Delta$ (GConstr)    $\Delta ⊢\phi :o\in \mathrm{𝐹𝑚}$                   $\Delta ⊢\phi :o$		$\Delta ,x:\sigma ⊢G:\rho$ (GAbs)    $x\notin \mathrm{𝖽𝗈𝗆}\left(\Delta \right)$               $\Delta ⊢\lambda x.G:\sigma \to \rho$
$\Delta ⊢G:\iota \to \rho$ (GAppI)    $\Delta ⊢N:\iota \in \mathrm{𝑇𝑚}$                   $\Delta ⊢GN:\rho$		$\Delta ⊢G:{\rho }_1\to {\rho }_2$         $\Delta ⊢H:{\rho }_1$ (GAppR)                                $\Delta ⊢GH:{\rho }_2$

Equations

$$\begin{array}[]{l}\mathit{\mathsf{let}}\>\mathit{\mathit{add}{}}\>\mathit{x}\>\mathit{y}\>\mathit{=}\>\mathit{x}\>\mathit{+}\>\mathit{y}\\ \mathit{\mathsf{let}}\>\mathit{\mathsf{rec}}\>\mathit{\mathit{iter}{}}\>\mathit{f}\>\mathit{s}\>\mathit{n}=\mathit{\mathsf{if}}\>\mathit{n\leq 0}\>\mathit{\mathsf{then}}\>\mathit{s}\>\mathit{\mathsf{else}}\>\mathit{f}\>\mathit{n}\>\mathit{(\mathit{iter}{}}\>\mathit{f}\>\mathit{s}\>\mathit{(n}\>\mathit{-}\>\mathit{1))}\\ \mathsf{in}\;\mathit{\lambda n.\,\mathit{\mathsf{assert}}\>\mathit{(n}\>\mathit{\leq\mathit{\mathit{iter}{}}\>\mathit{\mathit{add}{}}\>\mathit{0}\>\mathit{n)}}}\end{array}$$

$$\begin{array}[]{l}\forall xyz.\,z=x+y\Rightarrow\mathit{\mathit{Add}{}}\>\mathit{x}\>\mathit{y}\>\mathit{z}\\ \forall fsnm.\,n\leq 0\wedge m=s\Rightarrow\mathit{\mathit{Iter}{}}\>\mathit{f}\>\mathit{s}\>\mathit{n}\>\mathit{m}\\ \forall fsnm.\,n>0\wedge\big{(}\exists p.\,\mathit{\mathit{Iter}{}}\>\mathit{f}\>\mathit{s}\>\mathit{(n-1)}\>\mathit{p}\wedge\mathit{f}\>\mathit{n}\>\mathit{p}\>\mathit{m}\big{)}\Rightarrow\mathit{\mathit{Iter}{}}\>\mathit{f}\>\mathit{s}\>\mathit{n}\>\mathit{m}\\ \forall nm.\,\mathit{\mathit{Iter}{}}\>\mathit{\mathit{Add}{}}\>\mathit{0}\>\mathit{n}\>\mathit{m}\Rightarrow n\leq m\end{array}$$

$$Add\mapsto \lambda xyz.z=x+yIter\mapsto \lambda fsnm.(\forall xyz.fxyz\Rightarrow 0<x\Rightarrow y<z)\wedge 0\le s\Rightarrow n\le m$$

$$\begin{array}[]{l}\mathit{Add}\!\!:x{:}\mathit{\mathsf{int}}\to\mathit{y{:}\mathit{\mathsf{int}}\to\mathit{z{:}\mathit{\mathsf{int}}\to\mathit{o\langle\mathit{z}\>\mathit{=}\>\mathit{x}\>\mathit{+}\>\mathit{y}\rangle}}}\\ \mathit{Iter}\!\!:(x{:}\mathit{\mathsf{int}}\to\mathit{y{:}\mathit{\mathsf{int}}\to\mathit{z{:}\mathit{\mathsf{int}}\to\mathit{o\langle\mathit{0}\>\mathit{<}\>\mathit{x}\>\mathit{\Rightarrow y}\>\mathit{<}\>\mathit{z}\rangle}}})\to s{:}\mathit{\mathsf{int}}\to\mathit{n{:}\mathit{\mathsf{int}}\to\mathit{m{:}\mathit{\mathsf{int}}\to\mathit{o\langle\mathit{0\leq s}\>\mathit{\Rightarrow n}\>\mathit{\leq m}\rangle}}}\end{array}$$

$${\Gamma }_I,n:\mathsf{int},m:\mathsf{int}⊢IterAdd0nm:o⟨n\le m⟩$$

$$\mathsf{order}(\iota )=1\mathsf{order}(o)=1\mathsf{order}({\sigma }_1\to {\sigma }_2)=\mathsf{max}(\mathsf{order}({\sigma }_1)+1,\mathsf{order}({\sigma }_2))$$

$$\begin{array}[]{rcl}M,\,N&\Coloneqq&x\mid c\mid\mathit{M}\>\mathit{N}\mid\lambda x\!\!:\!\!\sigma.\,\mathit{M}\end{array}$$

$$\begin{array}[]{ccc}\begin{array}[]{rcl}\mathsf{true},\mathsf{false}&:&o\\ {\wedge},{\vee},{\Rightarrow}&:&o\to o\to o\\ \end{array}&\phantom{woo}&\begin{array}[]{rcl}{\neg}&:&o\to o\\ {\forall_{\sigma}},{\exists_{\sigma}}&:&(\sigma\to o)\to o\end{array}\end{array}$$

$$\rho ::=o\mid \iota \to \rho \mid \rho \to \rho$$

$$\mathcal{S}[[\iota ]]:=A_{\iota }\mathcal{S}[[o]]:=\text{mathbbm}2\mathcal{S}[[{\sigma }_1\to {\sigma }_2]]:=\mathcal{S}[[{\sigma }_1]]\Rightarrow \mathcal{S}[[{\sigma }_2]]$$

$$\begin{array}[]{cc}\begin{array}[]{rcl}\mathsf{or}(b_{1})(b_{2})&=&\max\{b_{1},b_{2}\}\\ \mathsf{and}(b_{1})(b_{2})&=&\min\{b_{1},b_{2}\}\\ \mathsf{exists}_{\sigma}(f)&=&\max\{f(v)\mid v\in\llbracket\sigma\rrbracket\}\end{array}&\begin{array}[]{rcl}\mathsf{not}(b)&=&1-b\\ \mathsf{implies}(b_{1})(b_{2})&=&\mathsf{or}(\mathsf{not}(b_{1}))(b_{2})\\ \mathsf{forall}_{\sigma}(f)&=&\mathsf{not}(\mathsf{exists}_{\sigma}(\mathsf{not}\circ f))\end{array}\end{array}$$

$$\begin{array}[]{rcl}\mathcal{S}\llbracket\Delta\vdash x:\sigma\rrbracket(\alpha)&=&\alpha(x)\\ \mathcal{S}\llbracket\Delta\vdash c:\sigma\rrbracket(\alpha)&=&c^{A}\\ \mathcal{S}\llbracket\Delta\vdash\mathit{M}\>\mathit{N}:\sigma_{2}\rrbracket(\alpha)&=&\mathcal{S}\llbracket\Delta\vdash M:\sigma_{1}\to\sigma_{2}\rrbracket(\alpha)\big{(}\mathcal{S}\llbracket\Delta\vdash N:\sigma_{1}\rrbracket(\alpha)\big{)}\\ \mathcal{S}\llbracket\Delta\vdash\lambda x:\sigma_{1}.\,\mathit{M}:\sigma_{1}\to\sigma_{2}\rrbracket(\alpha)&=&\lambda v\in\mathcal{S}\llbracket\sigma_{1}\rrbracket.\,\mathit{\mathcal{S}\llbracket\Delta,x:\sigma_{1}\vdash M:\sigma_{2}\rrbracket(\alpha[x}\>\mathit{\mapsto v])}\\ \end{array}$$

$$\begin{array}[]{rcl}G&\Coloneqq&M\mid\varphi\mid G\wedge G\mid G\vee G\mid\exists x\!\!:\!\!\sigma.\>G\\ D&\Coloneqq&\mathsf{true}\mid\forall x\!\!:\!\!\sigma.\>D\mid D\wedge D\mid G\Rightarrow\mathit{X}\>\mathit{\overline{x}}\\ \end{array}$$

$$\begin{array}[]{rl}\mathit{Add}{}\!\!:&\mathsf{int}\to\mathsf{int}\to\mathsf{int}\to o\\ \mathit{Iter}{}\!\!:&(\mathsf{int}\to\mathsf{int}\to\mathsf{int}\to o)\to\mathsf{int}\to\mathsf{int}\to\mathsf{int}\to o\end{array}$$

$$\begin{array}[]{l}\forall x\,y\,z.\,z=x+y\Rightarrow\mathit{\mathit{Add}{}}\>\mathit{x}\>\mathit{y}\>\mathit{z}\\ \forall f\,s\,n\,m.\,n\leq 0\wedge m=0\Rightarrow\mathit{\mathit{Iter}{}}\>\mathit{f}\>\mathit{s}\>\mathit{n}\>\mathit{m}\\ \forall f\,s\,n\,m.\,(\exists p.\,n>0\wedge\mathit{\mathit{Iter}{}}\>\mathit{f}\>\mathit{s}\>\mathit{(n-1)}\>\mathit{p}\wedge\mathit{f}\>\mathit{n}\>\mathit{p}\>\mathit{m})\Rightarrow\mathit{\mathit{Iter}{}}\>\mathit{f}\>\mathit{s}\>\mathit{n}\>\mathit{m}\end{array}$$

$$\Delta ⊢\forall x.xQ\Rightarrow Px:o$$

$$\begin{array}[]{ccccccc}\mathsf{a}\coloneqq\begin{array}[]{rcl}\mathbf{0}&\mapsto&0\\ \mathbf{1}&\mapsto&1\\ \end{array}&&\mathsf{b}\coloneqq\begin{array}[]{rcl}\mathbf{0}&\mapsto&0\\ \mathbf{1}&\mapsto&0\\ \end{array}&&\mathsf{c}\coloneqq\begin{array}[]{rcl}\mathbf{0}&\mapsto&1\\ \mathbf{1}&\mapsto&1\\ \end{array}&&\mathsf{d}\coloneqq\begin{array}[]{rcl}\mathbf{0}&\mapsto&1\\ \mathbf{1}&\mapsto&0\\ \end{array}\\ \end{array}$$

$$\begin{array}[]{ccc}\begin{array}[]{ccc}\lx@intercol\hfil\alpha_{1}(Q)=\mathbf{0}\hfil\lx@intercol\\ \alpha_{1}(P)(\mathbf{a})=0&&\alpha_{1}(P)(\mathbf{b})=0\\ \alpha_{1}(P)(\mathbf{c})=1&&\alpha_{1}(P)(\mathbf{d})=1\\ \end{array}&&\begin{array}[]{ccc}\lx@intercol\hfil\alpha_{2}(Q)=\mathbf{1}\hfil\lx@intercol\\ \alpha_{2}(P)(\mathbf{a})=1&&\alpha_{2}(P)(\mathbf{b})=0\\ \alpha_{2}(P)(\mathbf{c})=1&&\alpha_{2}(P)(\mathbf{d})=0\\ \end{array}\end{array}$$

$$x_1:{\rho }_1=G_1,\dots ,x_m:{\rho }_m=G_m$$

$$\forall \overline{x_{r_1}}.G_1\Rightarrow X_{r_1}\overline{x_{r_1}}\wedge \cdots \wedge \forall \overline{x_{r_{\ell }}}.G_{\ell }\Rightarrow X_{r_{\ell }}\overline{x_{r_{\ell }}}$$

$$X_1=\lambda \overline{x_1}.G_1^{\prime },\dots ,X_k=\lambda \overline{x_k}.G_k^{\prime }$$

$$Add=\lambda xyz.z=x+yIter=\lambda fsnm.(n\le 0\wedge m=s)\vee (\exists p.0<n\wedge Iterfs(n-1)p\wedge fnpm)$$

$$\begin{array}[]{rcl}\mathcal{M}\llbracket\Delta\vdash x:\rho\rrbracket(\alpha)&=&\alpha(x)\\ \mathcal{M}\llbracket\Delta\vdash\varphi:o\rrbracket(\alpha)&=&\mathcal{S}\llbracket\Delta\vdash\varphi:o\rrbracket(\alpha)\\ \mathcal{M}\llbracket\Delta\vdash\mathit{G}\>\mathit{H}:\rho_{2}\rrbracket(\alpha)&=&\mathcal{M}\llbracket\Delta\vdash G:\rho_{1}\to\rho_{2}\rrbracket(\alpha)(\mathcal{M}\llbracket\Delta\vdash H:\sigma_{1}\rrbracket(\alpha))\\ \mathcal{M}\llbracket\Delta\vdash\mathit{G}\>\mathit{N}:\rho\rrbracket(\alpha)&=&\mathcal{M}\llbracket\Delta\vdash G:\iota\to\rho\rrbracket(\alpha)(\mathcal{S}\llbracket\Delta\vdash N:\iota\rrbracket(\alpha))\\ \mathcal{M}\llbracket\Delta\vdash\lambda x:\sigma.\,\mathit{G}:\sigma\rrbracket(\alpha)&=&\lambda x^{\prime}\in\mathcal{M}\llbracket\sigma\rrbracket.\,\mathit{\mathcal{M}\llbracket\Delta,x:\sigma\vdash G:\sigma\rrbracket(\alpha[x}\>\mathit{\mapsto x^{\prime}])}\\ \mathcal{M}\llbracket\Delta\vdash\wedge:o\to o\to o\rrbracket(\alpha)&=&\mathsf{and}\\ \mathcal{M}\llbracket\Delta\vdash\vee:o\to o\to o\rrbracket(\alpha)&=&\mathsf{or}\\ \mathcal{M}\llbracket\Delta\vdash\exists_{\sigma}:(\sigma\to o)\to o\rrbracket(\alpha)&=&\mathsf{mexists}_{\sigma}\end{array}$$

$$\mathcal{M}[[\iota ]]:=A_{\iota }\mathcal{M}[[o]]:=\text{mathbbm}2\mathcal{M}[[{\sigma }_1\to {\sigma }_2]]:=\mathcal{M}[[{\sigma }_1]]{\Rightarrow }_m\mathcal{M}[[{\sigma }_2]]$$

$$J(r)(t)=\{\begin{array}{ll}r(t)& \text{if t∈M[[(int→o)→o)]]}\\ 0& \text{otherwise}\end{array}$$

$$\mathcal{S}[[\rho ]]\text{galoiS}{\mathsf{L}}_{\rho }{\mathsf{I}}_{\rho }\mathcal{M}[[\rho ]]\text{Galois}{\mathsf{J}}_{\rho }{\mathsf{U}}_{\rho }\mathcal{S}[[\rho ]]$$

$$\begin{array}[]{ccc}\begin{array}[]{rcl}\mathsf{I}_{o}(b)&=&b\\ \mathsf{I}_{\iota\to\rho}(r)&=&\mathsf{I}_{\rho}\circ r\\ \mathsf{I}_{\rho_{1}\to\rho_{2}}(r)&=&\mathsf{I}_{\rho_{2}}\circ r\circ\mathsf{L}_{\rho_{1}}\end{array}&&\begin{array}[]{rcl}\mathsf{J}_{o}(b)&=&b\\ \mathsf{J}_{\iota\to\rho}(r)&=&\mathsf{J}_{\rho}\circ r\\ \mathsf{J}_{\rho_{1}\to\rho_{2}}(r)&=&\mathsf{J}_{\rho_{2}}\circ r\circ\mathsf{U}_{\rho_{1}}\end{array}\end{array}$$

$$\mathsf{I}_{\rho_{1}\to\rho_{2}}(r)(s)=\mathsf{I}_{\rho_{2}}\big{(}r(\bigcap\{t\mid s\subseteq\mathsf{I}_{\rho_{1}}(t)\})\big{)}\quad\text{and}\quad\mathsf{J}_{\rho_{1}\to\rho_{2}}(r)(s)=\mathsf{J}_{\rho_{2}}\big{(}r(\bigcup\{t\mid\mathsf{J}_{\rho_{1}}\subseteq s\})\big{)}.$$

$$\mathcal{M}[[{\rho }_1]]{\Rightarrow }_m\mathcal{M}[[{\rho }_2]]\stackrel{r\mapsto {\mathsf{I}}_{{\rho }_2}\circ r\circ {\mathsf{L}}_{{\rho }_1}}{\to }\mathcal{S}[[{\rho }_1]]{\Rightarrow }_m\mathcal{S}[[{\rho }_2]]\stackrel{s\mapsto s}{\to }\mathcal{S}[[{\rho }_1]]\Rightarrow \mathcal{S}[[{\rho }_2]]$$

$${\mathsf{I}}_{\Delta }(\alpha )(x)=\{\begin{array}{ll}\alpha (x)& \text{if Δ(x)=ι}\\ {\mathsf{I}}_{\Delta (x)}(\alpha (x))& \text{otherwise}\end{array}{\mathsf{J}}_{\Delta }(\alpha )(x)=\{\begin{array}{ll}\alpha (x)& \text{if Δ(x)=ι}\\ {\mathsf{J}}_{\Delta (x)}(\alpha (x))& \text{otherwise}\end{array}$$

Full text

1 Introduction

There is evidence to suggest that many first-order program verification problems can be framed as solvability problems for systems of constrained Horn clauses Beyene et al. (2013); Bjørner et al. (2013b, 2015), which are Horn clauses of first-order logic containing constraints expressed in some suitable background theory. This makes the study of these systems particularly worthwhile since they provide a purely logical basis on which to develop techniques for first-order program verification. For example, results on the development of highly efficient constrained Horn clause solvers Grebenshchikov et al. (2012); Hoder et al. (2011); Gurfinkel et al. (2015) can be exploited by a large number of program verification tools, each of which offloads some complex task (invariant finding is a typical example) to a solver by framing it in terms of constrained Horn clauses.

This paper concerns automated verification of higher-order, functional programs. Whilst there are approaches to the verification of functional programs in which constrained Horn clause solving plays an important role, there is inevitably a mismatch between the higher-order nature of the program and the first-order logic in which the Horn clauses are expressed, and this must be addressed in some intelligent way by the program verifier. For example, in recent work on refinement types Rondon et al. (2008); Vazou et al. (2015); Unno et al. (2013), a type system is used to reduce the problem of finding an invariant for the higher-order program, to finding a number of first-order invariants of the ground-type data at certain program points. This latter problem can often be expressed as a system of constrained Horn clauses. When that system is solvable, the first-order invariants obtained can be composed in the type system to yield a higher-order invariant for the program (expressed as a type assignment).

In this paper we introduce higher-order constrained Horn clauses, a natural extension of the notion of constrained Horn clause to higher-order logic, and examine certain aspects that we believe are especially relevant to applications in higher-order program verification, namely: the existence of canonical solutions, the applicability of existing techniques to automated solving and the expressibility of program properties of higher type.

Let us elaborate on these goals and illustrate our motivation more concretely by discussing a particular example. Consider the following higher-order program:

[TABLE]

The term $\mathit{\mathit{iter}{}}\>\mathit{\mathit{add}{}}\>\mathit{0}\>\mathit{n}$ occurring in the last line of the program is the sum of the integers from $1$ to $n$ in case $n$ is non-negative and is [math] otherwise. Let us say that the program is safe just in case the assertion is never violated, i.e. the summation is not smaller than $n$.

To verify safety, we must find an invariant that implies the required property. For our purposes, an invariant will be an over-approximation of the input-output graphs of the functions defined in the program. If we can find an over-approximation of the graph of the function $\mathit{\mathit{iter}{}}\>\mathit{\mathit{add}{}}\>\mathit{0}$ which does not contain any pair $(n,m)$ with $n>m$, then we can be certain that the guard on the assertion is never violated. Hence, we seek a set of pairs of natural numbers relating $n$ to $m$ at least whenever $\mathit{iter}\ \mathit{add}\ 0\ n$ evaluates to $m$ and which has no intersection with $>$.

The idea is to express the problem of finding such a program invariant logically, as a satisfiability problem for the following set of higher-order constrained Horn clauses:

[TABLE]

The clauses constrain the variables $\mathit{Add}:\mathsf{int}\to\mathsf{int}\to\mathsf{int}\to o$ and $\mathit{Iter}\!\!:(\mathsf{int}\to\mathsf{int}\to\mathsf{int}\to o)\to\mathsf{int}\to\mathsf{int}\to\mathsf{int}\to o$ with respect to the theory of integer linear arithmetic, so a model is just an assignment of particular relations111Throughout this paper we will speak of relations but work with their characteristic functions, which are propositional (Boolean-valued) functions, using $o$ for the sort of propositions. to these variables that satisfies the formulas. The first clause constrains $\mathit{Add}$ to be an over-approximation of the graph of the addition function $\mathit{add}{}$: whenever $z=x+y$, we at least know that $x,y$ and $z$ are related by $\mathit{Add}$. The second and third constrain $\mathit{Iter}$ to be an over-approximation of the graph of the iteration combinator $\mathit{iter}$. Observe that the two branches of the conditional in the program appear as two clauses, expressing over-approximations in which the third input $n$ is at most or greater than [math] respectively. The final clause ensures that, taken together, these over-approximations are yet precise enough that they exclude the possibility of relating an input $n$ of $\mathit{iter}\ \mathit{add}\ 0$ to a smaller output $m$. In other words, a model of these formulas is an invariant, in the sense we have described above, and thus constitutes a witness to the safety of the program.

Notice that what we are describing in this example is a compositional approach, in which an over-approximation $\mathit{Iter}\ \mathit{Add}\ 0:\mathsf{int}\to\mathsf{int}\to o$ to the graph of the function $\mathit{iter}\ \mathit{add}\ 0:\mathsf{int}\to\mathsf{int}$ is constructed from over-approximations $\mathit{Add}$ and $\mathit{Iter}$ of the graphs of the functions $\mathit{add}$ and $\mathit{iter}$. Consequently, where $\mathit{iter}$ was a higher-order function, $\mathit{Iter}$ is a higher-order relation taking a ternary relation on integers as input, and the quantification $\forall f$ is over all such ternary relations $f$. However, for the purposes of this paper, the details of how one obtains a system of higher-order constrained Horn clauses are not actually relevant, since we here study properties of such systems independently of how they arise.

Existence of canonical solutions.

A set of higher-order constrained Horn clauses may have many models or none (consider that there are many invariants that can prove a safety property or none in case it is unprovable). One model of the above set of clauses is the following assignment of relations (expressed in higher-order logic):

[TABLE]

Notice that this represents quite a large model (a coarse invariant). For example, under this assignment the relation described by $\mathit{Iter}\ \mathit{Add}\ (-1)$ relates every pair of integers $n$ and $m$. In the case of first-order constrained Horn clauses over the theory of integer linear arithmetic, if a set of clauses has a model, then it has a least model222In general, one can say that for each model of the background theory, a satisfiable set of clauses has a least satisfying valuation., and this least model property is at the heart of many of the applications of Horn clauses in practice. If we consider the use of constrained Horn clauses in verification, a key component of the design of many successful algorithms for solving systems of clauses (and program invariant finding more generally) is the notion of approximation or abstraction. However, to speak of approximation presupposes there is something to approximate. For program verifiers there is, for example, the set of reachable states or the set of traces of the program, and for first-order constrained Horn clause solvers there is the least model.

In contrast, in Section 4 we show that satisfiable systems of higher-order constrained Horn clauses do not necessarily have least models. The problem, which has also been observed for pure (without constraint theory) higher-order Horn clauses by Charalambidis et al. (2013), can be attributed to the use of unrestricted quantification over relations. By restricting the semantics, so that interpretations range only over monotone relations (monotone propositional functions), we ensure that systems do have least solutions, but at the cost of abandoning the standard (semantics of) higher-order logic. The monotone semantics is natural but, for the purpose of specifying constraint systems, it can be unintuitive. For example, consider the formula $\forall x.\,(\exists yz.\,x\ y\wedge y\ z)\Rightarrow P\ x$ which constrains $P:((\mathsf{int}\to o)\to o)\to o$ so that it is at least true of all non-empty sets of non-empty sets of integers 333Viewing relations of sort $\mathsf{int}\to o$ as sets of integers.. In the monotone semantics, this formula is guaranteed to have a least model, but inside that model $P$ is not true of the set $\{\{0\}\}$.

Ideally, we would like to be able to specify constraint systems using the standard semantics of higher-order logic, but solve (build solvers for) systems in the monotone semantics. In fact, we show that this is possible: we construct a pair of adjoint mappings with which the solutions to the former can be mapped to solutions of the latter and vice versa. This allows us to reduce the problem of solving an system of constraints in the standard semantics to the problem of solving a system in the monotone semantics. Monotonicity and the fact that satisfiable monotone systems have canonical solutions are key to the rest of the work in the paper.

Applicability of existing techniques to automated solving.

Many of the techniques developed originally for the automation of first-order program verification transfer well to first-order constrained Horn clause solving. Hence, to construct automated solvers for systems of higher-order clauses, we look to existing work on higher-order program verification. In automated verification for functional programs, one of the most successful techniques of recent years has been based on refinement type inference Rondon et al. (2008); Kobayashi et al. (2011); Vazou et al. (2015); Zhu and Jagannathan (2013). The power of the approach comes from its ability to lift rich first-order theories over data to higher types using subtyping and the dependent product.

In Section 5, we develop a refinement type system for higher-order constrained Horn clauses, in which types are assigned to the free relation variables that are being solved for. The idea is that a valid type assignment is a syntactic representation of a model. For example, the model discussed previously can be represented by the type assignment $\Gamma_{I}$:

[TABLE]

The correspondence hinges on the definition of refinements $o\langle\mathit{\varphi}\rangle$ of the propositional sort $o$, which are parametrised by a first-order constraint formula $\varphi$ describing an upper bound on the truth of any inhabitant. The dependent product and integer types are interpreted standardly, so that the first type above can be read as the set of all ternary relations on integers $x,y$ and $z$ that are false whenever $z$ is not $x+y$.

The system is designed so that its soundness allows one to conclude that a given first-order constraint formula can be used to approximate a given higher-order formula444Technically, the subjects of the type system are not all higher-order formulas but only the so-called goal formulas.. Given a formula $G$, from the derivability of the judgement $\Gamma\vdash G:o\langle\mathit{\varphi}\rangle$ it follows that $G\Rightarrow\varphi$ in those interpretations of the relational variables that satisfy $\Gamma$. For example, the judgement

[TABLE]

is derivable, from which we may conclude that $n\leq m$ is a sound abstraction of $\mathit{Iter}\ \mathit{Add}\ 0\ n\ m$ in any interpretation of $\mathit{Iter}$ and $\mathit{Add}$ that satisfies $\Gamma_{I}$. This is a powerful assertion for automated reasoning because the formula $\varphi$ in refinement type $o\langle\mathit{\varphi}\rangle$ is a simple first-order constraint formula (typically belonging to a decidable theory) whereas the formula $G$ in the subject is a complicated higher-order formula, possibly containing relational variables whose meanings are a function of the whole system. By adapting machinery developed for refinement type inference of functional programs, we obtain a sound (but incomplete) procedure for solving systems of higher-order constrained Horn clauses. An implementation shows the method to be feasible.

Expressibility of program properties of higher type.

We say that a property is of higher type if it is a property of a higher-order function. It is possible to do whole-program verification in a higher-order setting using only properties of first-order type, because a complete program typically has a first-order type like $\mathsf{int}\to\mathsf{int}$. However, it is also natural to want to specify properties of higher types, for example properties of higher-order functions of type $(\mathsf{int}\to\mathsf{int})\to\mathsf{int}$. Even when the ultimate goal is one of whole-program verification, being able to verify properties of higher types is advantageous because it can allow a large analysis to be broken down into smaller components according to the structure of the program.

However, the kinds of higher-type properties expressible by higher-order constrained Horn clauses is not immediately clear. Therefore, we conclude Section 5 by showing that it is possible to state at least those properties that can be defined using refinement types, since their complements are expressible using goal terms.

The rest of the paper is structured as follows. In Section 2 we fix our presentation of higher-order logic and the notion of higher-order constrained Horn clause is made precise in Section 3 along with the associated definition of solvability. Section 4 introduces monotone logic programs, which are better suited to automated reasoning, and shows that solvability of higher-order constrained Horn clause problems can be reduced to solvability of these programs. This class of logic programs forms the basis for the refinement type system defined in Section 5, which yields a sound but incomplete method for showing solvability through type inference. An implementation of the method is also discussed in this section, which concludes by discussing the definability of higher-type properties defined by refinement types. Finally, in Section 6, we discuss related work and draw conclusions in Section 7. Full proofs are included in the appendices.

2 Higher-order logic

We will work in a presentation of higher-order logic as a typed lambda calculus.

Sorts.

Given a sort $\iota$ of individuals (for example $\mathsf{int}$), and a sort $o$ of propositions, the general sorts are just the simple types that can be built using the arrow: $\sigma\Coloneqq\iota\mid o\mid\sigma_{1}\to\sigma_{2}$. The order of a sort $\sigma$, written $\mathsf{order}(\sigma)$, is defined as follows:

[TABLE]

Note: we follow the convention from logic of regarding base sorts to be of order $1$. Consequently, we will consider, for example, an $\mathsf{int}$ variable to be of order $1$ and an $(\mathsf{int}\to o)\to\mathsf{int}$ function to be of order $3$.

Terms.

The terms that we consider are just terms of an applied lambda calculus. We will write variables generally using $x,y,z$, or $X,Y,Z$ when we want to emphasise that they are of higher-order sorts.

[TABLE]

in which $c$ is a constant. We assume that application associates to the left and the scope of the abstraction extends as far to the right as possible. We identify terms up to $\alpha$-equivalence.

Sorting

A sort environment, typically $\Delta$, is a finite sequence of pairs $x:\sigma$, all of whose subjects are required to be distinct. We assume, for each constant $c$, a given sort assignment $\sigma_{c}$. Then sorting rules for terms are, as standard, associated with the judgement $\Delta\vdash s:\sigma$ defined by:

(SCst)

$\Delta\vdash c:\sigma_{c}$

(SVar)

$\Delta_{1},x:\sigma,\Delta_{2}\vdash x:\sigma$

$\Delta\vdash s:\sigma_{1}\to\sigma_{2}$         $\Delta\vdash t:\sigma_{1}$

(SApp)

$\Delta\vdash\mathit{s}\>\mathit{t}:\sigma_{2}$

$\Delta,x:\sigma_{1}\vdash s:\sigma_{2}$

(SAbs)                    $x\notin\mathsf{dom}(\Delta)$

$\Delta\vdash\lambda x.\,\mathit{s}:\sigma_{1}\to\sigma_{2}$

Given a sorted term $\Delta\vdash M:\sigma$, we say that a variable occurrence $x$ in $M$ is of order k just if the unique subderivation $\Delta^{\prime}\vdash x:\sigma^{\prime}$ rooted at this occurrence has $\sigma^{\prime}$ of order $k$. We say that a sorted term $\Delta\vdash M:\sigma$ is of order $k$ just if $k$ is the largest order of any of the variables occurring in $M$.

Formulas.

Given a first-order signature $\Sigma$ specifying a collection of base sorts and sorted constants, we can consider higher-type formulas over $\Sigma$, by considering terms whose constant symbols are either drawn from the signature $\Sigma$ or are a member of the following set $\mathsf{LSym}$ of logical constant symbols:

[TABLE]

As usual, we write $\exists_{\sigma}(\lambda x\!\!:\!\!\sigma.\,\mathit{M})$ more compactly as $\exists x\!\!:\!\!\sigma.\,M$ and define the set of formulas to be just the well-sorted terms of sort $o$. In the context of formulas, it is worthwhile to recognise the subset of relational sorts, typically $\rho$, which have the sort $o$ in tail position and whose higher-order subsorts are also relational. Formally:

[TABLE]

Since formulas are just terms, the notion of order carries over without modification.

Interpretation.

Let $A$ be a $\Sigma$-structure. In particular, we assume that $A$ assigns a non-empty set $A_{\iota}$ to each of the base sorts $\iota\in B$ and to the sort $o$ is assigned the distinguished lattice $\mathbbm{2}=\{0\leq 1\}$. We define the full sort frame over $A$ by induction on the sort:

[TABLE]

where $X\Rightarrow Y$ is the full set-theoretic function space between sets $X$ and $Y$. The lattice $\mathbbm{2}$ supports the following functions:

[TABLE]

We extend the order on $\mathbbm{2}$ to order the set $\mathcal{S}\llbracket\rho\rrbracket$ of all relations of a given sort $\rho$ pointwise, defining the order $\subseteq_{\rho}$ inductively on the structure of $\rho$:

• •

For all $b_{1},b_{2}\in\mathcal{S}\llbracket o\rrbracket$: if $b_{1}\leq b_{2}$ then $b_{1}\subseteq_{o}b_{2}$

• •

For all $r_{1},r_{2}\in\mathcal{S}\llbracket\iota\to\rho\rrbracket$: if, for all $n\in\mathcal{S}\llbracket\iota\rrbracket$, $r_{1}(n)\subseteq_{\rho}r_{2}(n)$, then $r_{1}\subseteq_{\iota\to\rho}r_{2}$.

• •

For all $r_{1},r_{2}\in\mathcal{S}\llbracket\rho_{1}\to\rho_{2}\rrbracket$: if, for all $s\in\mathcal{S}\llbracket\rho_{1}\rrbracket$, $r_{1}(s)\subseteq_{\rho_{2}}r_{2}(s)$, then $r_{1}\subseteq_{\rho_{1}\to\rho_{2}}r_{2}$.

This ordering determines a complete lattice structure on each $\mathcal{S}\llbracket\rho\rrbracket$, we will denote the (pointwise) join and meet by $\bigcup_{\rho}$ and $\bigcap_{\rho}$ respectively. To aid readability, we will typically omit subscripts.

We interpret a sort environment $\Delta$ by the indexed product: $\mathcal{S}\llbracket\Delta\rrbracket\coloneqq\Pi x\in\mathsf{dom}(\Delta).\mathcal{S}\llbracket\Delta(x)\rrbracket$, that is, the set of all functions on $\mathsf{dom}(\Delta)$ that map $x$ to an element of $\mathcal{S}\llbracket\Delta(x)\rrbracket$; these functions, typically $\alpha$, are called valuations. We similarly order $\mathcal{S}\llbracket\Delta\rrbracket$ pointwise, with $f_{1}\subseteq_{\Delta}f_{2}$ just if, for all $x\!\!:\!\!\rho\in\Delta$, $f_{1}(x)\subseteq_{\rho}f_{2}(x)$; thus determining a complete lattice structure.

For the purpose of interpreting formulas, we extend the structure $A$ to interpret the symbols from $\mathsf{LSym}$ according to the functions given above. The interpretation of a term $\Delta\vdash M:\sigma$ is a function $\mathcal{S}\llbracket\Delta\vdash M:\sigma\rrbracket$ (we leave $A$ implicit) that belongs to the set $\mathcal{S}\llbracket\Delta\rrbracket\Rightarrow\mathcal{S}\llbracket\sigma\rrbracket$, and which is defined by the following equations.

[TABLE]

Satisfaction

For a $\Sigma$-structure $A$, a formula $\Delta\vdash M:o$ and a valuation $\alpha\in\mathcal{S}\llbracket\Delta\rrbracket$, we say that $\langle A,\alpha\rangle$ satisfies $M$ and write $A,\alpha\vDash M$ just if $\mathcal{S}\llbracket\Delta\vdash M:o\rrbracket(\alpha)=1$. We define entailment $M\vDash N$ between two formulas $M$ and $N$ in terms of satisfaction as usual.

3 Higher-order constrained Horn clauses

We introduce a notion of constrained Horn clauses in higher-order logic.

Constraint language.

Assume a fixed, first-order language over a first-order signature $\Sigma$, consisting of: distinguished subsets of first-order terms $\mathit{Tm}$ and first-order formulas $(\varphi\in)$ $\mathit{Fm}$, and a first-order theory $\mathit{Th}$ in which to interpret those formulas. We refer to this first-order language as the constraint language, and $\mathit{Th}$ as the background theory.

Atoms and constraints.

An atom is an applicative formula of shape $\mathit{X}\>\mathit{M_{1}}\>\mathit{\cdots M_{k}}$ in which $X$ is a relational variable and each $M_{i}$ is a term. A constraint, $\varphi$, is just a formula from the constraint language. For technical convenience, we assume that atoms do not contain any constants (including logical constants), and constraints do not contain any relational variables.

Constrained Horn clauses.

Fix a sorting $\Delta$ of relational variables. The constrained goal formulas over $\Delta$, typically $G$, and the constrained definite formulas over $\Delta$, typically $D$, are the subset of all formulas defined by induction:

[TABLE]

in which $\sigma$ is either the sort of individuals $\iota$ or a relational sort $\rho$, $M$ is an atom555We do not require the head variable of $M$ to be in $\mathsf{dom}(\Delta)$., $\varphi$ a constraint and, in the last alternative, $X$ is required to be a relational symbol inside $\mathsf{dom}(\Delta)$ and $\overline{x}=x_{1}\cdots x_{n}$ a sequence of pairwise distinct variables. It will often be convenient to view a constrained definite formula equivalently as a conjunction of (constrained) definite clauses, which are those definite formulas with shape: $\forall\overline{x}.\,G\Rightarrow X\,\overline{x}$.

Remark 1**.**

Our class of constrained definite formulas resembles the definitional fragment of Wadge (1991), due to the restrictions on the shape of $\mathit{X}\>\mathit{\overline{x}}$ occurring in the head of definite clauses. However, the formalism discussed in loc. cit., which was intended as a programming language, also restricted the existential quantifiers that could occur inside goal formulas and did not consider any notion of underlying constraint language.

Problem.

A (higher-order) Constrained Horn Clause Problem is given by a tuple $\langle\Delta,D,G\rangle$ in which:

• •

$\Delta$ is a sorting of relational variables.

• •

$\Delta\vdash D:o$ is a constrained definite formula over $\Delta$.

• •

$\Delta\vdash G:o$ is a constrained goal formula over $\Delta$.

The problem is of order $k$ if $k$ is the largest order of the bound variables that occur in $D$ or $G$. We say that such a problem is solvable just if, for all models $A$ of the background theory $\mathit{Th}$, there exists a valuation $\alpha$ of the variables in $\Delta$ such that $A,\alpha\vDash D$, and yet $A,\alpha\not\vDash G$.

Remark 2**.**

The presentation of the problem follows some of the literature for the use of first-order Horn clauses in verification. The system of higher-order constrained Horn clauses is partitioned into two, distinguishing the definite clauses as a single definite formula and presenting the negation of non-definite clauses as a single goal formula, which is required to be refuted by valuations. This better reflects the distinction between the program and the property to be proven. Furthermore, solvability is defined in a way that allows for incompleteness in the background theory to be used to express under-specification of programming language features (for example, because they are difficult to reason about precisely).

Example 1**.**

Let us place the motivating system of clauses from the introduction formally into the framework. To that end, let us fix the quantifier free fragment of integer linear arithmetic ($\mathsf{ZLA}$) as the underlying constraint language. The sorting $\Delta$ of relational variables (the unknowns to be solved for) are given by:

[TABLE]

The higher-order constrained definite formula $D$ consists of a conjunction of the following three constrained definite clauses:

[TABLE]

Finally, the clause $\forall nm.\,\mathit{\mathit{Iter}{}}\>\mathit{\mathit{Add}{}}\>\mathit{0}\>\mathit{n}\>\mathit{m}\Rightarrow n\leq m$ expressing the property of interest is negated to give goal $G=\exists n\,m.\,\mathit{\mathit{Iter}{}}\>\mathit{\mathit{Add}{}}\>\mathit{0}\>\mathit{n}\>\mathit{m}\wedge m<n$. This problem is solvable. Being a complete theory, $\mathsf{ZLA}$ has one model up to isomorphism and, with respect to this model, the valuation given in the introduction satisfies $D$ but refutes $G$.

We believe that the generalisation of constrained horn clauses to higher orders is very natural. However, our principal motivation in its study is the possibility of obtaining interesting applications in higher-order program verification (analogous to those in first-order program verification with first-order constrained Horn clauses). We interpret higher-order program verification in its broadest sense, encompassing not just purely functional languages but, more generally, problems in which satisfaction of a property depends upon an analysis of higher-order control flow. For example, an early application of first-order constrained Horn clauses in the very successful constraint logic programming (CLP) paradigm of Jaffar and Maher (1994) was the analysis of circuit designs Heintze et al. (1992), for which systems of clauses were felt to be particularly suitable since they give a succinct, declarative specification of the analyses. The relative advantages of circuit design description using higher-order combinator libraries or specification languages based on higher-order programming, such as Bjesse et al. (1998), are well documented, and systems of higher-order of constrained Horn clauses would therefore be a natural setting in which to verify the properties of such designs.

4 Monotone models

One of the attractive features of first-order constrained Horn clauses is that, for any given choice of interpretation of the background theory, every definite formula (set of definite clauses) possesses a unique, least model. Consequently, it follows that there is a solution to a first-order Horn clause problem $\langle\Delta,D,G\rangle$ iff for each model of the background theory, the least model of $D$ refutes $G$. This reformulation of the problem is of great practical benefit because it allows for the design of algorithms that, at least conceptually, exploit the canonicity. For example, at the heart of the design of many successful algorithms for first-order Horn clause solving (and program invariant finding more generally) is the notion of approximation or abstraction. However, to speak of approximation presupposes there is something to approximate. For program verifiers there is, for example, the set of reachable states or the set of traces of the program, and for first-order constrained Horn clause solvers there is the least model.

The fact that first-order definite formulas possess a least model is paid for by restrictions placed on the syntax. By forbidding negative logical connectives in goal formulas, it can be guaranteed that the unknown relation symbols in any definite clause occur positively exactly once, and hence obtaining the consequences of a given formula is a monotone operation. We have made the same syntactic restrictions in our definition of higher-order constrained Horn formulas, but we do not obtain the same outcome.

Theorem 1**.**

Higher-order constrained definite formulas do not necessarily possess least models.

Proof.

Consider the sorting $\Delta_{\mathit{one}}$ of relational variables $P\!\!:((\mathsf{one}\to o)\to o)\to o$ and $Q\!\>:\mathsf{one}\to o$ and the definite formula $D_{\mathit{one}}$:

[TABLE]

over a finite constraint language consisting of the sort $\mathsf{one}$ of individuals and no functions, relations or constants of any kind. The language is interpreted in the background theory axiomatised by the sentence $\forall xy.x=y$, so that all models consist of a single individual $\mathcal{S}\llbracket\mathsf{one}\rrbracket=\{\star\}$. Let us use $\mathbf{0}$ to denote the mapping $\star\mapsto 0$ and $\mathbf{1}$ denote the mapping $\star\mapsto 1$, both of which together comprise the set $\mathcal{S}\llbracket\mathsf{one}\to o\rrbracket$; and let us name the elements of $\mathcal{S}\llbracket(\mathsf{one}\to o)\to o\rrbracket$ as follows:

[TABLE]

Then we can describe minimal models $\alpha_{1}$ and $\alpha_{2}$ by the following equations:

[TABLE]

It is easy to verify that there are no models smaller than these and yet they are unrelated, so there is no least model. ∎

A similar observation has been made in the pure (without constraint theory) setting by Charalambidis et al. (2013).

Some consideration of the proof of this theorem leads to the observation that, despite an embargo on negative logical connectives in goal formulas, it may still be the case that unknown relation symbols occur negatively in goal formulas (and hence may occur positively more than once in a definite clause). For example, consider the definite clause from above, namely: $\forall x.\,x\,Q\Rightarrow P\,x$. Whether or not $Q$ can be said to occur positively in the goal formula $x\,Q$ depends on the action of $x$. If we consider the subterm $\mathcal{S}\llbracket x\,Q\rrbracket$ as a function of $x$ and $Q$, then it is monotone in $Q$ only when the function assigned to $x$ is itself monotone. By contrast, if $x$ is assigned an antitone function, as is the case when $x$ takes on the value $\mathbf{d}$, then $\mathcal{S}\llbracket x\,Q\rrbracket$ will be antitone in $Q$; for example $\alpha_{1}(Q)\subseteq\alpha_{2}(Q)$ but $\mathcal{S}\llbracket x\,Q\rrbracket(\alpha_{2}[x\mapsto\mathbf{d}])\subseteq\mathcal{S}\llbracket x\,Q\rrbracket(\alpha_{1}[x\mapsto\mathbf{d}])$.

4.1 Logic programs

As we show in the following section, by restricting to an interpretation in which every function is monotone (in the logical order) we can obtain a problem in which there is a notion of least solution666Recall that least (respectively monotone) here refers to smallest in (preservation of) the logical order, i.e. with respect to inclusion of relations.. However, in doing so it seems that we sacrifice some of the logical purity of our original problem: if the universe of our interpretation contains only monotone functions, it does not include the function $\mathsf{implies}$ and so it becomes unclear how to interpret definite formulas. Consequently, it requires a new definition of what it means to be a model of a formula. Rather, the version of the problem we obtain by restricting to a monotone interpretation is much more closely related to work on the extensional semantics of higher-order logic programs e.g. Wadge (1991); Charalambidis et al. (2013), which emphasises the role of Horn clauses as definitions of rules. Hence, we present the monotone restriction in those terms.

Goal terms.

The class of well-sorted goal terms $\Delta\vdash G:\rho$ is given by the sorting judgements defined by the rules below, in which $c$ is one of $\wedge$, $\vee$ or $\exists_{\sigma}$ and here, and throughout the rules, $\sigma$ is required to stand for either the sort of individuals $\iota$ or otherwise some relational sort. It is easily verified that the constrained goal formulas are a propositional sorted subset of the goal terms. From now on we shall use $G$, $H$ and $K$ to stand for arbitrary goal terms and disambiguate as necessary.

Logic programs.

A higher-order, constrained logic program, $P$, over a sort environment $\Delta=x_{1}\!\!:\rho_{1},\ldots,x_{m}:\rho_{m}$ is just a finite system of (mutual) recursive definitions of shape:

[TABLE]

Such a program is well sorted when, for each $1\leq i\leq m$, $\Delta\vdash G_{i}:\rho_{i}$. Since each $x_{i}$ is distinct, we will sometimes regard a program $P$ as a finite map from variables to terms, defined so that $P(x_{i})=G_{i}$. We will write $\vdash P:\Delta$ to abbreviate that $P$ is a well-sorted program over $\Delta$.

Standard interpretation.

Logic programs can be interpreted in the standard semantics by interpreting the right-hand sides of the equations using the term semantics given in Section 2. The program $P$ itself then gives rise to the functional $T^{\mathcal{S}}_{P:\Delta}:\mathcal{S}\llbracket\Delta\rrbracket\Rightarrow\mathcal{S}\llbracket\Delta\rrbracket$, sometimes called the one-step consequence operator in the literature on the semantics of logic programming, which is defined by: $T^{\mathcal{S}}_{P:\Delta}(\alpha)(x)=\mathcal{S}\llbracket\Delta\vdash P(x):\Delta(x)\rrbracket(\alpha)$.

The logic program of a definite formula.

Every definite formula $D$ gives rise to a logic program, which is obtained by collapsing clauses that share the same head $\mathit{X}\>\mathit{\overline{x}}$ by taking the disjunction of their bodies, and viewing the resulting expression as a recursive definition of $X$. The formulation as logic program is more convenient in two ways. First, it is a more natural object to which to assign a monotone interpretation since we have eliminated implication, which does not act monotonically in its first argument, in favour of definitional equality. Second, looking ahead to Section 5, the syntactic structure of logic programs allows for a more transparent definition of a type system.

To that end, fix a definite formula $\Delta\vdash D:o$. We assume, without loss of generality777Observe that such a shape can always be obtained by applying standard logical equivalences., that $D$ has the shape:

[TABLE]

over a sort environment $\Delta=\{X_{1}\!\!:\rho_{1},\ldots,X_{k}\!\!:\rho_{k}\}$, i.e. $\{1,\ldots,k\}=\{r_{1},\ldots,r_{\ell}\}$. We construct a program over $\Delta$, called the logic program of $D$ and denoted $P_{D}$, as follows:

[TABLE]

where $G_{j}^{\prime}=\bigvee\{G_{i}\mid r_{i}=j\}$. Note that $\{G_{i}\mid r_{i}=j\}$ are exactly the bodies of all the definite clauses in $D$ whose heads are $X_{j}$. The fact that $\vdash P_{D}:\Delta$ follows immediately from the well-sortedness of $D$.

Example 2**.**

The definite formula component of the Horn clause problem from Example 1 is transformed into the following logic program $P$:

[TABLE]

Characterisation.

If we were to consider only the standard interpretation then the foregoing development of logic programs would have limited usefulness. As is well known at first-order, the definite formula and the program derived from it essentially define the same class of objects.

Lemma 1**.**

For definite formula $D$, the prefixed points of $T^{\mathcal{S}}_{P_{D}}$ are exactly the models of $D$.

In contrast to the first-order case, it follows that $T^{\mathcal{S}}_{P_{D}}$ does not have a least (pre-)fixed point888In this paper we use the term prefixed point to refer to those $x$ for which $f(x)\leq x$. Indeed, for reasons already outlined, this functional is not generally monotone. However, it will play an important role in Section 4.3.

4.2 Monotone semantics

The advantage of logic programs is that they have a natural, monotone interpretation.

Monotone sort frame.

We start from the interpretation of the background theory $A$, regarding $A_{\iota}$ as a discrete poset. We then define the monotone sort frame over $A$ by induction:

[TABLE]

where $X\mathrel{\Rightarrow_{m}}Y$ is the monotone function space between posets $X$ and $Y$, i.e. the set of all functions $f\in X\Rightarrow Y$ that have the property that $x_{1}\leq x_{2}$ implies $f(x_{1})\leq f(x_{2})$. It is easy to verify that this function space is itself a poset with respect to the pointwise ordering. Of course, in case $X$ is discrete poset $A_{\iota}$, this coincides with the full function space. We extend the lattice structure of $\mathbbm{2}$ to all relations $\mathcal{M}\llbracket\rho\rrbracket$, analogously to the case of the full function space (and we reuse the same notation since there will be no confusion); and we similarly define $\mathcal{M}\llbracket\Delta\rrbracket\coloneqq\Pi x\in\mathsf{dom}(\Delta).\,\mathcal{M}\llbracket\Delta(x)\rrbracket$.

It is worth considering the implications of monotonicity in the special case of relations, i.e. propositional functions. A relation $r$ is an element of $X_{1}\mathrel{\Rightarrow_{m}}\cdots{}\mathrel{\Rightarrow_{m}}X_{k}\mathrel{\Rightarrow_{m}}\mathbbm{2}$ just if it is upward closed: whenever $r$ is true of $x_{1},\ldots,x_{k}$ ($x_{i}\in X_{i}$), and $x_{1}^{\prime},\ldots,x_{k}^{\prime}$ ($x_{i}^{\prime}\in X_{i}$) has the property that $x_{i}\subseteq x_{i}^{\prime}$, then $r$ must also be true of $x_{1}^{\prime},\ldots,x_{k}^{\prime}$. In particular, when $r\in X\mathrel{\Rightarrow_{m}}\mathbbm{2}$, then $r$ can be thought of as an upward closed set of elements of $X$.

Monotone interpretation.

The interpretation of goal terms is defined in Figure 1. As for the standard interpretation, we assume a fixed interpretation $A$ of the background theory, which is left implicit in the notation. Whilst the standard interpretation of the positive logical constants for conjunction and disjunction will suffice, the interpretation of existential quantification needs to be relativised to the monotone setting: $\mathsf{mexists}_{\sigma}(r)=\mathit{max}\{r(d)\mid d\in\mathcal{M}\llbracket\sigma\rrbracket\}$. Since the implication function $\mathsf{implies}$ is not monotone (in its first argument), definite formulas are not interpretable in a monotone frame. However, it is possible to interpret logic programs. To that end, we define the functional $T^{\mathcal{M}}_{P:\Delta}$ on semantic environments by: $T^{\mathcal{M}}_{P:\Delta}(\alpha)(x)=\mathcal{M}\llbracket\Delta\vdash P(x):\Delta(x)\rrbracket(\alpha)$. In analogy with the Horn clause problem, we call a prefixed point of $T^{\mathcal{M}}_{P:\Delta}$ a model of the program $P$. This construction preserves the logical order.

Lemma 2**.**

$\mathcal{M}\llbracket\Delta\vdash G:\rho\rrbracket\in\mathcal{M}\llbracket\Delta\rrbracket\mathrel{\Rightarrow_{m}}\mathcal{M}\llbracket\rho\rrbracket$*  and  $T^{\mathcal{M}}_{P:\Delta}\in\mathcal{M}\llbracket\Delta\rrbracket\mathrel{\Rightarrow_{m}}\mathcal{M}\llbracket\Delta\rrbracket$.*

Proof.

Immediately follows from the fact that $\mathsf{mexists}$, $\mathsf{and}$ and $\mathsf{or}$ are monotone and all the constructions are monotone combinations. ∎

It follows from the Knaster-Tarski theorem that, unlike the functional arising from the standard interpretation, the monotone functional $T^{\mathcal{M}}_{P:\Delta}$ has a least fixed point, which we shall write $\mu T^{\mathcal{M}}_{P:\Delta}$. Consequently, logic programs $\vdash P:\Delta$ have a canonical monotone interpretation, $\llbracket\vdash P:\Delta\rrbracket$, which we define as $\mu T^{\mathcal{M}}_{P:\Delta}$.

Monotone problem.

By analogy with the first-order case, we are led to the following monotone version of the higher-order constrained Horn clause problem. A Monotone Logic Program Safety Problem (more often just monotone problem) is a triple $(\Delta,P,G)$ consisting of a sorting of relational variables $\Delta$, a logic program $\vdash P:\Delta$ and a goal $\Delta\vdash G:o$. The problem is solvable just if, for all models of the background theory, there is a prefixed point $\alpha$ of $T^{\mathcal{M}}_{P:\Delta}$ such that $\mathcal{M}\llbracket G\rrbracket(\alpha)=0$.

4.3 Canonical embedding

In the monotone problem we have obtained a notion of safety problem that admits a least solution. Due to the monotonicity of $\mathcal{M}\llbracket G\rrbracket$, there is a prefix point witnessing solvability iff the least prefix point is such a witness, i.e. iff $\mathcal{M}\llbracket G\rrbracket(\mathcal{M}\llbracket P\rrbracket)=0$. This clears the way for our algorithmic work in Section 5, which consists of apparatus in which to construct sound approximations of $\mathcal{M}\llbracket P\rrbracket$. However, the price we have had to pay seems severe, since we have all but abandoned our original problem definition.

The monotone logic program safety problem lacks the logical purity of the higher-order constrained Horn clause problem, which is stated crisply in terms of the standard interpretation of higher-order logic and the usual notion of models of formulas. In the context of program verification, the monotone problem appears quite natural, but if we look further afield, to e.g. traditional applications of constrained Horn clauses in constraint satisfaction, it seems a little awkward. For example, the significance of allowing only monotone solutions seems unclear if one is looking to state a scheduling problem for a haulage company or a packing problem for a factory.

Ideally, we would like to specify constraint systems using the standard Horn clause problem, with its clean logical semantics, but solve instances of the monotone problem, which is easier to analyse, due to monotonicity and the existence of canonical models. In fact, we shall show that this is possible: every solution to the Horn clause problem $\langle\Delta,D,G\rangle$ determines a solution to the monotone problem $\langle\Delta,P_{D},G\rangle$ and vice versa (Theorem 2).

Transferring solutions

Let us begin by considering what a mapping between solutions of $\langle\Delta,P_{D},G\rangle$ and solutions of $\langle\Delta,D,G\rangle$ would look like. In both cases, a solution is a model: the former is a mapping from variables to monotone relations and the latter is a mapping from (the same) variables to arbitrary relations.

At first glance, it might appear that one can transfer models of $P_{D}$ straightforwardly to models of $D$, because monotone relations are, in particular, relations. However, the situation is a little more difficult. Although the solution space of the Horn clause problem is larger, more is required of a valuation in order to qualify as a model because the constraints of the Horn clause problem, which involve universal quantification over all relations, are more difficult to satisfy than the equations of the monotone problem, which involve (implicitly) quantification over only the monotone relations.

To see this concretely, it is useful to consider the simpler case in which all relations are required to be unary, i.e. $\rho$ is of shape $(\cdots((\iota\to o)\to o)\to\cdots{})\to o$. In the unary case, we can think of a relation simply as describing a set of objects, where those objects may themselves be sets of objects. For example, $\mathcal{S}\llbracket(\iota\to o)\to o\rrbracket$ describes the collection of all sets of sets of individuals. On the other hand, the constraint on monotonicity of relations has the consequence that, if we think of $\mathcal{M}\llbracket(\iota\to o)\to o\rrbracket$ as describing a collection of sets, it is the collection only consisting of those sets of sets of individuals that are upward closed. That is, a set $s$ is in $\mathcal{M}\llbracket(\iota\to o)\to o\rrbracket$ just if, whenever a set of individuals $t$ is in $s$ and $t\subseteq u$ then $u$ is also in $s$. In general, we can think of $\mathcal{S}\llbracket\sigma\to o\rrbracket$ as the collection of all sets of objects from $\mathcal{S}\llbracket\sigma\rrbracket$, and $\mathcal{M}\llbracket\sigma\to o\rrbracket$ as the collection of hereditarily upward-closed sets. Now consider the logic program $P=\lambda x.\,\mathit{\mathsf{true}}$, in which $P$ is of sort $((\mathsf{int}\to o)\to o)\to o$. One model of this program is to take for $P$ the set of all upward-closed sets of sets of integers, which is a relation in $\mathcal{M}\llbracket((\mathsf{int}\to o)\to o)\to o\rrbracket$. However, the set of all upward-closed sets of sets of integers is not a model of the corresponding formula $\forall x.\,\mathsf{true}\Rightarrow P\ x$ in the standard semantics, because it does not contain, for example, the set $\{\{0\}\}$ which is not upward closed (i.e. its characteristic function is not a monotone Boolean-valued function), yet the universal quantification requires it.

So, although there is a canonical inclusion of $\mathcal{M}\llbracket\rho\rrbracket$ into $\mathcal{S}\llbracket\rho\rrbracket$, it does not extend to map models of $P_{D}$ to models of $D$ in general. If we return to thinking of the elements of $((\mathsf{int}\to o)\to o)\to o$ formally as Boolean-valued functions, the inclusion described above is mapping the monotone function $r\in\mathcal{M}\llbracket(\mathsf{int}\to o)\to o)\rrbracket\mathrel{\Rightarrow_{m}}\mathbbm{2}$, which satisfies $r(t)=1$ for all $t\in\mathcal{M}\llbracket(\mathsf{int}\to o)\to o\rrbracket$, to the function $J(r)\in\mathcal{S}\llbracket(\mathsf{int}\to o)\to o\rrbracket\Rightarrow\mathbbm{2}$, which satisfies, for all $t\in\mathcal{S}\llbracket(\mathsf{int}\to o)\to o)\rrbracket$:

[TABLE]

In other words, it lifts a function whose domain consists only of hereditarily monotone relations to a function whose domain consists of all relations simply by mapping non-hereditarily monotone inputs to [math]. We could equally well consider the dual, in which all such inputs were mapped to $1$, but the image of the mapping would typically not refute the goal $G$ because the models so constructed are too large.

This counterexample suggests that we require a mapping of monotone relations $r\in\mathcal{M}\llbracket((\mathsf{int}\to o)\to o)\to o\rrbracket$ to standard relations $J(r)\in\mathcal{S}\llbracket((\mathsf{int}\to o)\to o)\to o\rrbracket$ that is a little more sophisticated in the action of $J(r)$ on inputs that are not hereditarily monotone. Instead of mapping all such inputs to [math] or all such inputs to $1$ we shall determine the value of $J(r)$ on some non-monotone input $t\in\mathcal{S}\llbracket(\mathsf{int}\to o)\to o\rrbracket$ by considering the value of $r$ on a monotone input $U(t)\in\mathcal{M}\llbracket(\mathsf{int}\to o)\to o\rrbracket$ which is somehow close to $t$. In fact there are two canonical choices of hereditarily monotone relations close to a given relation $t$, which are obtained as, respectively, the largest monotone relation included in $t$ and the smallest monotone relation in which $t$ is included. We will describe the situation in general using Galois connection.

Galois connection.

A pair of functions $f:P\to Q$ and $g:Q\to P$ between partial orders $P$ and $Q$ is a Galois connection just if, for all $x\in P$ and $y\in Q$: $f(x)\leq y$ iff $x\leq g(y)$. In such a situation we write $f\dashv g$ and $f$ is said to be the left adjoint of $g$, and $g$ the right adjoint of $f$. First, it is easy to verify that if $f\dashv g$ then $f$ and $g$ are monotone.

Proposition 1**.**

Given a pair of monotone maps $f:P\to Q$ and $g:Q\to P$, the following are equivalent:

1. (1)

The pair $(f,g)$ is a Galois connection. 2. (2)

$f\circ g\leq 1_{Q}$* and $g\circ f\leq 1_{P}$.* 3. (3)

For all $x\in P$, $\inf\,\{y\in Q\mid x\leq g(y)\}$ is defined and equal to $f(x)$; and for all $y\in Q$, $\sup\,\{x\in P\mid f(x)\leq y\}$ is defined and equal to $g(y)$.

Further, if any one of the above conditions holds, then

1. (4)

$f$* preserves all existing suprema, and $g$ preserves all existing infima.* 2. (5)

$f=f\circ g\circ f$* and $g=g\circ f\circ g$.*

To see the Proposition, just view the pair $(f,g)$ as functors on categories Mac Lane (1971); then they forms a Galois connection exactly when they are an adjunction pair. The following facts are easy to verify:

1. (i)

If $P$ is a complete lattice and $f:P\to Q$ preserves all joins, then $f$ is a left adjoint. 2. (ii)

If $Q$ is a complete lattice and $g:Q\to P$ preserves all meets, then $g$ is an right adjoint. 3. (iii)

If $f_{1}:P\to Q$, $g_{1}:Q\to P$, $f_{2}:Q\to R$ and $g_{2}:R\to Q$ with $f_{1}\dashv g_{1}$ and $f_{2}\dashv g_{2}$ then it follows that $f_{1}\circ f_{2}\dashv g_{1}\circ g_{2}$, is a Galois connection between partial orders $P$ and $R$. 4. (iv)

If $f_{1}:P_{1}\to Q_{1}$, $g_{1}:Q_{1}\to P_{1}$, $f_{2}:P_{2}\to Q_{2}$ and $g_{2}:Q_{2}\to P_{2}$ with $f_{1}\dashv g_{1}$ and $f_{2}\dashv g_{2}$ then it follows that the pair of functions $f:[P_{1}\mathrel{\Rightarrow_{m}}P_{2}]\to[Q_{1}\mathrel{\Rightarrow_{m}}Q_{2}]$ and $g:[Q_{1}\mathrel{\Rightarrow_{m}}Q_{2}]\to[P_{1}\mathrel{\Rightarrow_{m}}P_{2}]$, defined by: $f(h)=f_{1}\circ h\circ g_{2}$ and $g(k)=g_{1}\circ k\circ f_{2}$ is a Galois connection $f\dashv g$ between the corresponding monotone function spaces (ordered pointwise).

Facts (i) and (ii) are just the Adjoint Functor Theorem (see e.g. Mac Lane (1971)) specialised to the case of preorders. Notice that a special case of (iv) is the construction of a Galois connection $f\dashv g$ between the (full) function spaces $A\Rightarrow P$ and $A\Rightarrow Q$ (with pointwise order) for fixed set $A$ and partial orders $P$ and $Q$, whenever there is a Galois connection $f_{2}\dashv g_{2}$ between $P$ and $Q$. This is because there is always a trivial Galois connection $\mathsf{id}\dashv\mathsf{id}$ on any set $A$ by viewing it as a discrete partial order.

Embedding the monotone relations.

For general $\rho$, every complete lattice of monotone relations $\mathcal{M}\llbracket\rho\rrbracket$ can be embedded in the complete lattice of all relations $\mathcal{S}\llbracket\rho\rrbracket$ in the following two ways.

[TABLE]

We define the family of right adjoints $\mathsf{I}_{\rho}$ and the family of left adjoints $\mathsf{J}_{\rho}$, by induction on the sort $\rho$. In the definition, $\mathsf{L}_{\rho}$ is the uniquely determined left adjoint of $\mathsf{I}_{\rho}$ and $\mathsf{U}_{\rho}$ is the uniquely determined right adjoint of $\mathsf{J}_{\rho}$.

[TABLE]

We briefly discuss this definition before verifying its correctness. It is worth observing that, rather than defining $\mathsf{I}_{\rho_{1}\to\rho_{2}}$ and $\mathsf{J}_{\rho_{1}\to\rho_{2}}$ using the induced left and right adjoints at $\rho_{1}$, we could have given the definition explicitly (recalling Galois connection properties (ii) and (iii)) by:

[TABLE]

We have not given the definition in this way because the proofs that follow only require the adjunction properties of $\mathsf{L}_{\rho_{1}}$ and $\mathsf{U}_{\rho_{1}}$, and not any explicit characterisation. To unpack the definition a little more, suppose $\rho$ is restricted to unary relations and consider the first few elements of this inductive family. When $\rho$ is either $o$ or $\iota\to o$, $\mathcal{S}\llbracket\rho\rrbracket=\mathcal{M}\llbracket\rho\rrbracket$, and $\mathsf{I}$ and $\mathsf{J}$ are both the identity. Consequently, they are both left and right adjoint to themselves, so that $\mathsf{L}$ and $\mathsf{U}$ are also both the identity. When $\rho$ is $(\iota\to o)\to o$, by definition $\mathsf{J}_{\rho}(r)=\mathsf{J}_{o}\circ r\circ\mathsf{U}_{\iota\to o}$ but, as discussed, both of $\mathsf{J}_{o}$ and $\mathsf{U}_{\iota\to o}$ are identities on their respective domains, so $\mathsf{J}_{\rho}(r)$ is just $r$. However, $\mathcal{M}\llbracket(\iota\to o)\to o\rrbracket$ is strictly contained within $\mathcal{S}\llbracket(\iota\to o)\to o\rrbracket$, so $\mathsf{J}_{\rho}$ is merely an inclusion and, consequently, the induced right adjoint $\mathsf{U}_{\rho}$ is more interesting. Using Galois connection property (ii) it can be computed explicitly, revealing that it maps each $s\in\mathcal{S}\llbracket\rho\rrbracket$ to $\bigcup\{t\in\mathcal{M}\llbracket\rho\rrbracket\mid\mathsf{J}_{\rho}(t)\subseteq s\}$. But, we have seen that $\mathsf{J}_{(\iota\to o)\to o}(t)=t$, so it follows that $\mathsf{U}_{\rho}(s)$ is just the largest monotone relation included in $s$, and we arrive back at the discussion with which we started this subsection. The following proof gives more insight on the structure of the mappings.

Lemma 3**.**

For each $\rho$, (i) $\mathsf{L}_{\rho}\dashv\mathsf{I}_{\rho}$ and (ii) $\mathsf{J}_{\rho}\dashv\mathsf{U}_{\rho}$ are well-defined Galois connections.

Proof.

We prove only (i) because the proof of (ii) is analogous. We show that $\mathsf{I}_{\rho}:\mathcal{M}\llbracket\rho\rrbracket\to\mathcal{S}\llbracket\rho\rrbracket$ is a well-defined right adjoint by induction on $\rho$.

• •

When $\rho$ is $o$, $\mathcal{M}\llbracket o\rrbracket=\mathcal{S}\llbracket o\rrbracket$ and $\mathsf{I}_{o}$ is the identity, which has left adjoint also the identity.

• •

When $\rho$ is of shape $\iota\to\rho_{2}$, it follows from the induction hypothesis that $\mathsf{I}_{\rho_{2}}:\mathcal{M}\llbracket\rho_{2}\rrbracket\to\mathcal{S}\llbracket\rho_{2}\rrbracket$ is a well-defined right adjoint. It follows from Galois connection property (vi) that the mapping $r\mapsto\mathsf{I}_{\rho_{2}}\circ r:\mathcal{M}\llbracket\iota\to\rho_{2}\rrbracket\to\mathcal{S}\llbracket\iota\to\rho_{2}\rrbracket$ is a well-defined right adjoint.

• •

Finally, when $\rho$ has shape $\rho_{1}\to\rho_{2}$, we decompose the definition of $\mathsf{I}_{\rho}$ as follows:

[TABLE]

It follows from the induction hypothesis that $\mathsf{I}_{\rho_{1}}:\mathcal{M}\llbracket\rho_{1}\rrbracket\to\mathcal{S}\llbracket\rho_{1}\rrbracket$ and $\mathsf{I}_{\rho_{2}}:\mathcal{M}\llbracket\rho_{2}\rrbracket\to\mathcal{S}\llbracket\rho_{2}\rrbracket$ are both well-defined right-adjoints, from which we may infer the existence of left adjoint $\mathsf{L}_{\rho_{1}}:\mathcal{S}\llbracket\rho_{1}\rrbracket\to\mathcal{M}\llbracket\rho_{1}\rrbracket$. It follows from Galois connection property (iv) that the mapping $r\mapsto\mathsf{I}_{\rho_{2}}\circ r\circ\mathsf{L}_{\rho_{1}}:\mathcal{M}\llbracket\rho_{1}\rrbracket\mathrel{\Rightarrow_{m}}\mathcal{M}\llbracket\rho_{2}\rrbracket\to\mathcal{S}\llbracket\rho_{1}\rrbracket\mathrel{\Rightarrow_{m}}\mathcal{S}\llbracket\rho_{2}\rrbracket$ is a well-defined right adjoint (with codomain the monotone function space). Finally, observe that there is a canonical inclusion between the monotone and full function spaces which, since it trivially preserves meets, is as an right adjoint according to Galois connection property (ii). The result follows since right adjoints compose (Galois connection property (iii)).

∎

The Galois connections give a canonical way to move between the universes of monotone and arbitrary relations; we extend them to mappings on valuations $\alpha\in\mathcal{M}\llbracket\Delta\rrbracket$ by:

[TABLE]

The action is pointwise on relations and trivial on individuals. It is easy to verify that each $\mathsf{I}_{\Delta}$ and $\mathsf{J}_{\Delta}$ are right and left adjoints respectively.

Corollary 1**.**

For each sorting $\Delta$, (i) $\mathsf{L}_{\Delta}\dashv\mathsf{I}_{\Delta}$ and (ii) $\mathsf{J}_{\Delta}\dashv\mathsf{U}_{\Delta}$ are well-defined Galois connections.

We now have a canonical way to move between monotone and arbitrary valuations, but our aim was to be able to map models of $P_{D}$ to models of $D$ (and vice versa), and we do not yet have any evidence that our mappings are at all useful in this respect. In both cases, models are prefixed points of certain functionals so we look for conditions which ensure that mappings preserve the property of being a prefix point. One such condition is the following: if $F:P\to Q$ is monotone, $T_{1}:P\to P$ and $T_{2}:Q\to Q$ then $F$ will send prefixed points of $T_{1}$ to prefixed points of $T_{2}$ whenever it satisfies $T_{2}\circ F\subseteq F\circ T_{1}$ (in the pointwise order). This is because if $T_{1}(x)\leq x$ then $F(T_{1}(x))\leq F(x)$ by monotonicity, but also $T_{2}(F(x))\leq F(T_{1}(x))$ by the assumption so that $T_{2}(F(x))\leq F(x)$.

In the following we will prove that the right adjoints $\mathsf{I}$ and $\mathsf{U}$ preserve prefix points by showing that $T^{\mathcal{M}}\circ\mathsf{U}\subseteq\mathsf{U}\circ T^{\mathcal{S}}$ and $T^{\mathcal{S}}\circ\mathsf{I}\subseteq\mathsf{I}\circ T^{\mathcal{M}}$. The meat of the definitions of $T^{\mathcal{S}}$ and $T^{\mathcal{M}}$ lies in the semantics of goal terms, so we first show that, for all goal terms $G$, $\mathcal{M}\llbracket G\rrbracket\circ\mathsf{U}\subseteq\mathsf{U}\circ\mathcal{S}\llbracket G\rrbracket$ and $\mathcal{S}\llbracket G\rrbracket\circ\mathsf{I}\subseteq\mathsf{I}\circ\mathcal{M}\llbracket G\rrbracket$. However, we rephrase $\mathcal{M}\llbracket G\rrbracket\circ\mathsf{U}\subseteq\mathsf{U}\circ\mathcal{S}\llbracket G\rrbracket$ equivalently as $\mathsf{J}\circ\mathcal{M}\llbracket G\rrbracket\circ\mathsf{U}\subseteq\mathcal{S}\llbracket G\rrbracket$ and $\mathcal{S}\llbracket G\rrbracket\circ\mathsf{I}\subseteq\mathsf{I}\circ\mathcal{M}\llbracket G\rrbracket$ equivalently as $\mathcal{S}\llbracket G\rrbracket\subseteq\mathsf{I}\circ\mathcal{M}\llbracket G\rrbracket\circ\mathsf{L}$, which allows for a straightforward induction.

Lemma 4**.**

For all goal terms $\Delta\vdash G:\rho$,  $\mathsf{J}_{\rho}\circ\mathcal{M}\llbracket G\rrbracket\circ\mathsf{U}_{\Delta}\;\subseteq\;\mathcal{S}\llbracket G\rrbracket\;\subseteq\;\mathsf{I}_{\rho}\circ\mathcal{M}\llbracket G\rrbracket\circ\mathsf{L}_{\Delta}$.

The fact that the two right adjoints map between prefix points now follows immediately once the equivalence of our rephrasings have been verified.

Lemma 5** (Model translation).**

Fix a program $\vdash P:\Delta$.

1. (i)

If $\beta$ is a prefixed point of $T^{\mathcal{S}}_{P:\Delta}$ then $\mathsf{U}_{\Delta}(\beta)$ is a prefixed point of $T^{\mathcal{M}}_{P:\Delta}$. 2. (ii)

If $\alpha$ is a prefixed point of $T^{\mathcal{M}}_{P:\Delta}$, then $\mathsf{I}_{\Delta}(\alpha)$ is a prefixed point of $T^{\mathcal{S}}_{P:\Delta}$.

Proof.

It follows from Lemma 4 and Lemma 1 that, for any goal term $G$:

[TABLE]

The first follows from $\mathsf{J}\circ\mathcal{M}\llbracket G\rrbracket\circ\mathsf{U}\subseteq\mathcal{S}\llbracket G\rrbracket$ since $\mathsf{J}$ is left adjoint. The second follows from $\mathcal{S}\llbracket G\rrbracket\subseteq\mathsf{I}\circ\mathcal{M}\llbracket G\rrbracket\circ\mathsf{L}$ by pre-composing with $\mathsf{I}$ on both sides and noting that $\mathsf{L}\circ\mathsf{I}$ is deflationary. By definition: $T^{\mathcal{M}}(\alpha)(x)=\mathcal{M}\llbracket P(x)\rrbracket(\alpha)$ and $T^{\mathcal{S}}(\beta)(x)=\mathcal{S}\llbracket P(x)\rrbracket(\beta)$, so that we can deduce the following from the above inclusions:

[TABLE]

For part (i), it only remains to observe that if $T^{\mathcal{S}}(\beta)\subseteq\beta$ then, by monotonicity, $\mathsf{U}(T^{\mathcal{S}}(\beta))\subseteq\mathsf{U}(\beta)$ and, by the above inclusion, $T^{\mathcal{M}}(\mathsf{U}(\beta))\subseteq\mathsf{U}(\beta)$. Part (ii) is analogous. ∎

Moreover, these mappings preserve refutation of the goal. Intuitively, we think of $\mathsf{U}(\beta)$ (respectively $\mathsf{I}(\alpha)$) as the largest monotone (respectively standard) valuation that is smaller than $\beta$ (respectively $\alpha$). So, (as is made precise in Lemma 4) if the latter refutes a goal, so should the former. Hence, we obtain the following problem reduction.

Theorem 2**.**

The higher-order constrained Horn clause problem $\langle\Delta,D,G\rangle$ is solvable, iff the monotone logic program safety problem $\langle\Delta,P_{D},G\rangle$ is solvable, and iff in all models of the background theory $\mathcal{M}\llbracket G\rrbracket(\mathcal{M}\llbracket P_{D}\rrbracket)=0$.

Proof.

We prove a chain of implications.

• •

Assume that $\langle\Delta,D,G\rangle$ is solvable, so that for each model $A$ of the background theory, there is a valuation $\beta$ and $A,\,\beta\vDash D$ and $A,\,\beta\not\vDash G$, i.e. $\mathcal{S}\llbracket G\rrbracket(\beta)=0$. Fix such a model $A$ of the background theory and then let $\beta$ be the witness given above. Then it follows from Lemma 4 that $\mathsf{J}(\mathcal{M}\llbracket G\rrbracket(\mathsf{U}(\beta)))\subseteq 0$, i.e. $\mathcal{M}\llbracket G\rrbracket(\mathsf{U}(\beta))=0$. Since $\beta$ is a model of $D$, it follows from Lemma 1 that it is also a prefixed point of $T^{\mathcal{S}}_{P_{D}}$ and hence $\mathsf{U}(\beta)$ is a prefixed point of $T^{\mathcal{M}}_{P_{D}}$ by Lemma 5. Therefore, $\langle\Delta,P_{D},G\rangle$ is also solvable.

• •

If $\langle\Delta,P_{D},G\rangle$ is solvable, then, for each model $A$ of the background theory, there is a prefix point $\alpha$ of $T^{\mathcal{M}}_{P_{D}}$ and $\mathcal{M}\llbracket G\rrbracket(\alpha)=0$. However, $\mathcal{M}\llbracket P_{D}\rrbracket$ is, by definition, the least prefixed point so $\mathcal{M}\llbracket P_{D}\rrbracket\subseteq\mathsf{U}(\alpha)$ and hence $\mathcal{M}\llbracket G\rrbracket(\mathcal{M}\llbracket P_{D}\rrbracket)=0$ follows by monotonicity.

• •

Finally assume that in all models of the background theory $\mathcal{M}\llbracket G\rrbracket(\mathcal{M}\llbracket P_{D}\rrbracket)=0$. Fix such a model of the background theory. We claim that $\mathsf{L}(\mathcal{S}\llbracket G\rrbracket(\mathsf{I}(\mathcal{M}\llbracket P_{D}\rrbracket)))\subseteq 0$ follows from Lemma 4, which is to say that $\mathcal{S}\llbracket G\rrbracket(\mathsf{I}(\mathcal{M}\llbracket P_{D}\rrbracket)))=0$. To see this, observe that $\mathcal{S}\llbracket G\rrbracket(\mathsf{I}(\mathcal{M}\llbracket P_{D}\rrbracket))\subseteq\mathsf{I}(\mathcal{M}\llbracket G\rrbracket(\mathcal{M}\llbracket P_{D}\rrbracket))$ follows as in the proof of Lemma 5 and note that $\mathsf{I}$ is right adjoint. Since $\mathcal{M}\llbracket P_{D}\rrbracket$ is a prefixed point of $T^{\mathcal{M}}_{P_{D}:\Delta}$, it follows from Lemma 5 that $\mathsf{I}(\mathcal{M}\llbracket P_{D}\rrbracket)$ is a prefixed point of $T^{\mathcal{S}}_{P_{D}}$. Finally, by Lemma 1 it is therefore a model of $D$, so $\langle\Delta,D,G\rangle$ is solvable.

∎

5 Refinement Type Assignment

Having reduced the higher-order Horn clause problem to a problem about the least-fixpoint semantics of higher-order logic programs, we now consider the task of automating reasoning about such programs. For this purpose, we look to work on refinement type systems, which are one of the most successful approaches to automatically obtaining invariants for higher-order, functional programs. In this section, we develop a refinement type system for monotone logic programs.

Elimination of higher-order existentials.

Due to monotonicity, it is possible to eliminate higher-order existential quantification from goal terms, simplifying the design of the type system. Given any goal term of shape $\exists x\!:\!\rho.\,G$, observe that $\mathcal{M}\llbracket G\rrbracket$ is a monotone function of $x$. If there is a relation that can be used as a witness for $x$ then, by monotonicity, so too can any larger relation. In particular, $G$ is true of some $x$ of sort $\rho$ iff $G$ is true of the universal relation of sort $\rho$, that is, the relation $u_{\rho}$ satisfying $u_{\rho}(r_{1})\cdots{}(r_{k})=1$ for all $r_{1},\ldots,r_{k}$. Moreover, the universal relation of sort $\rho$ is itself definable by a goal term, it is just the term $U_{\rho}\coloneqq\lambda x_{1}\ldots{}x_{k}.\,\mathit{\mathsf{true}}$. Consequently, $\mathcal{M}\llbracket\exists x\!:\!\rho.\,G:o\rrbracket=\mathcal{M}\llbracket G[U_{\rho}/x]\rrbracket$, in which the instance of existential quantification over relations has been eliminated by a syntactic substitution. For the rest of the paper, we assume without loss of generality that monotone logic programs contain only existential quantification over individuals.

5.1 Syntax

The refinement types are built out of constraint formulas which are combined using the dependent arrow. For the purposes of this section, we shall assume that the constraint language is closed under conjunction and closed under (well-sorted) substitution, in the sense that, for every constraint formula $\Delta,\,x\!\!:\iota\vdash\varphi:o\in\mathit{Fm}$ and term $\Delta\vdash N:\iota\in\mathit{Tm}$, it follows that $\varphi[N/x]\in\mathit{Fm}$.

Types.

The restricted syntax of goal terms allows us to make several simplifications to our refinement type system, in comparison to those in the literature. The first is that we only allow refinement of the propositional sort $o$ and we only allow dependence on the sort of individuals $\iota$. Formally, we define the set of type expressions according to the following grammar:

[TABLE]

in which $\varphi\in\mathit{Fm}$ is a constraint formula. We make this definition under the assumption that both kinds of arrow associate to the right and we identify types up to $\alpha$-equivalence.

Refinement

We restrict attention to those types that we consider to be well-formed, which is defined by a system of judgements $\Delta\vdash T::\rho$, in which $\Delta$ is a sort environment, $T$ is a type and $\rho$ is a relational sort. In case such a judgement is provable we say that $T$ refines $\rho$.

$\Delta\vdash\varphi:o\in\mathit{Fm}$

$\Delta\vdash o\langle\mathit{\varphi}\rangle::o$

$\Delta,x\!\!:\iota\vdash T::\rho$

$\Delta\vdash x{:}\mathit{\iota}\to\mathit{T}::\iota\to\rho$

$\Delta\vdash T_{1}::\rho_{1}$         $\Delta\vdash T_{2}::\rho_{2}$

$\Delta\vdash T_{1}\to T_{2}::\rho_{1}\to\rho_{2}$

Type environments.

A type environment $\Gamma$ is a finite sequence of pairs of variables and types, $x:T$, such that the variable subjects are pairwise distinct. We write the empty sort environment as $\epsilon$. We place similar well-formedness restrictions on environments, using the judgement $\vdash\Gamma::\Delta$, in which $\Gamma$ is a type environment and $\Delta$ a sort environment. In case such a judgement is provable we say that $\Gamma$ refines $\Delta$.

$\vdash\epsilon::\epsilon$

$\vdash\Gamma::\Delta$

$\vdash(\Gamma,\,x:\iota)::(\Delta,\,x:\iota)$

$\vdash\Gamma::\Delta$         $\Delta\vdash T::\rho$

$\vdash(\Gamma,\,x:T)::(\Delta,\,x:\rho)$

Since the variable subjects of a type environment are required to be distinct, we will frequently view such an environment as a finite map from variables to types. Thus, whenever $x$ is a subject in $\Gamma$, we will write $\Gamma(x)$ for the type assigned to $x$ and $\mathsf{dom}(\Gamma)$ for its set of subjects.

Subtype theory.

Much of the power of refinement types is derived from the associated subtype theory, which imports wholesale the reasoning apparatus of the underlying constraint language. Subtyping between types is the set of inequalities given by the judgement form $\vdash T_{1}\sqsubseteq T_{2}$ defined inductively.

$\mathit{Th}\vDash\mathit{\varphi}\Rightarrow\mathit{\psi}$

$\vdash o\langle\mathit{\varphi}\rangle\sqsubseteq o\langle\mathit{\psi}\rangle$

$\vdash T_{1}\sqsubseteq T_{2}$

$\vdash x{:}\mathit{\iota}\to\mathit{T_{1}}\sqsubseteq x{:}\mathit{\iota}\to\mathit{T_{2}}$

$\vdash T_{1}^{\prime}\sqsubseteq T_{1}$         $\vdash T_{2}\sqsubseteq T_{2}^{\prime}$

$\vdash T_{1}\to T_{2}\sqsubseteq T_{1}^{\prime}\to T_{2}^{\prime}$

It is natural to view $\sqsubseteq$ as a preorder and useful to distinguish the extremal elements. We write $\top_{\!\!\rho}$ and $\bot_{\rho}$ for the families of refinement types defined inductively as follows:

[TABLE]

in which the variables $z$ are chosen to be suitably fresh. It is clear that, by construction, $\vdash\top_{\!\!\rho}::\rho$ and $\vdash\bot_{\rho}::\rho$.

Type assignment.

Type assignment for goal terms $\Delta\vdash G:\sigma$ and programs $\vdash P:\Delta$ are defined by a system of judgements of the forms $\Gamma\vdash G:T$ and $\vdash P:\Gamma$ respectively, in which type environment $\Gamma$ and type $T$ are required to satisfy $\vdash\Gamma::\Delta$ and $\Delta\vdash T::\sigma$. The system is defined in Figure 2.

Application and abstraction.

There are two versions of each of abstraction and application, corresponding to the fact that we have chosen to emphasize the difference between dependence of a result type on an argument of individual sort and non-dependence on arguments of relational sort.

In common with other refinement type systems in the literature but unlike more general dependent type systems, our types are not closed under substitution of arbitrary terms of the programming language. This can be reconciled with the usual rule for dependent application, in which substitution $T[N/x]$ into a type $T$ occurs, in a number of ways. For example, in the system of Rondon et al. (2008), terms $N$ of the programming language that are substituted into a type $T$ through application are understood using uninterpreted function symbols in the logic; in Unno and Kobayashi (2009), the rule for application trivialises the substitution by requiring that $T$ does not contain the dependent variable $x$ and; in Terauchi (2010), the operand $N$ is required to be a variable (which can be guaranteed when the program is assumed to be in A-normal form). In our case, dependence can only occur at sort $\iota$ and, since the subjects of the system are goal terms, all subterms of sort $\iota$ are necessarily already terms of the constraint language, so we avoid the need for any further conditions.

Subtyping

Our subsumption rule (TSub) is quite standard, we just note that the fact that there are no non-trivial refinements of the base sort $\iota$ has the consequence that there is no significant advantage for the subtype judgement to refer to the type context $\Gamma$, which is why it has been formulated in this context-free way. Similar comments can be made about avoiding the need to distinguish between base and function types in (TVar) .

Constraints and logical constants.

To understand the rules for typing constraint, existential, conjunctive and disjunctive formulas, it is instructive to assign a meaning to the judgement $\Gamma\vdash G:o\langle\mathit{\varphi}\rangle$. One should view this judgement as asserting that: in those valuations that satisfy $\Gamma$, $G$ implies $\varphi$. This statement is made precise in Lemma 6 once the semantics of types has been introduced. Under this reading, we can view the type system as a mechanism for concluding assertions of the form “goal formula $G$ is approximated by constraint $\varphi$” or “constraint $\varphi$ is an abstraction of goal formula $G$”. This is a useful assertion for automated reasoning because it is relating the complicated formula $G$, which may include higher-order relation symbols whose meanings are defined recursively by the program, to the much more tractable constraint formula $\varphi$, which is drawn from a (typically decidable) first-order theory.

This view helps to clarify the intuition behind the rules for assigning types to formulas headed by a constant. In particular, for goal terms $G$ that are themselves formulas of the constraint language, the rule (TConstraint) loses no information in the abstraction. Note that we give only a rule for typing existential quantification at base sort $\iota$, which is justified by the remarks at the start of this section. Finally, observe that the side condition on (TExists) ​ is equivalent to the condition $\mathit{Th}\vDash(\exists x.\,\varphi)\Rightarrow\psi$ since, due to the well-formedness of the judgement, $\psi$ cannot contain $x$ freely. We use the side condition in the given form because the constraint language may not allow existential quantification. A similar remark may be made concerning the rule (TOr) ​ and the ability to express disjunction.

To programs $\vdash P:\Delta$, of shape $x_{1}=G_{1},\,\ldots,\,x_{m}=G_{m}$, we assign type environments according to the rule:

$\Gamma\vdash G_{1}:\Gamma(x_{1})\qquad\cdots\qquad\Gamma\vdash G_{m}:\Gamma(x_{m})$

(TProg)

$\vdash x_{1}=G_{1},\quad\ldots,\quad x_{m}=G_{m}:\Gamma$

Once we have defined the relational semantics of types, in which a type environment $\Gamma$ is interpreted as a valuation $\mathcal{M}\llparenthesis\Gamma\rrparenthesis$, the soundness of this rule will guarantee that $\mathcal{M}\llparenthesis\Gamma\rrparenthesis$ is a prefix point of $T^{\mathcal{M}}_{P:\Delta}$, and hence is an over-approximation of $\mathcal{M}\llbracket P\rrbracket$.

Example 3**.**

Using (TProg) ​ the program in Example 2 can be assigned the type environment $\Gamma_{I}$ from the introduction. For example, the type of $\mathit{Iter}$ can be justified from the following judgements. First, for the subterms $n\leq 0$ and $m=0$ in the body of $\mathit{Iter}{}$ we can apply the (TConstraint) rule to immediately derive the judgements:

[TABLE]

in which $\Gamma^{\prime}$ is the type environment $\Gamma,\,f\!\!:x{:}\mathit{\mathsf{int}}\to\mathit{y{:}\mathit{\mathsf{int}}\to\mathit{z{:}\mathit{\mathsf{int}}\to\mathit{o\langle\mathit{0}\>\mathit{<}\>\mathit{x}\>\mathit{\Rightarrow y}\>\mathit{<}\>\mathit{z}\rangle}}},\,s\!\!:\mathsf{int},\,n\!\!:\mathsf{int},\,m\!\!:\mathsf{int}$. Then using (TAnd) ​, we can derive the judgement: $\Gamma^{\prime}\vdash n\leq 0\wedge m=s:o\langle\mathit{n}\>\mathit{\leq 0}\>\mathit{\wedge m}\>\mathit{=}\>\mathit{s}\rangle$. Moreover, since also $\mathsf{ZLA}\vDash n\leq 0\wedge m=s\Rightarrow 0\leq s\Rightarrow n\leq m$, it follows from the subsumption rule (TSub) ​ that the judgement:

[TABLE]

is also derivable. Next, consider the subterm $\mathit{\mathit{Iter}{}}\>\mathit{f}\>\mathit{s}\>\mathit{(n-1)}\>\mathit{p}$. Observe that $\vdash o\langle\mathit{z}\>\mathit{=}\>\mathit{x}\>\mathit{+}\>\mathit{y}\rangle\sqsubseteq o\langle\mathit{0}\>\mathit{<}\>\mathit{x}\>\mathit{\Rightarrow y}\>\mathit{<}\>\mathit{z}\rangle$ so, using (TVar) and (TSub) we can assign to $f$ the type

[TABLE]

Hence, it follows from the (TAppR) ​ and (TAppI) ​ rules that we can derive the judgement: $\Gamma^{\prime}\vdash\mathit{\mathit{Iter}{}}\>\mathit{f}\>\mathit{s}\>\mathit{(n-1)}\>\mathit{p}:o\langle\mathit{0}\>\mathit{\leq s}\>\mathit{\Rightarrow n-1}\>\mathit{\leq p}\rangle$. To the term $\mathit{f}\>\mathit{n}\>\mathit{p}\>\mathit{m}$ we can assign the type $o\langle\mathit{0}\>\mathit{<}\>\mathit{n}\>\mathit{\Rightarrow p}\>\mathit{<}\>\mathit{m}\rangle$. Hence, by (TAnd) ​ and then (TExists) ​ we can conclude the judgement:

[TABLE]

since $\mathsf{ZLA}\vDash(\exists p.\,0<n\wedge(0\leq s\Rightarrow n-1\leq p)\wedge(0<n\Rightarrow p<m))\Rightarrow 0\leq s\Rightarrow n\leq m$. Using (1), (2) and (TOr) we can therefore derive an overall type for the body of the definition of $\mathit{Iter}$ as $o\langle\mathit{0}\>\mathit{\leq s}\>\mathit{\Rightarrow n}\>\mathit{\leq r}\rangle$. The desired type follows from applications of (TAbsI) and (TAbsR) ​.

5.2 Semantics

We ascribe two meanings to types. The first is the usual semantics in which types are some kind of set and, as is typical, such sets have the structure of an order ideal. The second is specific to our setting and exploits the fact that every type refines a relational sort. The second semantics assigns to each type a specific relation. This makes later developments, such as the demonstration of the soundness of type assignment, simpler and also makes a link to the notion of symbolic model from the first-order case.

Ideal semantics of types.

The ideal semantics of refinement types is defined so as to map a well-formed typing sequent $\Delta\vdash T::\rho$ and appropriate valuation $\alpha$ to a subset $\mathcal{M}\llbracket T\rrbracket(\alpha)\subseteq\mathcal{M}\llbracket\rho\rrbracket$.

[TABLE]

We are now in a position to make precise the remark following the definition of type assignment.

Lemma 6**.**

$\mathcal{M}\llbracket G\rrbracket(\alpha)\in\mathcal{M}\llbracket o\langle\mathit{\varphi}\rangle\rrbracket(\alpha)\;$* iff $\;\alpha\vDash G\Rightarrow\varphi$.*

The soundness of type assignment will guarantee that, additionally, $\Gamma\vdash G:o\langle\mathit{\varphi}\rangle$ implies that $\mathcal{M}\llbracket G\rrbracket(\alpha)\in\mathcal{M}\llbracket o\langle\mathit{\varphi}\rangle\rrbracket(\alpha)$ for all appropriate $\alpha$.

Relational semantics of types.

We will also consider a monotone relational semantics of types. Fix a sort environment $\Delta$. Given an appropriate first-order valuation $\alpha$, we can associate relations $\mathcal{M}\llparenthesis\Delta\vdash T::\rho\rrparenthesis(\alpha)\in\mathcal{M}\llbracket\rho\rrbracket$ to each well formed type $\Delta\vdash T:\rho$.

[TABLE]

It follows straightforwardly from the definitions that $\mathcal{M}\llparenthesis T\rrparenthesis(\alpha)$ is a monotone relation.

Symbolic models.

Additionally, we can consider a type environment under a relational interpretation. We define, for all $x\in\mathsf{dom}(\Delta)$, $\mathcal{M}\llparenthesis\vdash\Gamma::\Delta\rrparenthesis(x)=\mathcal{M}\llparenthesis\Gamma(x)\rrparenthesis(\emptyset)$. This object is a monotone valuation and hence, following the results of Section 4, this semantics makes precise the idea of a type environment $\Gamma$ as a (candidate) symbolic model, that is, a finite representation of a model designed for the purposes of automated reasoning.

Relationship.

The ideal and the relational semantics are closely related: the relational interpretation $\mathcal{M}\llparenthesis T\rrparenthesis(\alpha)$ of a type $T$ is the largest element of the ideal $\mathcal{M}\llbracket T\rrbracket(\alpha)$. Thus we see also that $\mathcal{M}\llbracket T\rrbracket(\alpha)$ is principal. For each relation $r\in\mathcal{M}\llbracket\rho\rrbracket$ let us write ${\Downarrow}_{\rho}r$ for the downward closure of $\{r\}$ in $\mathcal{M}\llbracket\rho\rrbracket$ (we will typically omit the subscript).

Lemma 7**.**

For all types $\Delta\vdash T::\rho$ and $\alpha\in\mathcal{S}\llbracket\Delta\rrbracket$, $\mathcal{M}\llbracket T\rrbracket(\alpha)={\Downarrow}\mathcal{M}\llparenthesis T\rrparenthesis(\alpha)$.

5.3 Soundness

We return to the discussion of type assignment by defining semantic judgements paralleling those for the type system. First let us make a preliminary definition. Let $\vdash\Gamma::\Delta$, then we say that valuation $\alpha\in\mathcal{M}\llbracket\Delta\rrbracket$ satisfies $\Gamma$ just if, for all $x\in\mathsf{dom}(\Delta)$, $\alpha(x)\in\mathcal{M}\llbracket\Gamma(x)\rrbracket$. We write the following judgement forms:

[TABLE]

In the first, we assume that $\Delta\vdash T_{1}:\rho$ and $\Delta\vdash T_{2}:\rho$ are types of the same sort. Then the meaning of $\vDash T_{1}\sqsubseteq T_{2}$ is that, for all $\alpha\in\mathcal{M}\llbracket\Delta\rrbracket$, $\mathcal{M}\llbracket T_{1}\rrbracket(\alpha)\subseteq\mathcal{M}\llbracket T_{2}\rrbracket(\alpha)$. In the second, we assume that $\vdash\Gamma::\Delta$, $\Delta\vdash G:\rho$ and $\Delta\vdash T::\rho$. Then the meaning of $\Gamma\vDash G:T$ is that, for all valuations $\alpha\in\mathcal{M}\llbracket\Delta\rrbracket$, if $\alpha$ satisfies $\Gamma$ then $\mathcal{M}\llbracket G\rrbracket(\alpha)\in\mathcal{M}\llbracket T\rrbracket(\alpha)$. Finally, in the third, we assume that $\vdash P:\Delta$ and $\vdash\Gamma::\Delta$. Then the meaning of $\vDash P:\Gamma$ is that $\mathcal{M}\llbracket P\rrbracket$ satisfies $\Gamma$.

Theorem 3** (Soundness of Type Assignment).**

1. (i)

If  $\vdash T_{1}\sqsubseteq T_{2}$  then  $\vDash T_{1}\sqsubseteq T_{2}$. 2. (ii)

If  $\Gamma\vdash G:T$  then  $\Gamma\vDash G:T$. 3. (iii)

If  $\vdash P:\Gamma$  then  $\vDash P:\Gamma$.

Proof sketch.

The first and second claims are proven by straightforward inductions on the relevant judgements. In the third case it follows from (ii) and the definition of (TProg) that $\mathcal{M}\llparenthesis\Gamma\rrparenthesis$ satisfies $\Gamma$ and is therefore a prefixed point of $T^{\mathcal{M}}_{P:\Delta}$. Since $\mathcal{M}\llbracket P\rrbracket$ is the least such, the result follows. ∎

This allows for a sound approach to solving systems of higher-order constrained Horn clauses. Given an instance of the problem $\langle\Delta,D,G\rangle$, we construct the corresponding logic program $\langle\Delta,P_{D},G\rangle$. If there is a type environment $\vdash\Gamma::\Delta$ such that $\vdash P_{D}:\Gamma$ and $\Gamma\vdash G:o\langle\mathit{\mathsf{false}}\rangle$ then it follows from Theorem 3 that, for each model $A$ of the background theory, $\mathcal{M}\llparenthesis\Gamma\rrparenthesis$ (with constants interpreted with respect to $A$) is a valuation that satisfies $D$ but refutes $G$. The approach is, however, incomplete. Consider the following instance, adapted from an example of Unno et al. (2013) showing the incompleteness of refinement type systems for higher-order program verification.

Example 4**.**

The higher-order constrained Horn clause problem $\langle\Delta,D,G\rangle$ specified by, respectively:

[TABLE]

is solvable in the theory of integer linear arithmetic ($\mathsf{ZLA}$), since there is no integer $i$ smaller than its predecessor. However, the logic program $P_{D}$ defined as $\mathit{Leq}=\lambda ij.\,\mathit{i}\>\mathit{\leq j},\;\mathit{Holds}=\lambda pn.\,\mathit{pn}$ is not typable. This is because if there were a type environment $\vdash\Gamma::\Delta$ for which $\vdash P_{D}:\Gamma$ and $\Gamma\vdash G:o\langle\mathit{\mathsf{false}}\rangle$, it would have shape:

[TABLE]

*for some formulas $i\!\!:\mathsf{int},j\!\!:\mathsf{int}\vdash\chi:o$ and $x\!\!:\mathsf{int}\vdash\varphi:o$ and $n\!\!:\mathsf{int}\vdash\psi:o$. These formulas would necessarily satisfy the following conditions:

1. $\mathsf{ZLA}\vDash i\leq j\Rightarrow\chi$,

2. $\mathsf{ZLA}\vDash\varphi[n/x]\Rightarrow\psi$,

3. $\mathsf{ZLA}\vDash\chi[x/j]\Rightarrow\varphi$, and

4. $\mathsf{ZLA}\vDash(\exists i.\,\varphi[i-1/n])\Rightarrow\mathsf{false}$,

implied by the definition of the type system. It follows from (1) and (3) that also $\mathsf{ZLA}\vDash i\leq x\Rightarrow\varphi$. Since $\varphi$ does not contain $i$ freely, it follows that this is equivalent to $\mathsf{ZLA}\vDash(\exists i.\,i\leq x)\Rightarrow\varphi$, itself equivalent to $\mathsf{ZLA}\vDash\varphi$. However, this contradicts (4), so there can be no such type assignment.*

It seems likely that, to obtain a sound and (relatively) complete approach, one could adapt the development described in Unno et al. (2013), at the cost of complicating the system a little.

5.4 Automation

This approach to solving the higher-order constrained Horn clause problems relies on finding a refinement type environment to act as a witness. It is well understood that, for refinement type systems following a certain pattern, typability (i.e. the existence of a type environment satisfying some properties) can be reduced to first-order constrained Horn clause solving Terauchi (2010); Bjørner et al. (2012); Jhala et al. (2011). Hence, the search for a witnessing environment can be automated using standard techniques (an explicit definition is included in Appendix C).

In order to check that the approach is feasible, we have implemented a prototype tool and used it to automatically verify a few small systems of clauses. The tool is written in Haskell and uses the Parsec library for parsing input in a mathematical syntax using unicode characters or ascii equivalents. Output is either a similar format or conforms to SMT-LIB in a manner that lets Z3 De Moura and Bjørner (2008) solve the system of first order clauses.

The test cases are obtained from that subset of the functional program verification problems given in Kobayashi et al. (2011) which do not make local assertions, re-expressed as higher-order Horn clause problems according to the method sketched by example in Section 1. The prototype999A basic web interface to the prototype tool is available at http://mjolnir.cs.ox.ac.uk/horus.

and the exact suite of test cases is available at http://github.com/penteract/HigherOrderHornRefinement. In all but one of the examples the prototype takes around 0.01s to transform the system of clauses and Z3 takes around 0.02s to solve the resulting first-order system. The remaining example, named neg, suffers from our choice of refinement type system. It is solved by the system described in loc. cit., which allows type-level intersection, but cannot be solved using our approach.

5.5 Expressibility of type assertions

It is possible to express the complement of a type using a goal formula. For example, according to the forgoing semantics, the type

[TABLE]

represents the set $\mathcal{M}\llbracket T\rrbracket(\emptyset)$ of all monotone relations of sort $(\iota\to\iota\to o)\to\iota\to o$ that relate all parity-preserving inputs to non-zero outputs. The complement of this set of relations can be defined (in the monotone semantics) by the goal term $\mathsf{Com}(T)\coloneqq\lambda z.\,\mathit{z}\>\mathit{(\lambda xy.\,\mathit{x}\>\mathit{\equiv y}\>\mathit{\mathrel{\mathsf{mod}}}\>\mathit{2})\ 0}$ which classifies such relations according to whether or not they relate the particular parity-preserving relation $\lambda xy.\,\mathit{x}\>\mathit{\equiv y}\>\mathit{\mathrel{\mathsf{mod}}}\>\mathit{2}$ to [math]. The mode of definition we have in mind is the following.

Goal definability.

We say that a relation $r\in\mathcal{M}\llbracket\rho\rrbracket$ is goal term definable (more briefly $G$-definable) just if there exists a closed goal term $\vdash H:\rho$ and $\mathcal{M}\llbracket H\rrbracket(\emptyset)=r$. We say that a class of relations is $G$-definable just if the characteristic predicate of the class is $G$-definable.

Returning to the example, if a given relation $r$ does not relate $\lambda xy.\,\mathit{x}\>\mathit{\equiv y}\>\mathit{\mathrel{\mathsf{mod}}}\>\mathit{2}$ to [math], then $r$ is not a member of $\mathcal{M}\llbracket T\rrbracket(\emptyset)$. On the other hand, if $r$ is not a member $\mathcal{M}\llbracket T\rrbracket(\emptyset)$, then there is some parity-preserving relation $s$ that is related by $r$ to [math]. Since $r$ is monotone, it follows that $r$ also relates all relations larger than $s$ to [math]. Since $\lambda xy.\,\mathit{x}\>\mathit{\equiv y}\>\mathit{\mathrel{\mathsf{mod}}}\>\mathit{2}$ is the largest of the parity-preserving relations, it follows that $r$ relates $\lambda xy.\,\mathit{x}\>\mathit{\equiv y}\>\mathit{\mathrel{\mathsf{mod}}}\>\mathit{2}$ to [math]. Hence the set

[TABLE]

is $G$-definable by the goal term $\mathsf{Com}(T)$.

Definability of type complements and the relational semantics.

Any $G$-definition $\mathsf{Com}(T)$ of the complement of $T$ is intertwined with a $G$-definition of the largest element of $T$: to understand when a relation $r$ is not in the type $T_{1}\to T_{2}$ you must understand when there exists a relation $s\in\mathcal{M}\llbracket T_{1}\rrbracket(\emptyset)$ such that $r(s)$ is not in $\mathcal{M}\llbracket T_{2}\rrbracket(\emptyset)$, i.e. when the property $\mathcal{M}\llbracket\mathsf{Com}(T)\rrbracket(\emptyset)(r(s))$ holds. However, since $\mathcal{M}\llbracket\mathsf{Com}(T)\rrbracket(\emptyset)$ and $r$ are monotone, if $\mathcal{M}\llbracket\mathsf{Com}(T)\rrbracket(\emptyset)(r(s))$ holds then $\mathcal{M}\llbracket\mathsf{Com}(T)\rrbracket(r(s^{\prime}))$ holds for any $s^{\prime}\supseteq s$. Consequently, there exists an $s\in\mathcal{M}\llbracket T_{1}\rrbracket(\emptyset)$ satisfying the property iff the largest element of $\mathcal{M}\llbracket T_{1}\rrbracket(\emptyset)$ satisfies the property. This leads to the definitions by mutual induction on type:

[TABLE]

in which $\mathsf{Com}(T)$ is a $G$-definition of the complement of the class $\mathcal{M}\llbracket T\rrbracket(\emptyset)$. The definition of $\mathsf{Lar}$ is parametrised by a goal formula representing domain conditions that are accumulated during the analysis of function types. It follows that $\mathsf{Lar}(\mathsf{false})(T)$ is a $G$-definition of the largest element of the class $\mathcal{M}\llbracket T\rrbracket(\emptyset)$.

Lemma 8**.**

For any closed type $\vdash T::\rho$:

1. (i)

The goal term $\mathsf{Com}(T)$ is a $G$-definition of the class $\{r\in\mathcal{M}\llbracket\rho\rrbracket\mid r\notin\mathcal{M}\llbracket T\rrbracket(\emptyset)\}$. 2. (ii)

The goal term $\mathsf{Lar}(\mathsf{false})(T)$ is a $G$-definition of the relation $\mathcal{M}\llparenthesis T\rrparenthesis(\emptyset)$.

This gives a sense in which we can express the higher-type property $G:T$ within the higher-order constrained Horn clause framework, namely as the goal formula $\mathsf{Com}(T)\ G$ defining the negation of the type assertion (recall that in the higher-order Horn clause problem we aim to refute the negation of property to be proven, expressed as a goal formula). Furthermore, we can use this result in order to justify an extension of the syntax of higher-order constrained Horn clauses with a new kind of type-guarded existential quantification. This allows us to state goal formulas like $\exists x\!:\!T.G$, i.e. there exists a relation in (the set defined by) refinement type $T$ that moreover satisfies $G$. The full development is contained in the anonymous supplementary materials.

6 Related Work

Constrained Horn-clause solving in first-order program verification

Our motivation comes mainly from the use of constrained Horn clauses to express problems in the verification of first-order, imperative programs. The papers of Bjørner et al. (2012) and Bjørner et al. (2015) argue the case for the approach and provide a good overview of it. One of the best recommendations for the approach is the selection of highly efficient solvers that are available, such as Grebenshchikov et al. (2012); Hoder et al. (2011); Gurfinkel et al. (2015), which we exploit in this work as part of the automation of our prototype solver for higher-order clauses.

Higher-order logic programming

Work on higher-order logic programming is typically concerned with programming language design and implementation. Consequently, one of the main themes of the work discussed in the following is that of (i) finding a good semantics for higher-order logic programming languages, and one of the central criteria for a good semantics is that (ii) it lends itself well to developing techniques for enumerating answers to queries. In contrast to (i), our work is about a particular satisfiability problem of logic, namely the existence of a model of a formula satisfying certain criteria (modulo a background theory). In higher-order logic programming (e.g. Nadathur and Miller (1990); Chen et al. (1993); Charalambidis et al. (2013)) it often does not make sense, a priori, to ask about the existence of models because the semantics of the logic programming language is fixed once and for all as part of its definition. One can ask whether the set of answers to a program query is empty, but to understand this as a logical question about the models of a formula is only possible through a result such as our contribution in Section 4. In contrast to (ii), our goal is to develop techniques, such as the type system in Section 5, for the dual problem, namely to show that a Horn formula is satisfiable (recall that we require the existence of a model refuting the goal $G$, and the goal is the negation of a Horn clause $G\Rightarrow\mathsf{false}$). Query answering (unsatisfiability) is recursively enumerable, whereas satisfiability, in particular where there is a background theory, is typically harder.

Recent work on extensional semantics for higher-order logic programming started with Wadge (1991) and continued with, for example, Charalambidis et al. (2013, 2014). Wadge was the first to observe that relational variables appearing as arguments in the head of clauses is problematic. This line of work gives a denotational semantics to higher-order logic programs and so is very closely related to the monotone semantics of logic programs that we use in Section 4, except that there is no treatment of constraint theories (discussed in the following paragraph). Unlike our work, Charalambidis et al. (2013) are very careful to ensure the algebraicity of their domains so that they can build a sophisticated system of query answering based on enumerating compact elements. If we were to extend our work to encompass a treatment of counterexamples, then we would want to exploit algebraicity in a similar manner. Their work does not make any connection between their denotational semantics of higher-order logic programs and satisfiability in standard higher-order logic; it seems likely that our result could be adapted to their setting.

Higher-order constraint logic programming.

Another way in which all of the foregoing work differs from our own is that, in the work we have mentioned so far, there is no treatment of constraints. Whilst first-order constraint logic programming is a very well developed area (an old, but good survey is Jaffar and Maher (1994)), there is very little existing work on the higher-order extension. Lipton and Nieva (2007) give a Kripke semantics for a $\lambda$Prolog-like language extended with a generic framework for constraints. In contrast to our work, the underlying higher-order logic is intuitionistic and the precise notion of model is bespoke to the paper.

Interpretations of higher-order logic

Under the standard semantics, an interpretation of a higher-order theory consists of a choice of universe $A_{\iota}$ in which to interpret the sort of individuals $\iota$ and an interpretation of the constants of the theory. In particular, the interpretation $\mathcal{S}\llbracket\sigma_{1}\to\sigma_{2}\rrbracket$ of any arrow sort $\sigma_{1}\to\sigma_{2}$ is fixed by the choice of $A_{\iota}$. In Henkin (or general) semantics, an interpretation consists of all of the above but, additionally, also a choice of interpretation for each of the infinitely many arrow sorts (under some natural restrictions regarding definability of elements). For example, there are Henkin interpretations in which the collection $\llbracket\mathsf{int}\to o\rrbracket$ does not contain all sets of integers. We choose to frame the higher-order constrained Horn clause problem using standard semantics because it is already established in verification. For example, when monadic second order logic (MSO) is used to express verification problems on transition systems, the second-order variables range over all sets of the states101010Or all finite sets of states in the case of weak MSO, but in both cases the domain is fixed by the setting. A Henkin semantics formulation of the problem would allow for a solution to the satisfiability problem to specify its own domain for the second order variables.. Consequently, the standard semantics seems the most appropriate starting point for work on higher-order constrained Horn clauses in verification.

Automated verification of functional programs

Two of the most well-studied approaches to the automated verification of functional programs are based on higher-order model checking Ong (2006); Kobayashi and Ong (2009); Kobayashi (2013) and refinement types Rondon et al. (2008); Vazou et al. (2015); Jhala et al. (2011); Zhu and Jagannathan (2013); Unno et al. (2013). A method to verify higher-order programs more directly using first-order constrained Horn clauses has been suggested by Bjørner, McMillan, and Rybalchenko (2013a).

In higher-order model checking, the problem of verifying a higher-order program is reformulated as the problem of verifying a property of the tree generated by a higher-order recursion scheme, see e.g. Kobayashi et al. (2011). The approach has the advantage of being based around a natural, decidable problem, which is an attractive target for the construction of efficient solvers Ramsay et al. (2014); Broadbent et al. (2013); Broadbent and Kobayashi (2013). By contrast, we propose to investigate higher-order program verification based around the higher-order constrained Horn clause problem. Although this problem is generally undecidable, it has the advantage of being able to express (background theory) constraints directly and so has the potential to be a better setting in which to search for higher-order program invariants.

In approaches based on refinement types, a type system is used to the reduce the problem of finding an invariant for the higher-order program, to finding a number of first-order invariants of the ground-type data at certain program points, which can often be expressed as first-order constrained Horn clause solving. As exemplified by the LiquidHaskell system of Vazou et al. (2014), one advantage of using a type system directly is that it can very naturally encompass all the features of modern programming languages. We have not addressed the problem of how best to frame a higher-order program verification problem using higher-order clauses (excepting our motivating sketch in the introduction) but it does not seem as clear as for approaches using refinement types. On the other hand, the reduction to first-order invariants that underlies refinement type approaches has a cost in expressibility. In principle, it is possible to overcome this deficiency, for example by employing types in which higher-order invariants can be encoded as first-order statements of arithmetic Unno et al. (2013); we mention also the scheme of Bjørner et al. (2013a) which proposes to view higher-order invariants as first-order statements about closures (encoded as data structures). However, in both cases it seems plausible that working directly in higher-order logic may lead to the development of more transparent and generic techniques. To benefit from this would necessitate a move to a different technology from our system of refinement types used for solving.

7 Conclusion and future work

In this work, we have presented our notion of higher-order constrained Horn clauses and the first foundational results, with an emphasis on making connections to existing work in the verification of higher-order programs. By analogy with the situation for first-order program verification, we believe that higher-order constrained Horn clauses can be an attractive, programming-language independent setting for developing automated techniques for the verification of higher-order programs. Let us conclude by giving some more justification to this belief through a discussion of future work.

We have shown, in Example 4, that our method for solving is bound by the same limitations as typical refinement type systems in the literature. However, there is a lot of scope to develop new approaches to solving which may not suffer in the same way. A general result in this direction would be to show that these limitations are not intrinsic to the higher-order constrained Horn clause problem. For example, it seems plausible that higher-order clauses are expressive (in the sense of Cook) for suitable Hoare logics over higher-order programs, mirroring the case at first-order Blass and Gurevich (1987); Bjørner et al. (2015). A specific technique for solving, which we plan to pursue, is an approach for reducing higher-order clauses to first-order clauses with datatypes, using the ideas of Bjørner et al. (2013a) (which is itself in the spirit of Reynolds’ defunctionalisation Reynolds (1972)).

In defunctionalisation, as in our method of Section 5, the goal is to reduce the problem to that of first-order clauses by doing some reasoning about the behaviour of higher-order functions. Without further investigation, it is unclear whether this reduction should happen at the level of programs (as is the case in e.g. Bjørner et al. (2013a)) or at the level of a higher-order intermediate representation such as higher-order constrained Horn clauses (as we have suggested in the introduction). However, if one believes that the reasoning involved in such a reduction is generic, in the sense of being essentially the same whether the programs are written in Haskell, or ML, or Javascript, then this suggests that it is worthwhile to investigate whether this reasoning can be done efficiently on the intermediate representation, rather than have the reasoning re-implemented in each different analysis of each different higher-order programming language.

Finally, we make the observation that higher-order constraints may be useful even in the verification of first-order procedures. For example, in refinement type systems, a refinement of a base type is typically a predicate on values of the type. Therefore, it seems reasonable that a refinement of a type constructor should be a (Boolean-valued) function on predicates, i.e. a higher-order relation. It would be interesting to develop a type inference algorithm that can reason about refinements of type constructors (a concern that is orthogonal to the existence of higher-order procedures) using higher-order constraints, and to understand the connections with the work of Vazou, Rondon, and Jhala (2013).

Acknowledgements.

Research was partially completed while the second and third authors were visiting the Institute for Mathematical Sciences, National University of Singapore in 2016.

Appendix A Supplementary material for Section 4

A.1 Proof of Lemma 4

We first consider the special case in which $G$ is existential quantification and rephrase the latter claim equivalently as $\mathsf{L}\circ\mathcal{S}\llbracket\exists\rrbracket\subseteq\mathcal{M}\llbracket\exists\rrbracket\circ\mathsf{L}$ (which is easier to prove).

Lemma 9**.**

For sorts $\sigma$ (either $\iota$ or some $\rho$),   $\mathsf{mexists}_{\sigma}\circ\mathsf{U}_{\sigma\to o}\;\subseteq\;\mathsf{exists}_{\sigma}\;\subseteq\;\mathsf{mexists}_{\sigma}\circ\mathsf{L}_{\sigma\to o}$.

Proof.

In case $\sigma$ is $\iota$, by definition $\mathsf{mexists}_{\iota}=\mathsf{exists}_{\iota}$ and $\mathsf{U}_{\iota\to o}(s)=s=\mathsf{L}_{\iota\to o}(s)$, so the result is clear. Otherwise, $\sigma$ is some relational sort $\rho$ and we observe that both of the following are true for all $s\in\mathcal{S}\llbracket\rho\to o\rrbracket$:

• (i)

for all $r\in\mathcal{M}\llbracket\rho\rrbracket$: $\mathsf{U}_{\rho\to o}(s)(r)=1$ implies $s(\mathsf{J}_{\rho}(t))=1$

• (i)

for all $t\in\mathcal{S}\llbracket\rho\rrbracket$: $s(t)=1$ implies $\mathsf{L}_{\rho\to o}(s)(\mathsf{L}_{\rho}(t))=1$

Hence, (i) witnesses $r$ to the satisfiability of $\mathsf{U}(s)$ can be mapped to witnesses $\mathsf{J}(t)$ to the satisfiability of $s$ and (ii) witnesses $t$ to the satisfiability of $s$ can be mapped to witnesses $\mathsf{L}(t)$ to the satisfiability of $\mathsf{L}(s)$; thus proving the lemma. To see that (i) is true we just observe that if $\mathsf{U}_{\rho\to o}(s)(r)=1$, then $s(\mathsf{J}_{\rho}(r))=1$ by definition. To see that (ii) is true, we reason as follows. If $s(t)=1$, then since $\mathsf{I}\circ\mathsf{L}$ is inflationary, also $\mathsf{I}_{\rho\to o}(\mathsf{L}_{\rho\to o}(s))(t)=1$. Hence, by definition, $\mathsf{L}_{\rho\to o}(s)(\mathsf{L}_{\rho}(t))=1$. ∎

Lemma 4.

For all goal terms $\Delta\vdash G:\rho$,  $\mathsf{J}_{\rho}\circ\mathcal{M}\llbracket G\rrbracket\circ\mathsf{U}_{\Delta}\;\subseteq\;\mathcal{S}\llbracket G\rrbracket\;\subseteq\;\mathsf{I}_{\rho}\circ\mathcal{M}\llbracket G\rrbracket\circ\mathsf{L}_{\Delta}$.

Proof.

The proof of the inclusion $\mathsf{J}\circ\mathcal{M}\llbracket G\rrbracket\circ\mathsf{U}\subseteq\mathcal{S}\llbracket G\rrbracket$ is by induction on the sorting judgement for goal terms. We give here only the more interesting cases:

• •

If $\Delta\vdash x:\rho$ then:

[TABLE]

by definition and the fact that $\mathsf{J}\circ\mathsf{U}$ is deflationary.

• •

If $\Delta\vdash\varphi:o$ with $\varphi$ a formula of the constraint language, then:

[TABLE]

by definition and since the free variables of $\varphi$ are assumed to be all first-order.

• •

If $\Delta\vdash HK:\rho_{2}$ with $\Delta\vdash H:\rho_{1}\to\rho_{2}$ and $\Delta\vdash K:\rho_{1}$, then we reason as follows. First observe that:

[TABLE]

by definition and because $\mathsf{J}\circ\mathcal{M}\llbracket H\rrbracket(\mathsf{U}(\alpha))$ is monotone and $\mathsf{U}\circ\mathsf{J}$ is inflationary. Then:

[TABLE]

by definition, the induction hypothesis and because $\mathsf{J}(r)$ is monotone in general because $r$ is. Finally:

[TABLE]

by definition and the induction hypothesis.

• •

If $\Delta\vdash\lambda x.\,\mathit{H}:\rho_{1}\to\rho_{2}$ and $\Delta,x:\!\rho_{1}\vdash H:\rho_{2}$, we first observe that:

[TABLE]

follows from the definitions. Then we note that:

[TABLE]

follows by definition and the induction hypothesis.

• •

If $\Delta\vdash\vee:o\to o\to o$ or $\Delta\vdash\wedge:o\to o\to o$, the result holds by definition.

• •

If $\Delta\vdash\exists_{\sigma}:(\sigma\to o)\to o$ then:

[TABLE]

follows by definition and Lemma 9.

Showing the inclusion $\mathcal{S}\llbracket G\rrbracket\subseteq\mathsf{I}\circ\mathcal{M}\llbracket G\rrbracket\circ\mathsf{L}$ is dual: just observe that whenever, in the above proof, an inclusion is justified by $\mathsf{U}\circ\mathsf{J}$ being inflationary (respectively $\mathsf{J}\circ\mathsf{U}$ deflationary), the corresponding reverse inclusion can be justified by noting that $\mathsf{L}\circ\mathsf{I}$ is deflationary (respectively $\mathsf{I}\circ\mathsf{L}$ inflationary). ∎

Appendix B Supplementary Material for Section 5

B.1 Proof of Lemma 7

Lemma 10**.**

Let $\Delta\vdash T_{1}\to T_{2}::\rho_{1}\to\rho_{2}$ be a type and let $\alpha\in\mathcal{M}\llbracket\Delta\rrbracket$ be a first order valuation. Then $\mathcal{M}\llparenthesis T_{1}\to T_{2}\rrparenthesis(\alpha)$ is monotone.

Proof.

Let $t_{1},t_{2}\in\mathcal{M}\llbracket\rho_{1}\rrbracket$ and consider the following two cases.

• •

If $t_{1}\subseteq\mathcal{M}\llparenthesis T_{1}\rrparenthesis(\alpha)$, then $\mathcal{M}\llparenthesis T_{1}\to T_{2}\rrparenthesis(\alpha)(t_{1})=\mathcal{M}\llparenthesis T_{2}\rrparenthesis(\alpha)$. Since $\mathcal{M}\llparenthesis T_{1}\to T_{2}\rrparenthesis(\alpha)(t_{2})$ is either $\mathcal{M}\llparenthesis T_{2}\rrparenthesis(\alpha)$ or $\top$, it follows that $\mathcal{M}\llparenthesis T_{1}\to T_{2}\rrparenthesis(\alpha)(t_{1})\subseteq\mathcal{M}\llparenthesis T_{1}\to T_{2}\rrparenthesis(\alpha)(t_{2})$.

• •

Otherwise, $\mathcal{M}\llparenthesis T_{1}\to T_{2}\rrparenthesis(\alpha)(t_{1})=\top$ and it follows from the assumption that $t_{2}\not\subseteq\mathcal{M}\llparenthesis T_{1}\rrparenthesis(\alpha)$. Hence, also $\mathcal{M}\llparenthesis T_{1}\to T_{2}\rrparenthesis(\alpha)(t_{2})=\top$.

∎

Lemma 7.

For all types $\Delta\vdash T::\rho$ and $\alpha\in\mathcal{M}\llbracket\Delta\rrbracket$, $\mathcal{M}\llbracket T\rrbracket(\alpha)={\Downarrow}\mathcal{M}\llparenthesis T\rrparenthesis(\alpha)$.

Proof.

The proof is by induction on the derivation of the sorting judgement.

• •

When the judgement is of shape $\Delta\vdash o\langle\mathit{\varphi}\rangle::o$, clearly $\{0,\mathcal{S}\llbracket\varphi\rrbracket(\alpha)\}={\Downarrow}\mathcal{M}\llparenthesis\varphi\rrparenthesis(\alpha)$.

• •

When the judgement is of shape $\Delta\vdash x{:}\mathit{\iota}\to\mathit{T}::\iota\to\rho$ we first observe that, for all $n\in A_{\iota}$, it follows from the induction hypothesis that $\mathcal{M}\llbracket T\rrbracket(\alpha[x\mapsto n])={\Downarrow}\mathcal{M}\llparenthesis T\rrparenthesis(\alpha[x\mapsto n])$. To see downwards closure, let $t_{2}\in\mathcal{M}\llbracket x{:}\mathit{\iota}\to\mathit{T}\rrbracket$ and $t_{1}\subseteq t_{2}$. Then, for all $n\in A_{\iota}$, $t_{2}(n)\in\mathcal{M}\llbracket T\rrbracket(\alpha[x\mapsto n])$. Since $t_{1}(n)\subseteq t_{2}(n)$ and this set is downwards closed, it follows that $t_{1}(n)$ is also a member. To see membership, $\mathcal{M}\llparenthesis x{:}\mathit{\iota}\to\mathit{T}\rrparenthesis(\alpha)(n)\in\mathcal{M}\llbracket T\rrbracket(\alpha[x\mapsto n])$ so, by definition, $\mathcal{M}\llparenthesis x{:}\mathit{\iota}\to\mathit{T}\rrparenthesis(\alpha)\in\mathcal{M}\llbracket x{:}\mathit{\iota}\to\mathit{T}\rrbracket(\alpha)$. Finally, let $r\in\mathcal{M}\llbracket x{:}\mathit{\iota}\to\mathit{T}\rrbracket(\alpha)$ and let $n\in A_{\iota}$. Then it follows that $r(n)\in\mathcal{M}\llbracket T\rrbracket(\alpha[x\mapsto n])$ so $r(n)\subseteq\mathcal{M}\llparenthesis T\rrparenthesis(\alpha[x\mapsto n])$ as required.

• •

When the judgement has shape $\Delta\vdash T_{1}\to T_{2}::\rho_{1}\to\rho_{2}$ we proceed as follows. To see that $\mathcal{M}\llbracket T_{1}\to T_{2}\rrbracket(\alpha)$ is downwards closed, let $t_{2}$ be a member and $t_{1}\subseteq t_{2}$. Then let $t\in\mathcal{M}\llbracket T_{1}\rrbracket(\alpha)$. It follows that $t_{2}(t)\in\mathcal{M}\llbracket T_{2}\rrbracket(\alpha)$ and $t_{1}(t)\subseteq t_{2}(t)$, so the result follows from the induction hypothesis. To see membership, let $t\in\mathcal{M}\llbracket T_{1}\rrbracket(\alpha)$. It follows from the induction hypothesis that, therefore $t\subseteq\mathcal{M}\llparenthesis T_{1}\rrparenthesis(\alpha)$. Hence $\mathcal{M}\llparenthesis T_{1}\to T_{2}\rrparenthesis(\alpha)(t)=\mathcal{M}\llparenthesis T_{2}\rrparenthesis(\alpha)$ and it follows from the induction hypothesis that $\mathcal{M}\llparenthesis T_{2}\rrparenthesis(\alpha)\in\mathcal{M}\llbracket T_{2}\rrbracket(\alpha)$, as required. To see the extremal property, let $s\in\mathcal{M}\llbracket T_{1}\to T_{2}\rrbracket(\alpha)$ and let $t\in\mathcal{M}\llbracket\rho_{1}\rrbracket$. If $t\in\mathcal{M}\llbracket T_{1}\rrbracket(\alpha)$, so that $t\subseteq\mathcal{M}\llparenthesis T_{1}\rrparenthesis(\alpha)$ follows from the induction hypothesis, then the fact that $s(t)\subseteq\mathcal{M}\llparenthesis T_{1}\to T_{2}\rrparenthesis(\alpha)(t)$ follows from the fact that $s(t)\in\mathcal{M}\llbracket T_{2}\rrbracket(\alpha)$, $\mathcal{M}\llparenthesis T_{1}\to T_{2}\rrparenthesis(\alpha)(t)=\mathcal{M}\llparenthesis T_{2}\rrparenthesis(\alpha)$ and the induction hypothesis. Otherwise, $t\notin\mathcal{M}\llbracket T_{1}\rrbracket(\alpha)$ and it follows from the induction hypothesis that, therefore, $t\not\subseteq\mathcal{M}\llparenthesis T_{1}\rrparenthesis(\alpha)$. Hence $\mathcal{M}\llparenthesis T_{1}\to T_{2}\rrparenthesis(\alpha)(t)=\top_{\rho_{2}}$ and the result is immediate.

∎

B.2 Proof of Theorem 3

Theorem 3.

For all $\vdash\theta:\Delta$, $\vdash\Gamma::\Delta$, $\Delta\vdash G:\sigma$ and $\Delta\vdash T,T_{1},T_{2}::\sigma$, the following is true:

1. (i)

$\vdash T_{1}\sqsubseteq T_{2}$* implies $\vDash T_{1}\sqsubseteq T_{2}$* 2. (ii)

$\Gamma\vdash G:T$* implies $\Gamma\vDash G:T$* 3. (iii)

$\vdash P:\Gamma$* implies $\vDash P:\Gamma$*

Proof.

The proof of the first claim is by induction on the derivation.

• •

If the conclusion is $\vdash\mathsf{int}\sqsubseteq\mathsf{int}$ the result follows immediately.

• •

If the conclusion is $\vdash o\langle\mathit{\varphi}\rangle\sqsubseteq o\langle\mathit{\psi}\rangle$, then necessarily, for all $\alpha\in\mathcal{M}\llbracket\Delta\rrbracket$, $\alpha\vDash\varphi\Rightarrow\psi$. Then let $\alpha\in\mathcal{M}\llbracket\Delta\rrbracket$. It follows that $\mathcal{M}\llbracket o\langle\mathit{\varphi}\rangle\rrbracket(\alpha)=\{0,\mathcal{M}\llbracket\varphi\rrbracket(\alpha)\}\subseteq\{0,\mathcal{M}\llbracket\psi\rrbracket(\alpha)\}$.

• •

If the conclusion is $\vdash x{:}\mathit{T_{1}}\to\mathit{T_{2}}\sqsubseteq y{:}\mathit{T_{1}^{\prime}}\to\mathit{T_{2}^{\prime}}$, let $\alpha\in\mathcal{M}\llbracket\Delta\rrbracket$, $r\in\mathcal{M}\llbracket x:T_{1}\to T_{2}\rrbracket(\alpha)$ and $s\in\mathcal{M}\llbracket T_{1}^{\prime}\rrbracket$. It follows from the induction hypothesis that

[TABLE]

where $\beta=(\alpha\setminus\{x\mapsto\alpha(x)\})\cup\{z\mapsto\alpha(x)\}$ and $\gamma=(\alpha\setminus\{y\mapsto\alpha(y)\})\cup\{z\mapsto\alpha(y)\}$. It follows that $s\in\mathcal{M}\llbracket T_{1}\rrbracket(\alpha)$ and hence $r(s)\in\mathcal{M}\llbracket T_{2}[s/y]\rrbracket(\alpha)$. Finally, we observe that therefore $r(s)\in\mathcal{M}\llbracket T_{2}^{\prime}[s/y]\rrbracket(\alpha)$.

The proof of the second claim is by induction on the typing derivation.

• •

When the judgement has shape $\Gamma_{1},x:T,\Gamma_{2}\vdash x:T$, assume $\alpha\vDash\Gamma$. Then $\mathcal{M}\llbracket G\rrbracket(\alpha)=\alpha(x)$. From our assumption, $\alpha(x)\in\mathcal{M}\llbracket\Gamma(x)\rrbracket$, i.e. $\alpha(x)\in\mathcal{M}\llbracket T\rrbracket(\alpha)$ as required.

• •

When the judgement has shape $\Gamma\vdash\varphi:o\langle\mathit{\varphi}\rangle$, it follows immediately that $\mathcal{M}\llbracket\varphi\rrbracket(\alpha)\in\mathcal{M}\llbracket o\langle\mathit{\varphi}\rangle\rrbracket$.

• •

When the judgement has shape $\Gamma\vdash G\wedge H:o\langle\mathit{\varphi\wedge\psi}\rangle$, let $\alpha\vDash\Gamma$. It follows from the induction hypothesis that $\Gamma\vDash G:o\langle\mathit{\varphi}\rangle$ and $\Gamma\vDash H:o\langle\mathit{\psi}\rangle$ and consequently, $\mathcal{M}\llbracket G\rrbracket(\alpha)\in\mathcal{M}\llbracket o\langle\mathit{\varphi}\rangle\rrbracket$ and $\mathcal{M}\llbracket H\rrbracket(\alpha)\in\mathcal{M}\llbracket o\langle\mathit{\varphi}\rangle\rrbracket$. The result then follows from Lemma 6.

• •

When the judgement has shape $\Gamma\vdash G\vee H:o\langle\mathit{\varphi\vee\psi}\rangle$ the proof is analogous to the case above.

• •

When the judgement has shape $\Gamma\vdash\exists x.G:o\langle\mathit{\exists x.\varphi}\rangle$ let $\alpha\vDash\Gamma$. It follows from the induction hypothesis that $\Gamma,x:\mathsf{int}\vDash G:o\langle\mathit{\varphi}\rangle$. Hence, for any $n\in\mathcal{M}\llbracket\mathsf{int}\rrbracket$, $\alpha[x\mapsto n]\vDash G\Rightarrow\varphi$. Assume $\alpha\vDash\exists x.G$, then there is some $n$ such that $\alpha[x\mapsto n]\vDash G$ which has the consequence that $\alpha[x\mapsto n]\vDash\varphi$ and hence $\alpha\vDash\exists x.\varphi$. The result then follows from Lemma 6.

• •

When the judgement has shape $\Gamma\vdash\mathit{G}\>\mathit{H}:T_{2}[H/x]$ and $\Gamma\vdash H:\mathsf{int}$, let $\alpha\vDash\Gamma$. It follows from the induction hypothesis that $\mathcal{M}\llbracket G\rrbracket(\alpha)\in\mathcal{M}\llbracket x{:}\mathit{\mathsf{int}}\to\mathit{T_{2}}\rrbracket(\alpha)$ and $\mathcal{M}\llbracket H\rrbracket(\alpha)\in\mathcal{M}\llbracket\mathsf{int}\rrbracket(\alpha)$. Hence, by definition, $\mathcal{M}\llbracket\mathit{G}\>\mathit{H}\rrbracket(\alpha)\in\mathcal{M}\llbracket T_{2}\rrbracket(\alpha[x\mapsto\mathcal{M}\llbracket H\rrbracket(\alpha)])=\mathcal{M}\llbracket T_{2}[H/x]\rrbracket(\alpha)$.

• •

When the judgement has shape $\Gamma\vdash\mathit{G}\>\mathit{H}:T_{2}$ and $\Gamma\vdash H:T_{1}$ and $T_{1}$ is not $\mathsf{int}$, let $\alpha\vDash\Gamma$. It follows from the induction hypothesis that $\mathcal{M}\llbracket G\rrbracket(\alpha)\in\mathcal{M}\llbracket T_{1}\to T_{2}\rrbracket$ and $\mathcal{M}\llbracket H\rrbracket\in\mathcal{M}\llbracket T_{1}\rrbracket$. Hence, it follows by definition that $\mathcal{M}\llbracket\mathit{G}\>\mathit{H}\rrbracket(\alpha)\in\mathcal{M}\llbracket T_{2}\rrbracket(\alpha)$.

• •

When the judgement has shape $\Gamma\vdash\mathit{\lambda x:\mathsf{int}.\,\mathit{G}}:x{:}\mathit{\mathsf{int}}\to\mathit{T}$, let $\alpha\vDash\Gamma$. It follows from the induction hypothesis that, for all $n\in\mathcal{M}\llbracket\mathsf{int}\rrbracket$, $\mathcal{M}\llbracket G\rrbracket(\alpha[x\mapsto n])\in\mathcal{M}\llbracket T\rrbracket(\alpha[x\mapsto n])$. By definition $\mathcal{M}\llbracket\lambda x:\mathsf{int}.\,\mathit{G}\rrbracket(\alpha)\in\mathcal{M}\llbracket x{:}\mathit{\mathsf{int}}\to\mathit{T}\rrbracket(\alpha)$ just if, for all $n\in\mathcal{M}\llbracket\mathsf{int}\rrbracket$, $\mathcal{M}\llbracket\lambda x:\mathsf{int}.\,\mathit{G}\rrbracket(\alpha)(n)\in\mathcal{M}\llbracket T\rrbracket(\alpha[x\mapsto n])$. The result then follows from the definition of $\mathcal{M}\llbracket\lambda x.\,\mathit{G}\rrbracket(\alpha)(n)$ and the previous observation.

• •

When the judgement has shape $\Gamma\vdash\lambda x:\rho.\,\mathit{G}:T_{1}\to T_{2}$ for $T_{1}\neq\mathsf{int}$, let $\alpha\vDash\Gamma$. It follows from the induction hypothesis that, for all $r\in\mathcal{M}\llbracket T_{1}\rrbracket(\alpha)$, then $\mathcal{M}\llbracket G\rrbracket(\alpha[x\mapsto r])\in\mathcal{M}\llbracket T_{2}\rrbracket(\alpha[x\mapsto r])$. Let $r\in\mathcal{M}\llbracket T_{1}\rrbracket(\alpha)$, then $\mathcal{M}\llbracket\lambda x.\,\mathit{G}\rrbracket(\alpha)(r)=\mathcal{M}\llbracket G\rrbracket(\alpha[x\mapsto r])$. It follows from the previous observation that this expression is an element of $\mathcal{M}\llbracket T_{2}\rrbracket(\alpha[x\mapsto r])$, but $T_{2}$ cannot have any occurrence of relational variable $x$ since it is built out of constraint formulas.

In the third case we reason as follows. Assume $\vdash P:\Gamma$ so that, necessarily, for all $x\in\mathsf{dom}(\Delta)$, $\Gamma\vdash P(x):\Gamma(x)$. Then it follows from part (ii) that, for each $x\in\mathsf{dom}(\Delta)$, and $\alpha$ satisfying $\Gamma$, $\mathcal{M}\llbracket P(x)\rrbracket(\alpha)\in\mathcal{M}\llbracket\Gamma(x)\rrbracket$. It follows from Lemma 7 that $\mathcal{M}\llparenthesis\Gamma\rrparenthesis$ satisfies $\Gamma$. Consequently, for all $x\in\mathsf{dom}(\Delta)$, $\mathcal{M}\llbracket P(x)\rrbracket(\mathcal{M}\llparenthesis\Gamma\rrparenthesis)\in\mathcal{M}\llbracket\Gamma(x)\rrbracket$, which is to say that $\mathcal{M}\llbracket P(x)\rrbracket(\mathcal{M}\llparenthesis\Gamma\rrparenthesis)\subseteq\mathcal{M}\llparenthesis\Gamma\rrparenthesis(x)$. Hence, $\mathcal{M}\llparenthesis\Gamma\rrparenthesis$ is a prefixpoint of $T^{\mathcal{M}}_{P:\Delta}$. It follows from the canonicity of $\mathcal{M}\llbracket P\rrbracket$ that $\mathcal{M}\llbracket P\rrbracket\subseteq\mathcal{M}\llparenthesis\Gamma\rrparenthesis$ and, by Lemma 7, that therefore, for all $x\in\mathsf{dom}(\Delta)$, $\mathcal{M}\llbracket P\rrbracket(x)\in\mathcal{M}\llbracket\Gamma(x)\rrbracket$.

∎

B.3 Proof of Lemma 8

Lemma 8.

For any closed type $\vdash T::\rho$:

1. (i)

The goal term $\mathsf{Com}(T)$ is a $G$-definition of the class $\{r\in\mathcal{M}\llbracket\rho\rrbracket\mid r\notin\mathcal{M}\llbracket T\rrbracket(\emptyset)\}$. 2. (ii)

The goal term $\mathsf{Lar}(\mathsf{false})(T)$ is a $G$-definition of the relation $\mathcal{M}\llparenthesis T\rrparenthesis(\emptyset)$.

Proof.

We generalise the statement, proving for all $\Delta\vdash T::\rho$, $\alpha\in\mathcal{M}\llbracket\Delta\rrbracket$ and goal formulas $\Delta\vdash G:o$: $\mathcal{M}\llbracket\mathsf{Com}(T)\rrbracket(\alpha)=\{r\in\mathcal{M}\llbracket\rho\rrbracket\mid r\notin\mathcal{M}\llbracket T\rrbracket(\alpha)\}$ and, for all $\overline{d}$ of the appropriate sorts: $\mathcal{M}\llbracket\mathsf{Lar}(G)(T)\rrbracket(\alpha)(\overline{d})=1$ iff $\mathcal{M}\llbracket G\rrbracket(\alpha)$ = 1 or $\mathcal{M}\llparenthesis T\rrparenthesis(\alpha)(\overline{d})=1$. The proof is by induction on $\Delta\vdash T::\rho$.

• •

If the judgement is of shape $\Delta\vdash o\langle\mathit{\varphi}\rangle::o$ then we reason as follows.

1. (i)

For all $b\in\mathbbm{2}$:

[TABLE]

This latter expression evaluates to $1$ iff $\alpha[x\mapsto b]\not\vDash x\Rightarrow\varphi$ (by the variable convention we assume that $x$ does not occur in $\varphi$). It follows from Lemma 6 that this is the case iff $\mathcal{M}\llbracket x\rrbracket(\alpha[x\mapsto b])=b\notin\mathcal{M}\llbracket T\rrbracket(\alpha[x\mapsto b])=\mathcal{M}\llbracket T\rrbracket(\alpha)$. 2. (ii)

Also, $\mathcal{M}\llbracket\mathsf{Lar}(G)(T)\rrbracket(\alpha)=\mathcal{M}\llbracket G\vee\varphi\rrbracket(\alpha)=\mathsf{or}(\mathcal{M}\llbracket G\rrbracket(\alpha))(\mathcal{M}\llbracket\varphi\rrbracket(\alpha))$. This latter expression denotes $1$ iff $\mathcal{M}\llbracket G\rrbracket(\alpha)=1$ or $\mathcal{M}\llbracket\varphi\rrbracket(\alpha)=1$.

• •

If the judgement is of shape $\Delta\vdash x{:}\mathit{\iota}\to\mathit{T^{\prime}}::\iota\to\rho$ then we reason as follows.

1. (i)

For all $r\in\mathcal{M}\llbracket\iota\to\rho\rrbracket$:

[TABLE]

This latter expression denotes $1$ iff there is some $n\in A_{\iota}$ such that $\mathcal{M}\llbracket\mathsf{Com}(T^{\prime})(x\,y)\rrbracket(\alpha[z\mapsto r][x\mapsto n])=1$ and this is true iff there is some $n$ such that $\mathcal{M}\llbracket\mathsf{Com}(T^{\prime})\rrbracket(\alpha[x\mapsto n])(r(n))=1$. It follows from the induction hypothesis that this is true iff there is some $n$ such that $r(n)\notin\mathcal{M}\llbracket T^{\prime}\rrbracket(\alpha[x\mapsto n])$. This is exactly $r\notin\mathcal{M}\llbracket x{:}\mathit{\iota}\to\mathit{T^{\prime}}\rrbracket(\alpha)$. 2. (ii)

For all $n\in A_{\iota}$ and $\overline{d}$:

[TABLE]

It follows from the induction hypothesis that this denotes $1$ iff either $\mathcal{M}\llbracket G\rrbracket(\alpha[x\mapsto n])=1$ or $\mathcal{M}\llparenthesis T^{\prime}\rrparenthesis(\alpha[x\mapsto n])(\overline{d})=1$. We may assume, by the variable convention, that $x$ does not occur in $G$. This latter expression denotes $1$ iff $\mathcal{M}\llparenthesis x{:}\mathit{\iota}\to\mathit{T^{\prime}}\rrparenthesis(\alpha)$ by definition.

• •

If the judgement is of shape $\Delta\vdash T_{1}\to T_{2}::\rho_{1}\to\rho_{2}$ then we reason as follows.

1. (i)

For all $r\in\mathcal{M}\llbracket\rho_{1}\to\rho_{2}\rrbracket$:

[TABLE]

This latter expression is true iff $\mathcal{M}\llbracket\mathsf{Com}(T_{2})\rrbracket(\alpha)(r(\mathcal{M}\llbracket\mathsf{Lar}(\mathsf{false})(T_{1})\rrbracket(\alpha)))=1$. It follows from the induction hypothesis, part (ii), that this is the case iff

$\mathcal{M}\llbracket\mathsf{Com}(T_{2})\rrbracket(\alpha)(r(\mathcal{M}\llparenthesis T_{1}\rrparenthesis(\alpha)))=1$. By the monotonicity of the operator and the fact that $\mathcal{M}\llparenthesis T_{1}\rrparenthesis(\alpha)$ is the largest element of $\mathcal{M}\llbracket T_{1}\rrbracket(\alpha)$ (Lemma 7), this is true iff there is some $s\in\mathcal{M}\llbracket T_{1}\rrbracket(\alpha)$ such that $\mathcal{M}\llbracket\mathsf{Com}(T_{2})\rrbracket(\alpha)(r(s))=1$. It follows from the induction hypothesis, part (i), that this is true iff there is some $s\in\mathcal{M}\llbracket T_{1}\rrbracket(\alpha)$ such that $r(s)\notin\mathcal{M}\llbracket T_{2}\rrbracket(\alpha)$, which is exactly $r\notin\mathcal{M}\llbracket T_{1}\to T_{2}\rrbracket(\alpha)$. 2. (ii)

Fix $r\in\mathcal{M}\llbracket\rho_{1}\rrbracket(\alpha)$ and $\overline{d}$ appropriate to the argument sorts of $\rho_{2}$. Then:

[TABLE]

It follows from the induction hypothesis, part (ii), that this expression denotes $1$ iff (P1) $\mathcal{M}\llbracket G\vee\mathsf{Com}(T_{1})\,x\rrbracket(\alpha[x\mapsto r])=1$ or (P2) $\mathcal{M}\llparenthesis T_{2}\rrparenthesis(\alpha)(\overline{d})=1$. It follows that this first possibility (P1) is true iff $\mathcal{M}\llbracket G\rrbracket(\alpha)=1$ or $\mathcal{M}\llbracket\mathsf{Com}(T_{1})\rrbracket(\alpha)(r)=1$. It follows from the induction hypothesis, part (i), that $\mathcal{M}\llbracket\mathsf{Com}(T_{1})\rrbracket(\alpha)(r)=1$ iff $r\notin\mathcal{M}\llbracket T_{1}\rrbracket(\alpha)$. Consequently, (P1) or (P2) iff $\mathcal{M}\llbracket G\rrbracket(\alpha)=1$ or (Q1) $r\notin\mathcal{M}\llbracket T_{1}\rrbracket(\alpha)$ or (Q2) $\mathcal{M}\llparenthesis T_{2}\rrparenthesis(\alpha)(\overline{d})=1$. We claim that (Q1) or (Q2) iff $\mathcal{M}\llparenthesis T\rrparenthesis(\alpha)(r)(\overline{d})=1$. In the backward direction, assume that (Q1) does not hold. Then, by Lemma 7, $r\subseteq\mathcal{M}\llparenthesis T_{1}\rrparenthesis(\alpha)$ and $\mathcal{M}\llparenthesis T\rrparenthesis(\alpha)(r)(\overline{d})=1$ implies $\mathcal{M}\llparenthesis T_{2}\rrparenthesis(\alpha)(r)(\overline{d})=1$ which is (Q2). In the forward direction we analyse the two cases. In case (Q1), by Lemma 7, $r\not\subseteq\mathcal{M}\llparenthesis T_{1}\rrparenthesis(\alpha)$. Then $\mathcal{M}\llparenthesis T\rrparenthesis(\alpha)(r)(\overline{d})=\top_{\rho_{2}}(r)(\overline{d})=1$ by definition. Otherwise we assume (Q2) and not (Q1). Then, by Lemma 7, $r\subseteq\mathcal{M}\llparenthesis T_{1}\rrparenthesis(\alpha)$, so $\mathcal{M}\llparenthesis T_{2}\rrparenthesis(\alpha)(\overline{d})=1$ implies $\mathcal{M}\llparenthesis T\rrparenthesis(\alpha)(r)(\overline{d})=1$ by definition.

∎

Appendix C Type Inference

In this appendix we give an algorithm, presented as a collection of syntax directed rules of inference, for determining the typability of a logic program over quantifier free integer linear arithmetic. For convenience, we assume that the signature of the constraint language includes, for each sort $\mathsf{int}\to\cdots\to\mathsf{int}\to o$ of any arity, a countable supply of uninterpreted relation constants111111We use relation constants rather than variables to ensure we stay within a first-order language., which will appear in the inference as constraint formulas refining the propositional sort. The finite subset of these constants that are used in a given inference become the unknown relation symbols to be solved for in a first-order constrained Horn clause problem.

The sort of a well formed refinement type is determined uniquely so we define the underlying sort $T^{\flat}$ of a refinement type $T$ recursively:

[TABLE]

The underlying sort environment $\Gamma^{\flat}$ of a type environment $\Gamma$ is obtained recursively as follows:

[TABLE]

Fresh relational variables.

We suppose a function $\mathsf{freshRel}$ that, given a sort environment $\Delta$ and a second-order relational sort $\rho$, yields some term $\mathit{R}\>\mathit{x_{1}}\>\mathit{\cdots{}}\>\mathit{x_{k}}$ with

[TABLE]

a fresh, second-order relation constant, and the set $\{x_{1}:\mathsf{int},\ldots,x_{k}:\mathsf{int}\}$ exactly the subset of $\Delta$ consisting of variables of integer sort. We denote this situation by the judgement:

$R$ fresh

$\mathit{R}\>\mathit{x_{1}}\>\mathit{\cdots{}}\>\mathit{x_{k}}=\mathsf{freshRel}(\Delta)(\rho)$

Fresh types.

Similarly, given a sort environment $\Delta$ and a sort $\sigma$, we suppose a function $\mathsf{freshTy}$ that yields a choice of type $T$ refining $\sigma$ and which is constructed from fresh relations as described above. We will write a judgement of shape $T=\mathsf{freshTy}(\Delta)(\sigma)$, which is defined by the following system:

$\mathsf{int}=\mathsf{freshTy}(\Delta)(\mathsf{int})$

$\varphi=\mathsf{freshRel}(\Delta)(o)$

$o\langle\mathit{\varphi}\rangle=\mathsf{freshTy}(\Delta)(o)$

$T_{1}=\mathsf{freshTy}(\Delta)(\rho_{1})$         $T_{2}=\mathsf{freshTy}(\Delta)(\rho_{2})$

$T_{1}\to T_{2}=\mathsf{freshTy}(\Delta)(\rho_{1}\to\rho_{2})$

$T=\mathsf{freshTy}(\Delta,z:\mathsf{int})(\rho)$

$z$ fresh

$z{:}\mathit{\mathsf{int}}\to\mathit{T}=\mathsf{freshTy}(\Delta)(\mathsf{int}\to\rho)$

Fresh type environments.

We extend the judgement to sort environments $\Delta$ of shape $x_{1}\!\!:\sigma_{1},\ldots,x_{k}\!\!:\sigma_{k}$ by the following rule:

$T_{1}=\mathsf{freshTy}(\Delta)(\sigma_{1})\quad\cdots\quad T_{k}=\mathsf{freshTy}(\Delta)(\sigma_{k})$

$x_{1}\!\!:T_{1},\ldots,x_{k}\!\!:T_{k}=\mathsf{freshEnv(\Delta)}$

Inference.

Rather than giving a recursive procedure directly, we define three syntax-directed typing judgements, which have the following shape:

[TABLE]

for $\Gamma$ the type environment in which the type assignment is conducted, $C$ a first-order Horn constraint describing possible assignments to the uninterpreted relational constants, $G$ the term and $T$ the inferred type.

The three judgement forms are defined according to the rules in Figure 3, where we have generalised the judgements $\mathsf{freshRel}$ and $\mathsf{freshTy}$ to sets of sorts in the obvious way. Since the system is syntax directed it can be read as an algorithm by regarding:

[TABLE]

Given an instance of the monotone problem $\langle\Delta,P,G\rangle$, let $C_{1}\Vdash P:\Gamma$ and \Gamma\mathrel{\mathchoice{\begin{picture}(0.3,1.0)\roundcap \polyline(.2,0.03)(.2,0.97) \end{picture}}{\begin{picture}(0.3,1.0)\roundcap \polyline(.2,0.03)(.2,0.97) \end{picture}}{\begin{picture}(0.3,1.0)\roundcap \polyline(.2,0.03)(.2,0.97) \end{picture}}{\begin{picture}(0.3,1.0)\roundcap \polyline(.2,0.03)(.2,0.97) \end{picture}}}\mathrel{\mathchoice{\begin{picture}(0.3,1.0)\roundcap \polyline(.2,0.03)(.2,0.97) \end{picture}}{\begin{picture}(0.3,1.0)\roundcap \polyline(.2,0.03)(.2,0.97) \end{picture}}{\begin{picture}(0.3,1.0)\roundcap \polyline(.2,0.03)(.2,0.97) \end{picture}}{\begin{picture}(0.3,1.0)\roundcap \polyline(.2,0.03)(.2,0.97) \end{picture}}}C_{2}\Vdash G:o\langle\mathit{\varphi}\rangle. The type environment $\Gamma$ and the type $o\langle\mathit{\varphi}\rangle$, which we think of as outputs, are built from types containing formulas with occurrences of fresh relational constants. Then there is a type environment $\Gamma^{\prime}$ (without fresh relational constants) such that $\vdash P:\Gamma^{\prime}$ and $\Gamma^{\prime}\vdash G:o\langle\mathit{\mathsf{false}}\rangle$ iff the first order system of constrained Horn clauses $\langle\Delta^{\prime},C_{1}\wedge C_{2}\wedge\varphi\Rightarrow\mathsf{false}\rangle$ has a symbolic model, i.e. a solution that is expressible within quantifier free integer linear arithmetic.

Appendix D Extension by type guards

It is worthwhile to consider the kinds of safety verification questions that can be posed in our formalisation. In particular, since we are interested in verifying higher-order programs, it would be helpful to be able to state properties of higher-order functions. In type-based approaches to verification, such as Rondon et al. (2008); Unno et al. (2013), it is possible to do this. For example, one can state a typing judgement asserting that some program expression is guaranteed to map evenness preserving functions to non-zero integers.

It is not immediate how to state a similar property using higher-order constrained Horn clauses. Here, properties are specified by stating their negation as a goal formula. The negation of the example property above has the form: $\exists f\!\!:\mathsf{int}\to\mathsf{int}\to o.\,\exists x:\!\!\mathsf{int}.\,\mathsf{EvenPreserving}\ f\wedge x=0\wedge\mathit{G}\>\mathit{f}\>\mathit{x}$, with $G$ playing the role of the program expression, and $\mathsf{EvenPreserving}$ is required to be a goal formula asserting that its argument relates even integers only to other even integers. That is, a logical formulation of the refinement type $x{:}\mathit{\mathsf{int}}\to\mathit{y{:}\mathit{\mathsf{int}}\to\mathit{o\langle\mathit{x}\>\mathit{\equiv 0}\>\mathit{\mathrel{\mathsf{mod}}}\>\mathit{2}\>\mathit{\Rightarrow y}\>\mathit{\equiv 0}\>\mathit{\mathrel{\mathsf{mod}}}\>\mathit{2}\rangle}}$. However, the existence of such a goal term is problematic, since evenness preservation of this kind is not a monotone property — it is clearly satisfied by the empty relation, yet violated by many relations larger than it.

The aim of this section is to show that, despite this serious deficiency of expression, it is possible to state higher-type properties of the kind given above. The key is to observe that, in the formulation of a type judgement as a goal, the properties expressed by refinement types will only occur guarding existentially quantified variables. Hence, these “type guards” (such as the hypothetical $\mathsf{EvenPreserving}$ predicate above), serve only to limit the search space from which the existential witness is drawn, rather than to test some quality of a particular, concrete individual. We begin by making the restricted shape of these type guards precise then, in Section D.1, we show how monotonicity allows for such guards to be entirely eliminated.

Type guarded existentials.

We extend the syntax of higher-order Horn clauses by adding a family of type guarded existential quantifier constants $\exists_{T::\rho}:\rho\to o$, which are parametrised by a closed type $\vdash T::\rho$. We write $\exists x\!\!:\!\!T.\,M$ rather than $\exists_{T::\rho}(\lambda x.\,\mathit{M})$, omitting $\rho$ since it can be uniquely determined from $T$.

Interpretation.

For the purposes of interpretation, we need to give two standard semantics to types that parallels their monotone semantics. The definitions are completely analogous:

[TABLE]

but now the set from which e.g. $f$ is drawn in the third clause is the set of all propositional functions $\mathcal{S}\llbracket\rho_{1}\to\rho_{2}\rrbracket$. Similarly for the relational semantics.

[TABLE]

It follows that $\mathcal{S}\llparenthesis T\rrparenthesis(\alpha)$ is actually a monotone relation. An inspection of the proof of Lemma 7 shows that it carries over to the case of the standard semantics.

Having defined this semantics of types, the family of type guarded existential quantifiers can be interpreted in the standard semantics by the family of functions $\mathsf{exists}_{T::\rho}\in\mathcal{S}\llbracket\rho\rrbracket\Rightarrow\mathbbm{2}$ and in the monotone semantics by the family of functions $\mathsf{mexists}_{T::\rho}\in\mathcal{M}\llbracket\rho\rrbracket\mathrel{\Rightarrow_{m}}\mathbbm{2}$ defined by $\mathsf{exists}_{T::\rho}(s)=\max\{s(d)\mid d\in\mathcal{S}\llbracket\vdash T::\rho\rrbracket\}$ and $\mathsf{mexists}_{T::\rho}(r)=\max\{r(d)\mid d\in\mathcal{M}\llbracket\vdash T::\rho\rrbracket\}$.

Type guarded higher-order Horn clauses

We extend the higher-order Horn clause problem to incorporate type guarded existentials by adding to the grammar for constrained goal formulas: $G\Coloneqq\cdots\mid\exists x\!\!:\!\!T.\>G$. Note that this subsumes the existential quantifier on relations completely as: $\mathcal{S}\llbracket\exists_{\rho}\rrbracket=\mathcal{S}\llbracket\exists_{\top_{\!\!\rho}::\rho}\rrbracket$, since the meaning $\mathcal{S}\llbracket\top_{\!\!\rho}\rrbracket(\alpha)$ of the top type in any valuation $\alpha$ is the whole universe $\mathcal{S}\llbracket\rho\rrbracket$. The extended problem is called the type-guarded, higher-order, constrained Horn clause problem. We extend logic programs in the same way, adding the possibility that constant $c$ can be $\exists_{T::\rho}$ in the side condition of the rule (GCst). The resulting problem we name the type-guarded, monotone logic safety problem. The reduction given by Theorem 2 still holds in this extended setting.

Theorem 4**.**

Type-guarded, higher-order constrained Horn clause problem $\langle\Delta,D,G\rangle$ is solvable iff type-guarded, monotone logic safety problem $\langle\Delta,P_{D},G\rangle$ is solvable.

D.1 Elimination of type guards within monotone models

We now show that type-guarded existentials can be eliminated under the monotone semantics, that is: any instance of the type-guarded monotone problem can be reduced to an instance of the ordinary monotone problem. The obvious approach to this is to try to capture, using a formula, the class of relations defined by a closed type. If $H$ is a goal term representing the class $\mathcal{M}\llbracket T\rrbracket(\emptyset)$, then a type guarded existential formula $\exists x\!\!:\!\!T.\,G$ can be eliminated in favour of an ordinary existential formula $\exists x.\,H\,x\wedge G$.

Goal definability.

We say that a relation $r\in\mathcal{M}\llbracket\rho\rrbracket$ is goal term definable (more briefly $G$-definable) just if there exists a closed goal term $\vdash H:\rho$ and $\mathcal{M}\llbracket H\rrbracket(\emptyset)=r$. We say that a class of relations is $G$-definable just if the characteristic predicate of the class is $G$-definable. However, having made this precise, we can now observe that it is not generally possible to capture the class of relations defined by a type.

Lemma 11**.**

The class of relations $\mathcal{M}\llbracket(x{:}\mathit{\mathsf{int}}\to\mathit{o\langle\mathit{x}\>\mathit{\equiv 0}\>\mathit{\mathrel{\mathsf{mod}}}\>\mathit{2}\rangle})\to o\langle\mathit{\mathsf{false}}\rangle\rrbracket(\emptyset)$ is not $G$-definable.

Proof.

This type, which we shall abbreviate by $T$, defines the predicate $\mathcal{M}\llbracket T\rrbracket(\emptyset)$ which contains $r$ just if $r$ is false of every set of even integers (identifying the elements of $\mathcal{M}\llbracket\mathsf{int}\to o\rrbracket$ with sets of integers). However, this predicate $\mathcal{M}\llbracket T\rrbracket(\emptyset)$ is not monotone and hence cannot be defined by a goal term. Clearly, the empty relation $\bot\in\mathcal{M}\llbracket(\mathsf{int}\to o)\to o\rrbracket$ is not an element of $\mathcal{M}\llbracket T\rrbracket(\emptyset)$, since it is false of every set of integers. However, $\bot\subseteq\top$, the universal relation, and yet $\top$ is not in $\mathcal{M}\llbracket T\rrbracket(\emptyset)(\top)$ since it assigns true to all sets of integers. ∎

This result makes it clear that although every $r\in\mathcal{M}\llbracket T\rrbracket(\emptyset)$ is itself monotone, the set of relations $\mathcal{M}\llbracket T\rrbracket(\emptyset)$, viewed as a monadic predicate, may not be monotone.

Despite the foregoing result, it is possible to eliminate type guards by representing their semantics logically. Consider a type guarded formula $\exists x\!\!:\!\!T.\,G$. We can think of $G$ as a monotone function of $x$, so, if $G$ is true of some relation $r\in\mathcal{M}\llbracket T\rrbracket(\emptyset)$ then it will also be true of any larger relation in $\mathcal{M}\llbracket T\rrbracket(\emptyset)$. Consequently, $\exists x\!\!:\!\!T.\,G$ is true iff $G$ is true of the largest relation in $\mathcal{M}\llbracket T\rrbracket(\emptyset)$, namely (following Lemma 7) $\mathcal{M}\llparenthesis T\rrparenthesis(\emptyset)$. Hence, we do not need to represent the whole class of relations $\mathcal{M}\llbracket T\rrbracket(\emptyset)$ but only its largest member because, if $H$ is a $G$-definition of $\mathcal{M}\llparenthesis T\rrparenthesis(\emptyset)$, then we can eliminate $\exists x\!\!:\!\!T\,G$ in favour of $G[H/x]$, which is logically equivalent.

Definability of type complements and the relational semantics.

In order to give a $G$-definition of the largest member of a type $\mathcal{M}\llbracket T::\rho\rrbracket(\emptyset)$, it is useful to be able to give a $G$-definition of the complement of the type, i.e. the class that contains $r\in\mathcal{M}\llbracket\rho\rrbracket$ just if $r\notin\mathcal{M}\llbracket T\rrbracket(\emptyset)$. This is because the largest element of a type $T_{1}\to T_{2}$ is a relation that, in particular, is true of its argument $s$ whenever $s$ is not an element of $\mathcal{M}\llbracket T_{1}\rrbracket(\emptyset)$. In fact, the notions of complement of $T$ and largest element of $T$ are here intertwined: To understand when a relation $r$ is not in the type $T_{1}\to T_{2}$ you must understand when there exists a relation $s\in\mathcal{M}\llbracket T_{1}\rrbracket(\emptyset)$ such that $r(s)$ is not in $\mathcal{M}\llbracket T_{2}\rrbracket(\emptyset)$. Since this condition is a type-guarded existential, it follows from the above discussion that it can be re-expressed using the largest element of $\mathcal{M}\llbracket T_{1}\rrbracket(\emptyset)$. This leads to the definitions by mutual induction on type:

[TABLE]

in which $\mathsf{Com}(T)$ is a $G$-definition of the complement of the class $\mathcal{M}\llbracket T\rrbracket(\emptyset)$. The definition of $\mathsf{Lar}$ is parametrised by a goal formula representing domain conditions that are accumulated during the analysis of function types. It follows that $\mathsf{Lar}(\mathsf{false})(T)$ is a $G$-definition of the largest element of the class $\mathcal{M}\llbracket T\rrbracket(\emptyset)$.

Lemma 8.

For any closed type $\vdash T::\rho$:

1. (i)

The goal term $\mathsf{Com}(T)$ is a $G$-definition of the class $\{r\in\mathcal{M}\llbracket\rho\rrbracket\mid r\notin\mathcal{M}\llbracket T\rrbracket(\emptyset)\}$. 2. (ii)

The goal term $\mathsf{Lar}(\mathsf{false})(T)$ is a $G$-definition of the relation $\mathcal{M}\llparenthesis T\rrparenthesis(\emptyset)$.

Proof.

The following more general statement can be proven by a straightforward induction on $\Delta\vdash T::\rho$. For all $\Delta\vdash T::\rho$, $\alpha\in\mathcal{M}\llbracket\Delta\rrbracket$ and goal formulas $\Delta\vdash G:o$, $\mathcal{M}\llbracket\mathsf{Com}(T)\rrbracket(\alpha)=\{r\in\mathcal{M}\llbracket\rho\rrbracket\mid r\notin\mathcal{M}\llbracket T\rrbracket(\alpha)\}$ and, for all $\overline{d}$ of the appropriate sorts: $\mathcal{M}\llbracket\mathsf{Lar}(G)(T)\rrbracket(\alpha)(\overline{d})=1$ iff $\mathcal{M}\llbracket G\rrbracket(\alpha)$ = 1 or $\mathcal{M}\llparenthesis T\rrparenthesis(\alpha)(\overline{d})=1$. ∎

With a $G$-definition of the largest element satisfying a type, we have the necessary apparatus to eliminate type-guarded existentials. To this end, for each type guarded goal term $G$, let $\mathsf{Elim}(G)$ be defined by:

[TABLE]

and extend this to type guarded logic programs $\vdash P:\Delta$ by, for all $x\in\mathsf{dom}(\Delta)$, $\mathsf{Elim}(P)(x)=\mathsf{Elim}(P(x))$. It is immediate that $\mathsf{Elim}(G)$ is a goal term not containing any type guarded existentials.

Example 5**.**

We return to the motivating example of this section. Consider the type $T$, written explicitly as $x{:}\mathit{\mathsf{int}}\to\mathit{y{:}\mathit{\mathsf{int}}\to\mathit{o\langle\mathit{x}\>\mathit{\equiv 0}\>\mathit{\mathrel{\mathsf{mod}}}\>\mathit{2}\>\mathit{\Rightarrow y}\>\mathit{\equiv 0}\>\mathit{\mathrel{\mathsf{mod}}}\>\mathit{2}\rangle}}$. It follows that $\mathsf{Lar}(\mathsf{false})(T)=\lambda xy.\,\mathit{x}\>\mathit{\equiv 0}\>\mathit{\mathrel{\mathsf{mod}}}\>\mathit{2}\>\mathit{\Rightarrow y}\>\mathit{\equiv 0}\>\mathit{\mathrel{\mathsf{mod}}}\>\mathit{2}$ and $\mathsf{Com}(T)=\lambda z.\,\mathit{\exists x.\,\exists y.\,}\>\mathit{z}\>\mathit{x}\>\mathit{y}\>\mathit{\wedge x}\>\mathit{\equiv 0}\>\mathit{\mathrel{\mathsf{mod}}}\>\mathit{2}\>\mathit{\wedge y}\>\mathit{\not\equiv 0}\>\mathit{\mathrel{\mathsf{mod}}}\>\mathit{2}$ (after a little simplification). It is possible to express that some goal term $H:(\mathsf{int}\to\mathsf{int}\to o)\to\mathsf{int}\to o$ is not an element of $\mathcal{M}\llbracket T\to z{:}\mathit{\iota}\to\mathit{o\langle\mathit{z}\>\mathit{\neq 0}\rangle}\rrbracket(\emptyset)$ using the goal term $\mathsf{Com}(T\to z{:}\mathit{\iota}\to\mathit{o\langle\mathit{z}\>\mathit{\neq 0}\rangle})\ H$. This term asserts that $H$ violates the (relational formulation of the) property of mapping eveness preserving functions to non-zero integers and is equivalent to:

[TABLE]

Here we use $\mathsf{Com}$ to assert directly the negation of the property represented by the type. However, as mentioned in the discussion following the definition of $\mathsf{Com}$, type guarded existentials are used implicitly. For example, it is easy to see that this goal formula is logically equivalent to $\mathsf{Elim}(\exists z_{1}\!\!:\!(T\to z{:}\mathit{\iota}\to\mathit{o\langle\mathit{z}\>\mathit{\neq 0}\rangle}).\,\exists z_{2}.\,H\ z_{1}z_{2}\wedge z_{2}=0)$.

As sketched above, due to monotonicity the (ordinary) goal term $\mathsf{Elim}(G)$ obained from type-guarded goal term $G$ is logically equivalent to $G$. Consequently, there is no loss in performing the elimination: an instance of the type-guarded monotone problem is solvable iff the instance of the (ordinary) monotone problem obtained by elimination is solvable. The proof follows the sketch outlined following Lemma 11.

Theorem 5**.**

Type guarded, higher-order constrained Horn clause problem $\langle\Delta,D,G\rangle$ is solvable iff monotone logic program safety problem $\langle\Delta,\mathsf{Elim}(P_{D}),\mathsf{Elim}(G)\rangle$ is solvable.

Since every existential quantifier $\exists_{\rho}$ at relational sort can be viewed as an existential quantifier $\exists_{\top::\rho}$ guarded by the top type $\top_{\rho}$, it follows that, without loss of generality, one may assume that the latter problem contains only existential quantification over individuals. This justifies the absence of relational sort existential quantifiers in the type system of Section 5.