Type Safety via Hoare Logic with Separation and Pure Types

2026-07-28

AI Summary

Traditional type systems struggle to uniformly support memory safety, data structure invariants, and broader typability requirements, often lacking compositional extensibility and clear semantics. This work proposes a unified type-safety verification framework grounded in Floyd-Hoare logic, integrating path-sensitive types, separation types, type predicates, and error classification within a single Boolean algebra. It innovatively embeds generalized algebraic data types (GADTs) and liquid types into a common logical foundation, refines the “well-typed programs never go wrong” principle via explicit Err/Abrt distinctions, and unifies subtyping through decidable emptiness checks. A self-certifying type checker is implemented in Lean, accompanied by a machine-checked soundness proof that avoids reliance on external SMT solvers, with empirical validation on standard benchmarks demonstrating its practical efficacy.

Abstract

Type safety has traditionally rested on carefully crafted type systems, under the motto "well-typed programs cannot go wrong". Modern demands push type systems past this basic guarantee: toward memory safety (e.g., Rust), stronger data-structure invariants (e.g., GADTs), and broader typability (e.g., MLstruct). The motto absorbs each such property by enlarging the set of states deemed "wrong", but collapses them into one binary verdict: heap ownership, flow-sensitive changes to a variable's type, and the gap between a recoverable and a fatal error are relational, stateful facts about intermediate states that one verdict cannot tell apart. Worse, each demand typically brings its own extension, making it hard to say what each guarantees or how they combine. Floyd-Hoare logic supplies a unified foundation. We present a framework for type-safety verification built from four ingredients: (i) case specifications for path-sensitive typing; (ii) separation types, inspired by separation logic, for flow-sensitive type mutation and must-aliasing; (iii) a disciplined distinction between Err (runtime error values our types track) and Abrt (compile-time errors), yielding the refined motto well-typed programs must never abort; and (iv) type predicates for data-structure invariants. Since all four are ordinary types in one Boolean algebra rather than separate extensions, the framework subsumes both GADTs and liquid types within one type logic, spanning weak specifications that tolerate Err to strong ones that eliminate it. Subtyping reduces to one decidable emptiness test, so a single lightweight procedure serves the whole framework with no SMT oracle in its trusted base. We formalise the Hoare rules and prove soundness in a machine-checked Lean mechanisation; by proof reflection it yields a self-certifying type-checker, evaluated on a benchmark suite.

Problem

• type safety
• memory safety
• data-structure invariants
• flow-sensitive typing
• error classification

Innovation

• Hoare Logic
• Separation Types
• Type Safety
• Self-Certifying Type Checker
• Flow-Sensitive Typing