A trustworthy mechanized formalization of R

Abstract

The R programming language is very popular for developing statistical software and data analysis, thanks to rich libraries, concise and expressive syntax, and support for interactive programming. Yet, the semantics of R is fairly complex, contains many subtle corner cases, and is not formally specified. This makes it difficult to reason about R programs. In this work, we develop a big-step operational semantics for R in the form of an interpreter written in the Coq proof assistant. We ensure the trustworthiness of the formalization by introducing a monadic encoding that allows the Coq interpreter, CoqR, to be in direct visual correspondence with the reference R interpreter, GNU R. Additionally, we provide a testing framework that supports systematic comparison of CoqR and GNU R. In its current state, CoqR covers the nucleus of the R language as well as numerous additional features, making it pass a significant number of realistic test cases from the GNU R and FastR projects. To exercise the formal specification, we prove in Coq the preservation of memory invariants in selected parts of the interpreter. This work is an important first step towards a robust environment for formal verification of R programs. CCS Concepts • Theory of computation → Denotational semantics; • Software and its engineering → Application specific development environments;

On the design, implementation, and use of laziness in R

“…Finally, we compare our semantics to the work of Bodin et al [2018]. Our semantics makes no claims of being correct (there is no specification of R) or of being faithful to the language.…”

Formal methods for statistical software

“…Many statistical and analysis programs of concern are written in languages that do not have as much support for program analysis and proofs of correctness, such as SAS, R, Stata, and Python. This is beginning with the R language, see Bodin, Diaz, and Tanter [25].…”

“…There are static analyzers for languages like R. The work of Bodin, Diaz, and Tanter [25] lays a strong foundation for further analyzers that are sound. Several static code analyzers handle Python, but they generally only detect low-level bugs.…”

Data-driven ecosystem migration: non-intrusive migration of R ecosystem from lazy to strict semantics

“…I compare the small-step operational semantics to the work of Bodin, Diaz, and Tanter [4]. The semantics makes no claims of being correct (there is no specification of R) or of being faithful to the language.…”

“…Furthermore, package loading and interaction with C code is not supported, thus packages from my corpus cannot be tested. I tried to match my semantics to theirs but their paper Bodin, Diaz, and Tanter [4] does not describe their treatment of laziness. Due to the size of the Coq codebase and lack of documentation, it is unclear how to align the two artifacts.…”