Calculating correct compilers

Abstract

In this article we present a new approach to the problem of calculating compilers. In particular, we develop a simple but general technique that allows us to derive correct compilers from highlevel semantics by systematic calculation, with all details of the implementation of the compilers falling naturally out of the calculation process. Our approach is based upon the use of standard equational reasoning techniques, and has been applied to calculate compilers for a wide range of language features and their combination, including arithmetic expressions, exceptions, state, various forms of lambda calculi, bounded and unbounded loops, non-determinism, and interrupts. All the calculations in the article have been formalised using the Coq proof assistant, which serves as a convenient interactive tool for developing and verifying the calculations.

QED at Large: A Survey of Engineering of Formally Verified Software

“…Proof techniques can also help proof engineers reason within certain domains. Bahr and Hutton (2015), for example, describes a technique for deriving correct compilers from specifications in Coq. Section 6.2.5 describes techniques for reasoning about imperative programs.…”

Theorem proving for all: equational reasoning in liquid Haskell (functional pearl)

“…So far, all the proofs that we have seen have been very simple. To show that Liquid Haskell scales to more involved arguments, we show how it can be used to calculate a correct and efficient compiler for arithmetic expressions with addition, as in [Bahr and Hutton 2015;Hutton 2016].…”

Flag-based big-step semantics

“…Leroy and Grall [3] cite compiler correctness proofs as a main motivation for using coinductive big-step semantics as opposed to small-step semantics: using small-step semantics complicates the correctness proof. Indeed, Hutton and Wright [5] and Hutton and Bahr [40] also use big-step semantics for their compiler correctness proofs. However, in CompCert, Leroy [41] uses a small-step semantics and sophisticated notions of bisimulation for its compiler correctness proofs.…”