Mechanically verifying the correctness of an offline partial evaluator

Abstract

Abstract. We show that using deductive systems to specify an offline partial evaluator allows one to specify, prototype, and mechanically verify correctness via meta-programming -all within a single framework. For a λ-mix-style partial evaluator, we specify binding-time constraints using a natural-deduction logic, and the associated program specializer using natural (aka "deductive") semantics. These deductive systems can be directly encoded in the Elf programming language -a logic programming language based on the LF logical framework. The specifications are then executable as logic programs. This provides a prototype implementation of the partial evaluator. Moreover, since deductive system proofs are accessible as objects in Elf, many aspects of the partial evaluator correctness proofs (e.g., the correctness of binding-time analysis) can be coded in Elf and mechanically checked.

A Type Theoretic Specification of Partial Evaluation

“…Hatcliff [15] encodes binding-time constraints and a big-step operational semantics of a specializer for simply-typed two-level lambda calculus in Elf [25]. The encoding gives rise to an executable specification of a binding-time analysis and a specializer.…”

“…Most notably, Hatcliff [15] gives a big-step operational semantics for partial evaluation in Elf [25]. As Elf directly supports higher-order abstract syntax, variable bindings are handled implicitly.…”

Program specialization for execution monitoring

“…In this work, we take the correctness of the underlying specializer for granted and make use of (1) where required. Since this might raise concerns that the specializer becomes part of the TCB, we remark that (i) specializers have been mechanically proves correct (Hatcliff, 1995) and (ii) by relying on the cogen approach mentioned above, it is only necessary to verify the building bricks of the generating extension, as we demonstrated elsewhere (Thiemann, 1999b).…”

“…The correctness of offline partial evaluation has been considered in a number of places (Hatcliff & Danvy, 1997;Hatcliff, 1995;Consel & Khoo, 1995;Lawall & Thiemann, 1997). In this work, we take the correctness of the underlying specializer for granted and make use of (1) where required.…”

A Computational Formalization for Partial Evaluation (Extended Version)

“…We note, however, a recent trend (including the present work) to use operational semantics for specifying specializers [1,18,33,61,62]. In fact, the first author has shown that by emphasizing the logical character of type-based and operational semantics specifications, the correctness of a partial evaluator can be mechanically verified [35].…”