Mtac

Ziliani, Beta; Dreyer, Derek; Krishnaswami, Neelakantan R.; Nanevski, Aleksandar; Vafeiadis, Viktor

doi:10.1145/2500365.2500579

Cited by 24 publications

(7 citation statements)

References 33 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Inspired by Mtac [19,36] and MetaCoq [2], FreeSpec.Exec is a bi-interpreter, i.e., an interpreter that interleaves two interpreters. One of these two interpreters is the reduction engine of Coq: when it is provided a term of type impure ix t, this interpreter makes the head constructor appear using the weak-head reduction strategy.…”

Section: Methodsmentioning

confidence: 99%

FreeSpec: specifying, verifying, and executing impure computations in Coq

Letan

Régis-Gianas

2020

Proceedings of the 9th ACM SIGPLAN International Conference on Certified Programs and Proofs

View full text Add to dashboard Cite

FreeSpec is a framework for the Coq theorem prover which allows for specifying and verifying complex systems as hierarchies of components verified both in isolation and in composition. While FreeSpec was originally introduced for reasoning about hardware architectures, in this article we propose a novel iteration of FreeSpec formalism specifically designed to write certified programs and libraries. Then, we present in depth how we use this formalism to verify a static files webserver. We use this opportunity to present Free-Spec proof automation tactics, and to demonstrate how they successfully erase FreeSpec internal definitions to let users focus on the core of their proofs. Finally, we introduce Free-Spec.Exec, a plugin for Coq to seamlessly execute certified programs written with FreeSpec.• Theory of computation → Program verification.

show abstract

Section: Methodsmentioning

confidence: 99%

FreeSpec: specifying, verifying, and executing impure computations in Coq

Letan

Régis-Gianas

2020

Proceedings of the 9th ACM SIGPLAN International Conference on Certified Programs and Proofs

View full text Add to dashboard Cite

show abstract

“…As a consequence, even simple primitives such as retÐwhich itself only requires at most two universesÐwere forced to carry a prohibitively large number of universes. (2) Fixpoints: As described in the original paper [Ziliani et al 2013], the fixpoint operators of Mtac1 had a dummy subset predicate in order to circumvent the positivity restriction of Coq. This predicate would then be instantiated with the identity function.…”

Section: Opaque Definitionsmentioning

confidence: 99%

“…Modulo the guard condition on fixed-points appearing in the produced value, which is not statically guaranteed to hold by Mtac metaprograms.4 In Mtac2 we modified the original semantics of Mtac1 to never get stuck. Indeed, in[Ziliani et al 2013] certain dynamic checks will block the execution. We modified this behavior to always raise an exception.…”

mentioning

confidence: 99%

Mtac2: typed tactics for backward reasoning in Coq

Kaiser

Ziliani

Krebbers

et al. 2018

Proc. ACM Program. Lang.

Self Cite

View full text Add to dashboard Cite

Coq supports a range of built-in tactics, which are engineered primarily to support backward reasoning. Starting from a desired goal, the Coq programmer can use these tactics to manipulate the proof state interactively, applying axioms or lemmas to break the goal into subgoals until all subgoals have been solved. Additionally, it provides support for tactic programming via OCaml and Ltac, so that users can roll their own custom proof automation routines. Unfortunately, though, these tactic languages share a significant weakness. They do not offer the tactic programmer any static guarantees about the soundness of their custom tactics, making large tactic developments difficult to maintain. To address this limitation, Ziliani et al. previously proposed Mtac, a new typed approach to custom proof automation in Coq which provides the static guarantees that OCaml and Ltac are missing. However, despite its name, Mtac is really more of a metaprogramming language than it is a full-blown tactic language: it misses an essential feature of tactic programming, namely the ability to directly manipulate Coq's proof state and perform backward reasoning on it. In this paper, we present Mtac2, a next-generation version of Mtac that combines its support for typed metaprogramming with additional support for the programming of backward-reasoning tactics in the style of Ltac. In so doing, Mtac2 introduces a novel feature in tactic programming languagesÐwhat we call typed backward reasoning. With this feature, Mtac2 is capable of statically ruling out several classes of errors that would otherwise remain undetected at tactic definition time. We demonstrate the utility of Mtac2's typed tactics by porting several tactics from a large Coq development, the Iris Proof Mode, from Ltac to Mtac2.

show abstract

“…Rather than devising a separate language, our current plan is to base our design on Mtac (Ziliani et al 2013) to allow the tactic language of F ⋆ to be F ⋆ itself.…”

Section: Formalizing µF ⋆ In F ⋆mentioning

confidence: 99%

Dependent types and multi-monadic effects in F*

et al. 2016

View full text Add to dashboard Cite

We present a new, completely redesigned, version of F*, a language that works both as a proof assistant as well as a general-purpose, verification-oriented, effectful programming language. In support of these complementary roles, F* is a dependently typed, higher-order, call-by-value language with _primitive_ effects including state, exceptions, divergence and IO. Although primitive, programmers choose the granularity at which to specify effects by equipping each effect with a monadic, predicate transformer semantics. F* uses this to efficiently compute weakest preconditions and discharges the resulting proof obligations using a combination of SMT solving and manual proofs. Isolated from the effects, the core of F* is a language of pure functions used to write specifications and proof terms---its consistency is maintained by a semantic termination check based on a well-founded order. We evaluate our design on more than 55,000 lines of F* we have authored in the last year, focusing on three main case studies. Showcasing its use as a general-purpose programming language, F* is programmed (but not verified) in F*, and bootstraps in both OCaml and F#. Our experience confirms F*'s pay-as-you-go cost model: writing idiomatic ML-like code with no finer specifications imposes no user burden. As a verification-oriented language, our most significant evaluation of F* is in verifying several key modules in an implementation of the TLS-1.2 protocol standard. For the modules we considered, we are able to prove more properties, with fewer annotations using F* than in a prior verified implementation of TLS-1.2. Finally, as a proof assistant, we discuss our use of F* in mechanizing the metatheory of a range of lambda calculi, starting from the simply typed lambda calculus to System F-omega and even micro-F*, a sizeable fragment of F* itself---these proofs make essential use of F*'s flexible combination of SMT automation and constructive proofs, enabling a tactic-free style of programming and proving at a relatively large scale.

show abstract

Mtac

Cited by 24 publications

References 33 publications

FreeSpec: specifying, verifying, and executing impure computations in Coq

FreeSpec: specifying, verifying, and executing impure computations in Coq

Mtac2: typed tactics for backward reasoning in Coq

Dependent types and multi-monadic effects in F*

Contact Info

Product

Resources

About