Toward compiler implementation correctness proofs

Abstract

An aspect of the interaction between compiler theory and practice is addressed. Presented is a technique for the syntax-directed specification of compilers together with a method for proving the correctness of their parse-driven implementations. The subject matter is presented in an orderalgebraic framework; while not strictly necessary, this approach imposes beneficial structure and modularity on the resulting specifications and implementation correctness proofs. Compilers are specified using an order-algebraic definition of attribute grammars. A practical class of compiler implementations is considered, consisting of those driven by LR(W) or LL(k) parsers which cause a sequence of translation routine activations to modify a suitably initialized collection of data structures (called a translation environment). The implementation correctness criterion consists of appropriately comparing, for each source program, the corresponding object program (contained in the final translation environment) produced by the compiler implementation to the object program dictated by the compiler specification. Provided that suitable intermediate assertions (called trans&ion invariants) are supplied, the program consisting of the (parse-induced) sequence of translation routine activations can be proven partially correct via standard inductive assertion methods.

A Formally Verified Compiler Back-end

“…Since then, a great many on-paper proofs for program analyses and compiler transformations have been published -too many to survey here. Representative examples include the works of Clemmensen and Oest [24], Chirica and Martin [22], Guttman et al [39], Müller-Olm [74] and Lacey et al [52]. We refer the reader to Dave's annotated bibliography [28] for further references.…”

Providing a formal linkage between MDG and HOL

“…We are concerned with the latter step here. This split between implementation and specification correctness was advocated by Chirica and Martin [13] with respect to compiler correctness.…”

“…When importing an MDG result we need also to prove a theorem of this same form for the specification, because it is an explicit assumption included in the linkage theorems to allow them to be proved. The stronger consistency theorem (13) is an existential theorem for the structural specification, whereas the additional assumption (11) for the linkage theorem is an existential theorem for the behavioral specification. We have developed a way of proving both based on the syntax and semantics of the MDG input language [47].…”

On the Translation of Procedures to Finite Machines

“…The ultimate goal of compiler verification [1,2,4,6,8,9,11,12] is to justify such confidence into compilers.…”