Type soundness proofs with definitional interpreters

Amin, Nada; Rompf, Tiark

doi:10.1145/3009837.3009866

Cited by 42 publications

(30 citation statements)

References 48 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The proofs and formal models presented in this paper are largely standard, but make key use of induction over a numeric łfuel metricž that bounds the amount of work (in this case, loop iterations) a program is allowed to do. Such techniques enable effective proofs for functional formulations of big-step semantics and have only recently received wide-spread interest [Amin and Rompf 2017;Owens et al 2016]. Existentially quantifying over the number of loop iterations in our IMP semantics is very similar to a recent proposal by Siek [2016Siek [ , 2017.…”

Section: Related Workmentioning

confidence: 65%

Precise reasoning with structured time, structured heaps, and collective operations

Essertel

Wei

Rompf

2019

Proc. ACM Program. Lang.

Self Cite

View full text Add to dashboard Cite

Despite decades of progress, static analysis tools still have great difficulty dealing with programs that combine arithmetic, loops, dynamic memory allocation, and linked data structures. In this paper we draw attention to two fundamental reasons for this difficulty: First, typical underlying program abstractions are low-level and inherently scalar, characterizing compound entities like data structures or results computed through iteration only indirectly. Second, to ensure termination, analyses typically project away the dimension of time, and merge information per program point, which incurs a loss in precision. As a remedy, we propose to make collective operations first-class in program analysisÐinspired by Σnotation in mathematics, and also by the success of high-level intermediate languages based on map/reduce operations in program generators and aggressive optimizing compilers for domain-specific languages (DSLs). We further propose a novel structured heap abstraction that preserves a symbolic dimension of time, reflecting the program's loop structure and thus unambiguously correlating multiple temporal points in the dynamic execution with a single point in the program text. This paper presents a formal model, based on a high-level intermediate analysis language, a practical realization in a prototype tool that analyzes C code, and an experimental evaluation that demonstrates competitive results on a series of benchmarks. Remarkably, our implementation achieves these results in a fully semantics-preserving strongest-postcondition model, which is a worst-case for analysis/verification. The underlying ideas, however, are not tied to this model and would equally apply in other settings, e.g., demand-driven invariant inference in a weakest-precondition model. Given its semantics-preserving nature, our implementation is not limited to analysis for verification, but can also check program equivalence, and translate legacy C code to high-performance DSLs. CCS Concepts: • Software and its engineering → Automated static analysis; Software verification; General programming languages; Semantics.

show abstract

Section: Related Workmentioning

confidence: 65%

Precise reasoning with structured time, structured heaps, and collective operations

Essertel

Wei

Rompf

2019

Proc. ACM Program. Lang.

Self Cite

View full text Add to dashboard Cite

show abstract

“…WebAssembly has had a formal semantics from the very beginning, which has been mechanized (Watt, 2018) in Isabelle/HOL. Simplified languages representing the core underlying theories of Scala (Rompf and Amin, 2016;Amin and Rompf, 2017) and of OCaml (Owens, 2008) have been verified. Results from mechanized metatheory have also influenced verification of real compilers, like CakeML (Section 3.1.1).…”

Section: Programming Language Metatheorymentioning

confidence: 97%

QED at Large: A Survey of Engineering of Formally Verified Software

Ringer

Palmskog

Sergey

et al. 2019

FNT in Programming Languages

View full text Add to dashboard Cite

Development of formal proofs of correctness of programs can increase actual and perceived reliability and facilitate better understanding of program specifications and their underlying assumptions. Tools supporting such development have been available for over 40 years, but have only recently seen wide practical use. Projects based on construction of machine-checked formal proofs are now reaching an unprecedented scale, comparable to large software projects, which leads to new challenges in proof development and maintenance. Despite its increasing importance, the field of proof engineering is seldom considered in its own right; related theories, techniques, and tools span many fields and venues. This survey of the literature presents a holistic understanding of proof engineering for program correctness, covering impact in practice, foundations, proof automation, proof organization, and practical proof development.

show abstract

“…Agda is a total language and, although STLC is strongly-normalizing, that is not self-evident from the defined semantics and Agda will complain that it cannot determine whether eval will terminate. We address this issue here and throughout the rest of this paper using a fuel counter [Siek 2013;Owens et al 2016;Amin and Rompf 2017] in our interpreters. The idea is that the evaluation function has a fuel argument which is decreased every time our interpreter makes a recursive call.…”

Section: Totality and Anticipating Effects: Fuel And Monadsmentioning

confidence: 99%

“…However, recent years have seen a revival in interest in functional encodings of semantics. For example Danielsson [2012] shows how to prove type safety for definitional interpreters for languages with non-termination using the partiality monad [Capretta 2005], and a number of recent papers have advocated modeling execution in a total language by using fuel [Siek 2013;Owens et al 2016;Amin and Rompf 2017].…”

Section: Related Workmentioning

confidence: 99%

Intrinsically-typed definitional interpreters for imperative languages

Poulsen

Rouvoet

Tolmach

et al. 2017

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

A definitional interpreter defines the semantics of an object language in terms of the (well-known) semantics of a host language, enabling understanding and validation of the semantics through execution. Combining a definitional interpreter with a separate type system requires a separate type safety proof. An alternative approach, at least for pure object languages, is to use a dependently-typed language to encode the object language type system in the definition of the abstract syntax. Using such intrinsically-typed abstract syntax definitions allows the host language type checker to verify automatically that the interpreter satisfies type safety. Does this approach scale to larger and more realistic object languages, and in particular to languages with mutable state and objects? In this paper, we describe and demonstrate techniques and libraries in Agda that successfully scale up intrinsically-typed definitional interpreters to handle rich object languages with non-trivial binding structures and mutable state. While the resulting interpreters are certainly more complex than the simply-typed λcalculus interpreter we start with, we claim that they still meet the goals of being concise, comprehensible, and executable, while guaranteeing type safety for more elaborate object languages. We make the following contributions: (1) A dependent-passing style technique for hiding the weakening of indexed values as they propagate through monadic code. (2) An Agda library for programming with scope graphs and frames, which provides a uniform approach to dealing with name binding in intrinsically-typed interpreters. (3) Case studies of intrinsically-typed definitional interpreters for the simply-typed λ-calculus with references (STLC+Ref) and for a large subset of Middleweight Java (MJ). CCS Concepts: • Theory of computation → Program verification; Type theory; • Software and its engineering → Formal language definitions;

show abstract

Type soundness proofs with definitional interpreters

Cited by 42 publications

References 48 publications

Precise reasoning with structured time, structured heaps, and collective operations

Precise reasoning with structured time, structured heaps, and collective operations

QED at Large: A Survey of Engineering of Formally Verified Software

Intrinsically-typed definitional interpreters for imperative languages

Contact Info

Product

Resources

About