Results 1  10
of
22
The impact of higherorder state and control effects on local relational reasoning
, 2010
"... Reasoning about program equivalence is one of the oldest problems in semantics. In recent years, useful techniques have been developed, based on bisimulations and logical relations, for reasoning about equivalence in the setting of increasingly realistic languages—languages nearly as complex as ML o ..."
Abstract

Cited by 31 (13 self)
 Add to MetaCart
Reasoning about program equivalence is one of the oldest problems in semantics. In recent years, useful techniques have been developed, based on bisimulations and logical relations, for reasoning about equivalence in the setting of increasingly realistic languages—languages nearly as complex as ML or Haskell. Much of the recent work in this direction has considered the interesting representation independence principles enabled by the use of local state, but it is also important to understand the principles that powerful features like higherorder state and control effects disable. This latter topic has been broached extensively within the framework of game semantics, resulting in what Abramsky dubbed the “semantic cube”: fully abstract gamesemantic characterizations of various axes in the design space of MLlike languages. But when it comes to reasoning about many actual examples, game semantics does not yet supply a useful technique for proving equivalences. In this paper, we marry the aspirations of the semantic cube to the powerful proof method of stepindexed Kripke logical relations. Building on recent work of Ahmed, Dreyer, and Rossberg, we define the first fully abstract logical relation for an MLlike language with recursive types, abstract types, general references and call/cc. We then show how, under orthogonal restrictions to the expressive power of our language—namely, the restriction to firstorder state and/or the removal of call/cc—we can enhance the proving power of our possibleworlds model in correspondingly orthogonal ways, and we demonstrate this proving power on a range of interesting examples. Central to our story is the use of state transition systems to model the way in which properties of local state evolve over time.
Stepindexed Kripke models over recursive worlds
 In Proc. of POPL
, 2011
"... Over the last decade, there has been extensive research on modelling challenging features in programming languages and program logics, such as higherorder store and storable resource invariants. A recent line of work has identified a common solution to some of these challenges: Kripke models over w ..."
Abstract

Cited by 18 (9 self)
 Add to MetaCart
Over the last decade, there has been extensive research on modelling challenging features in programming languages and program logics, such as higherorder store and storable resource invariants. A recent line of work has identified a common solution to some of these challenges: Kripke models over worlds that are recursively defined in a category of metric spaces. In this paper, we broaden the scope of this technique from the original domaintheoretic setting to an elementary, operational one based on step indexing. The resulting method is widely applicable and leads to simple, succinct models of complicated language features, as we demonstrate in our semantics of Charguéraud and Pottier’s typeandcapability system for an MLlike higherorder language. Moreover, the method provides a highlevel understanding of the essence of recent approaches based on step indexing. 1.
Logical StepIndexed Logical Relations
"... We show how to reason about “stepindexed ” logical relations in an abstract way, avoiding the tedious, errorprone, and proofobscuring stepindex arithmetic that seems superficially to be an essential element of the method. Specifically, we define a logic LSLR, which is inspired by Plotkin and Aba ..."
Abstract

Cited by 15 (6 self)
 Add to MetaCart
We show how to reason about “stepindexed ” logical relations in an abstract way, avoiding the tedious, errorprone, and proofobscuring stepindex arithmetic that seems superficially to be an essential element of the method. Specifically, we define a logic LSLR, which is inspired by Plotkin and Abadi’s logic for parametricity, but also supports recursively defined relations by means of the modal “later ” operator from Appel et al.’s “very modal model” paper. We encode in LSLR a logical relation for reasoning (in)equationally about programs in callbyvalue System F extended with recursive types. Using this logical relation, we derive a useful set of rules with which we can prove contextual (in)equivalences without mentioning step indices. 1
Some domain theory and denotational semantics in Coq
, 2009
"... Abstract. We present a Coq formalization of constructive ωcpos (extending earlier work by PaulinMohring) up to and including the inverselimit construction of solutions to mixedvariance recursive domain equations, and the existence of invariant relations on those solutions. We then define operatio ..."
Abstract

Cited by 12 (4 self)
 Add to MetaCart
Abstract. We present a Coq formalization of constructive ωcpos (extending earlier work by PaulinMohring) up to and including the inverselimit construction of solutions to mixedvariance recursive domain equations, and the existence of invariant relations on those solutions. We then define operational and denotational semantics for both a simplytyped CBV language with recursion and an untyped CBV language, and establish soundness and adequacy results in each case. 1
Strongly Typed Term Representations in Coq
 J AUTOM REASONING
"... There are two approaches to formalizing the syntax of typed object languages in a proof assistant or programming language. The extrinsic approach is to first define a type that encodes untyped object expressions and then make a separate definition of typing judgements over the untyped terms. The int ..."
Abstract

Cited by 10 (2 self)
 Add to MetaCart
There are two approaches to formalizing the syntax of typed object languages in a proof assistant or programming language. The extrinsic approach is to first define a type that encodes untyped object expressions and then make a separate definition of typing judgements over the untyped terms. The intrinsic approach is to make a single definition that captures welltyped object expressions, so illtyped expressions cannot even be expressed. Intrinsic encodings are attractive and naturally enforce the requirement that metalanguage operations on object expressions, such as substitution, respect object types. The price is that the metalanguage types of intrinsic encodings and operations involve nontrivial dependency, adding significant complexity. This paper describes intrinsicstyle formalizations of both simplytyped and polymorphic languages, and basic syntactic operations thereon, in the Coq proof assistant. The Coq types encoding objectlevel variables (de Bruijn indices) and terms are indexed by both type and typing environment. One key construction is the bootstrapping of definitions and lemmas about the action of substitutions in terms of similar ones for a simpler notion of renamings. In the simplytyped case, this yields definitions that are free of any use of type equality coercions. In the polymorphic case, some substitution operations do still require type coercions, which we at least partially tame by uniform use of heterogeneous equality.
A Kripke Logical Relation Between ML and Assembly
"... There has recently been great progress in proving the correctness of compilers for increasingly realistic languages with increasingly realistic runtime systems. Most work on this problem has focused on proving the correctness of a particular compiler, leaving open the question of how to verify the c ..."
Abstract

Cited by 8 (5 self)
 Add to MetaCart
There has recently been great progress in proving the correctness of compilers for increasingly realistic languages with increasingly realistic runtime systems. Most work on this problem has focused on proving the correctness of a particular compiler, leaving open the question of how to verify the correctness of assembly code that is handoptimized or linked together from the output of multiple compilers. This has led Benton and other researchers to propose more abstract, compositional notions of when a lowlevel program correctly realizes a highlevel one. However, the state of the art in socalled “compositional compiler correctness ” has only considered relatively simple highlevel and lowlevel languages. In this paper, we propose a novel, extensional, compilerindependent notion of equivalence between highlevel programs in an expressive, impure MLlike λcalculus and lowlevel programs in an (only slightly) idealized assembly language. We define this equivalence by means of a biorthogonal, stepindexed, Kripke logical relation, which enables us to reason quite flexibly about assembly code that uses local state in a different manner than the highlevel code it implements (e.g., selfmodifying code). In contrast to prior work, we factor our relation in a symmetric, languagegeneric fashion, which helps to simplify and clarify the formal presentation, and we also show how to account for the presence of a garbage collector. Our approach relies on recent developments in Kripke logical relations for MLlike languages, in particular the idea of possible worlds as state transition systems. 1.
The marriage of bisimulations and Kripke logical relations
 In POPL
, 2012
"... There has been great progress in recent years on developing effective techniques for reasoning about program equivalence in MLlike languages—that is, languages that combine features like higherorder functions, recursive types, abstract types, and general mutable references. Two of the most promine ..."
Abstract

Cited by 7 (5 self)
 Add to MetaCart
There has been great progress in recent years on developing effective techniques for reasoning about program equivalence in MLlike languages—that is, languages that combine features like higherorder functions, recursive types, abstract types, and general mutable references. Two of the most prominent types of techniques to have emerged are bisimulations and Kripke logical relations (KLRs). While both approaches are powerful, their complementary advantages have led us and other researchers to wonder whether there is an essential tradeoff between them. Furthermore, both approaches seem to suffer from fundamental limitations if one is interested in scaling them to interlanguage reasoning. In this paper, we propose relation transition systems (RTSs), which marry together some of the most appealing aspects of KLRs and bisimulations. In particular, RTSs show how bisimulations’ support for reasoning about recursive features via coinduction can be synthesized with KLRs ’ support for reasoning about local state via state transition systems. Moreover, we have designed RTSs to avoid the limitations of KLRs and bisimulations that preclude their generalization to interlanguage reasoning. Notably, unlike KLRs, RTSs are transitively composable.
RelaxedMemory Concurrency and Verified Compilation
, 2010
"... In this paper, we consider the semantic design and verified compilation of a Clike programming language for concurrent sharedmemory computation above x86 multiprocessors. The design of such a language is made surprisingly subtle by several factors: the relaxedmemory behaviour of the hardware, th ..."
Abstract

Cited by 7 (1 self)
 Add to MetaCart
In this paper, we consider the semantic design and verified compilation of a Clike programming language for concurrent sharedmemory computation above x86 multiprocessors. The design of such a language is made surprisingly subtle by several factors: the relaxedmemory behaviour of the hardware, the effects of compiler optimisation on concurrent code, the need to support highperformance concurrent algorithms, and the desire for a reasonably simple programming model. In turn, this complexity makes verified (or verifying) compilation both essential and challenging. We define a concurrent relaxedmemory semantics for ClightTSO, an extension of CompCert’s Clight in which the processor’s memory model is exposed for highperformance code. We discuss a strategy for verifying compilation from ClightTSO to x86, which we validate with correctness proofs (building on CompCert) for the most interesting compiler phases.
Realisability semantics of parametric polymorphism, general references
, 2009
"... and recursive types ..."
CompCertTSO: A Verified Compiler for RelaxedMemory Concurrency
"... In this paper, we consider the semantic design and verified compilation of a Clike programming language for concurrent sharedmemory computation above x86 multiprocessors. The design of such a language is made surprisingly subtle by several factors: the relaxedmemory behaviour of the hardware, the ..."
Abstract

Cited by 4 (2 self)
 Add to MetaCart
In this paper, we consider the semantic design and verified compilation of a Clike programming language for concurrent sharedmemory computation above x86 multiprocessors. The design of such a language is made surprisingly subtle by several factors: the relaxedmemory behaviour of the hardware, the effects of compiler optimisation on concurrent code, the need to support highperformance concurrent algorithms, and the desire for a reasonably simple programming model. In turn, this complexity makes verified (or verifying) compilation both essential and challenging. In this paper we describe ClightTSO, a concurrent extension of CompCert’s Clight in which the TSObased memory model of x86 multprocessors is exposed for highperformance code, and CompCertTSO, a verifying compiler from ClightTSO to x86 assembly code, building on CompCert. CompCertTSO is verified inCoq:foranywellbehavedandsuccessfullycompiledClightTSOsourceprogram,anypermittedobservable behaviour of the generated assembly code (if it does not run out of memory) is also possible in the source