## A sound semantics for OCamllight (2008)

### Cached

### Download Links

- [www.cl.cam.ac.uk]
- [www.cl.cam.ac.uk]
- [www.cl.cam.ac.uk]
- [www.cl.cam.ac.uk]
- DBLP

### Other Repositories/Bibliography

Venue: | In: Programming Languages and Systems, 17th European Symposium on Programming, ESOP 2008, Lecture Notes in Computer Science |

Citations: | 13 - 4 self |

### BibTeX

@INPROCEEDINGS{Owens08asound,

author = {Scott Owens},

title = {A sound semantics for OCamllight},

booktitle = {In: Programming Languages and Systems, 17th European Symposium on Programming, ESOP 2008, Lecture Notes in Computer Science},

year = {2008},

pages = {1--15},

publisher = {Springer}

}

### OpenURL

### Abstract

Abstract. Few programming languages have a mathematically rigorous definition or metatheory—in part because they are perceived as too large and complex to work with. This paper demonstrates the feasibility of such undertakings: we formalize a substantial portion of the semantics of Objective Caml’s core language (which had not previously been given a formal semantics), and we develop a mechanized type soundness proof in HOL. We also develop an executable version of the operational semantics, verify that it coincides with our semantic definition, and use it to test conformance between the semantics and the OCaml implementation. We intend our semantics to be a suitable substrate for the verification of OCaml programs. 1 Mechanizing Metatheory Researchers in programming languages and program verification routinely develop their ideas in the context of core calculi and idealized models. The advantage of the core calculus approach comes from the efficacy of pencil-and-paper mathematics, both for specification and proof; however, these techniques do not scale well. Usable programming

### Citations

618 |
The Definition of Standard ML (Revised
- Milner, Tofte, et al.
- 1997
(Show Context)
Citation Context ...elf uses a more accessible declarative proof style, but lacks this powerful automation. Prior SML proof efforts tried to closely follow the mathematical specification of The Definition of Standard ML =-=[22]-=-, but failed, in part because of its big-step operational semantics, in part because of its bugs, and in part because the proof assistant technology of the time was lacking [1, 2, 14, 17, 19]. The Met... |

140 | Mechanized metatheory for the masses: The POPLmark challenge
- Aydemir, Bohannon, et al.
- 2005
(Show Context)
Citation Context ...languages, such as Standard ML’s module system, so our methodology remains untested for these situations. Related Work. There has been extensive work on formalizing language semantics (e.g., POPLmark =-=[11]-=- solutions), and Java, C, and Standard ML (SML) have all been subject to large-scale developments in proof assistants, with varying degrees of success [12–19]. Type soundness has been proved for large... |

97 | A machine-checked model for a Java-like language, virtual machine and compiler
- Klein, Nipkow
- 2004
(Show Context)
Citation Context ...Java, C, and Standard ML (SML) have all been subject to large-scale developments in proof assistants, with varying degrees of success [12–19]. Type soundness has been proved for large subsets of Java =-=[12, 15, 18]-=-, with a similar methodology to ours; however, the formalized versions of Java are significantly simpler than OCamllight: for example, they lack parametric polymorphism and pattern matching. Norrish’s... |

86 | Proving Java type soundness
- Syme
- 1999
(Show Context)
Citation Context ...Java, C, and Standard ML (SML) have all been subject to large-scale developments in proof assistants, with varying degrees of success [12–19]. Type soundness has been proved for large subsets of Java =-=[12, 15, 18]-=-, with a similar methodology to ours; however, the formalized versions of Java are significantly simpler than OCamllight: for example, they lack parametric polymorphism and pattern matching. Norrish’s... |

75 | Towards a mechanized metatheory of Standard ML
- Lee, Crary, et al.
- 2007
(Show Context)
Citation Context ...ins some metatheoretic results, but none of them approaches the scale of the OCamllight type soundness proof. The only prior mechanized type soundness proof for a realistic ML-like language (for SML) =-=[13]-=- follows a methodology that differs significantly from ours. Instead of formalizing SML directly, it uses an internal language (IL) into which SML, including its module system, can be elaborated ([13]... |

62 | Formalising C in HOL
- Norrish
- 1998
(Show Context)
Citation Context ...hodology to ours; however, the formalized versions of Java are significantly simpler than OCamllight: for example, they lack parametric polymorphism and pattern matching. Norrish’s formalization of C =-=[16]-=- contains some metatheoretic results, but none of them approaches the scale of the OCamllight type soundness proof. The only prior mechanized type soundness proof for a realistic ML-like language (for... |

54 |
Mechanizing metatheory in a logical framework
- Harper, Licata
- 2007
(Show Context)
Citation Context ...ng, or some amount of elaboration, or both. Another important difference between the SML proof and ours is the setting of the mechanization; the SML proof was carried out in the Twelf proof assistant =-=[21]-=- which differs significantly from HOL: – HOL is a classical, impredicative logic (with a model in ZFC set theory) whereas Twelf is constructive and predicative. – Twelf supports higher-order abstract ... |

52 | First-Order Proof Tactics in Higher-Order Logic Theorem Provers
- Hurd
- 2003
(Show Context)
Citation Context ... make extensive use of rule induction and structural induction principles. We also rely upon the ability to create functions using well-founded recursion [6], and upon an automated first-order prover =-=[7]-=-. Our OCamllight formalization follows the formal syntactic specification (BNF) in the OCaml manual [3, Chapter 6] as closely as is feasible. This close connection with 2 Thanks to Tom Ridge and Gille... |

41 | Ott: effective tool support for the working semanticist
- Sewell, Nardelli, et al.
- 2007
(Show Context)
Citation Context ...ld form a substrate for applying program verification techniques to a significant subset of real OCaml programs. We design and formalize the OCamllight type system and operational semantics using Ott =-=[4]-=-, a tool for expressing such specifications, and we use the HOL-4 proof assistant [5] to prove a type soundness theorem. 1 We also formalize a deterministic, exe1 We verify all of our proofs in HOL-4,... |

40 | Oheimb. Java-light is type-safe - definitely
- Nipkow, von
- 1998
(Show Context)
Citation Context ...Java, C, and Standard ML (SML) have all been subject to large-scale developments in proof assistants, with varying degrees of success [12–19]. Type soundness has been proved for large subsets of Java =-=[12, 15, 18]-=-, with a similar methodology to ours; however, the formalized versions of Java are significantly simpler than OCamllight: for example, they lack parametric polymorphism and pattern matching. Norrish’s... |

33 |
Reasoning about Terminating Functional Programs
- Slind
- 1999
(Show Context)
Citation Context ...ables using de Bruijn indices. In the proof we make extensive use of rule induction and structural induction principles. We also rely upon the ability to create functions using well-founded recursion =-=[6]-=-, and upon an automated first-order prover [7]. Our OCamllight formalization follows the formal syntactic specification (BNF) in the OCaml manual [3, Chapter 6] as closely as is feasible. This close c... |

25 |
The Machine-Assisted Proof of Programming Language Properties
- VanInwegen
- 1996
(Show Context)
Citation Context ...inition of Standard ML [22], but failed, in part because of its big-step operational semantics, in part because of its bugs, and in part because the proof assistant technology of the time was lacking =-=[1, 2, 14, 17, 19]-=-. The Metis [7] and TFL [6] packages, upon which we rely, did not exist at the time. 2 OCamllight To a crude approximation, our OCamllight semantics is a core ML, excluding only modules and objects. I... |

24 | Symbolic Simulation: An ACL2 Approach
- Moore
- 1998
(Show Context)
Citation Context ...nowledge, the testing of full-language-scale semantics has been previously carried out only for the Scheme semantics in the PLT Redex term rewriting system [23] and in ACL2 for a Java Virtual Machine =-=[9, 24]-=- (symbolic execution is part of the standard ACL2 methodology, and it has often been applied to test full-scale hardware formalizations). Although both the type system and operational semantics should... |

22 | Mistakes and ambiguities in the definition of Standard ML
- Kahrs
- 1993
(Show Context)
Citation Context ...actical utility rather than mathematical elegance, and their presence makes the proofs too long and tedious to check reliably by hand. Furthermore, the specifications themselves are subject to errors =-=[1, 2]-=-. Formal verification offers a better path: using a proof assistant to formalize an unambiguous semantics and to mechanize high-assurance proofs. In this paper, we present a formal verification method... |

19 | Reasoning with the formal definition of Standard ML
- Syme
- 1993
(Show Context)
Citation Context ...inition of Standard ML [22], but failed, in part because of its big-step operational semantics, in part because of its bugs, and in part because the proof assistant technology of the time was lacking =-=[1, 2, 14, 17, 19]-=-. The Metis [7] and TFL [6] packages, upon which we rely, did not exist at the time. 2 OCamllight To a crude approximation, our OCamllight semantics is a core ML, excluding only modules and objects. I... |

14 | J.S.: Java program verification via a JVM deep embedding in ACL2
- Liu, Moore
- 2004
(Show Context)
Citation Context ...nowledge, the testing of full-language-scale semantics has been previously carried out only for the Scheme semantics in the PLT Redex term rewriting system [23] and in ACL2 for a Java Virtual Machine =-=[9, 24]-=- (symbolic execution is part of the standard ACL2 methodology, and it has often been applied to test full-scale hardware formalizations). Although both the type system and operational semantics should... |

9 | Stenning’s protocol implemented in UDP and verified in Isabelle
- COMPTON
(Show Context)
Citation Context ...lrbs in x1 , ... , xn ←let rec lrbs in xn } ( function pat mat ) lrbs = (x1 = function pat mat1 and ... and xn = function pat matn) recfun ( lrbs , pat mat1 ) ⊲ e1 ... recfun ( lrbs , pat matn ) ⊲ en =-=(8)-=- ⊢ let rec lrbs in e −→ { x1 ←e1 , ... , xn ←en } e ⊢ try ( %prim raise ) v with pattern matching −→ (9) match v with pattern matching | → ( ( %prim raise ) v ) ⊢ store L −→ store ′ ⊢ 〈definitions val... |

5 | Defects in the revised definition of Standard ML
- Rossberg
- 2006
(Show Context)
Citation Context ...actical utility rather than mathematical elegance, and their presence makes the proofs too long and tedious to check reliably by hand. Furthermore, the specifications themselves are subject to errors =-=[1, 2]-=-. Formal verification offers a better path: using a proof assistant to formalize an unambiguous semantics and to mechanize high-assurance proofs. In this paper, we present a formal verification method... |

5 | Operational reasoning for concurrent Caml programs and weak memory models
- Ridge
- 2007
(Show Context)
Citation Context ...tern matching | → ( ( %prim raise ) v ) ⊢ store L −→ store ′ ⊢ 〈definitions value, program〉 L −→ 〈definitions, program ′ 〉 ⊢ 〈definitions value, program, store〉 −→ 〈definitions, program ′ , store ′ 〉 =-=(10)-=- Fig. 2. Operational semantics (excerpt) the 137 rules to illustrate interesting aspects of OCamllight and the formalization (value and v indicate the Ott-enforced value grammar for expr). Contexts. W... |

5 |
Studying the ML module system
- Gunter, Maharaj
- 1995
(Show Context)
Citation Context ...inition of Standard ML [22], but failed, in part because of its big-step operational semantics, in part because of its bugs, and in part because the proof assistant technology of the time was lacking =-=[1, 2, 14, 17, 19]-=-. The Metis [7] and TFL [6] packages, upon which we rely, did not exist at the time. 2 OCamllight To a crude approximation, our OCamllight semantics is a core ML, excluding only modules and objects. I... |

4 | An operational semantics for Scheme
- Matthews, Findler
- 2008
(Show Context)
Citation Context ...ers by showing them the test suite. To our knowledge, the testing of full-language-scale semantics has been previously carried out only for the Scheme semantics in the PLT Redex term rewriting system =-=[23]-=- and in ACL2 for a Java Virtual Machine [9, 24] (symbolic execution is part of the standard ACL2 methodology, and it has often been applied to test full-scale hardware formalizations). Although both t... |

1 |
The Objective Caml System. 3.10 edn. (2007) http://caml.inria.fr/ pub/docs/manual-ocaml/index.html
- Leroy
(Show Context)
Citation Context ...ng −→ expr ⊢ e1 ⊢ e1 v0 L −→ e ′ 1 L −→ e ′ 1 v0 (1) ⊢ ref v (2) ref v = l −→ l ⊢ v matches pat ⊲ { x1 ←v1 , .. , xm ←vm } ⊢ v with pat → e | pat1 → e1 | ... | patn → en −→ { x1 ←v1 , .. , xm ←vm } e =-=(3)-=- ⊢ v1 matches pat1 ⊲ { substs x1 } .... ⊢ vn matches patn ⊲ { substs xn } ⊢ ( v1 , .... , vn ) matches ( pat1 , .... , patn ) ⊲ { substs x1 @ .... @ substs xn } ¬(v matches pat1) ⊢ v matches pat2 ⊲ { ... |

1 |
personal correspondence
- Harper
- 2007
(Show Context)
Citation Context ...language (IL) into which SML, including its module system, can be elaborated ([13] proved type soundness only for IL, leaving a formalized elaboration to future work; this work has now been completed =-=[20]-=-). IL is essentially a heavily streamlined version of SML designed to yield an elegant and tractable mechanized soundness proof. In particular, IL does not directly support pattern matching, implicit ... |