## Mechanically Verifying the Correctness of an Offline Partial Evaluator (1995)

Citations: | 12 - 3 self |

### BibTeX

@MISC{Hatcliff95mechanicallyverifying,

author = {John Hatcliff},

title = {Mechanically Verifying the Correctness of an Offline Partial Evaluator},

year = {1995}

}

### OpenURL

### Abstract

We show that using deductive systems to specify an offline partial evaluator allows its correctness to be mechanically verified. For a -mix-style partial evaluator, we specify binding-time constraints using a natural-deduction logic, and the associated program specializer using natural (aka "deductive") semantics. These deductive systems can be directly encoded in the Elf programming language --- a logic programming language based on the LF logical framework. The specifications are then executable as logic programs. This provides a prototype implementation of the partial evaluator. Moreover, since deductive system proofs are accessible as objects in Elf, many aspects of the partial evaluation correctness proofs (e.g., the correctness of binding-time analysis) can be coded in Elf and mechanically verified. This work illustrates the utility of declarative programming and of using deductive systems for defining program specialization systems: by exploiting the logical character of definit...

### Citations

1880 | Abstract Interpretation: A Unified Lattice Model for Static Analysis of Programs by Construction or Approximation of Fixpoints - Cousot, Cousot - 1977 |

847 | A formulation of the simple theory of types - Church - 1940 |

696 | A Framework for Defining Logics
- Harper, Honsel, et al.
- 1993
(Show Context)
Citation Context ...ivities such as proving the correctness of binding-time analysis and specialization. -- We formalize the specifications using LF --- a meta-language (a dependentlytypeds-calculus) for defining logics =-=[12]-=-. In LF, judgements (assertions) are represented as types, and deductions are represented as objects. Determining the validity of a deduction is reduced to checking if the representing object is well-... |

420 | Isabelle: A generic theorem prover - Paulson - 1994 |

302 |
Higher-order abstract syntax
- Pfenning, Elliot
- 1988
(Show Context)
Citation Context ...roduced. All the encodings we use are adequate. See Harper et al.[12] type constructor. Binding in lam x : e is represented using binding in the metalanguages(i.e., using higher-order abstract syntax =-=[22]-=-). Variables in the object language are identified with variables in the meta-language, so there is no explicit representation of identifiers in the Elf signature for the object language. For example,... |

267 |
Semantics of Programming Languages: Structures and Techniques. Foundations of Computing
- Gunter
- 1992
(Show Context)
Citation Context ...stants for each term and 4 In the extended version of this paper [13], we treat full PCF, i.e., simply-typed -terms with primitive operations (e.g., succ, pred), conditionals, and fixpoint constructs =-=[8]-=-. In the present version, space constraints force us to consider only those constructs which best illustrate principles. Including the other constructs is a straightforward extension of the work here ... |

236 | Tutorial notes on partial evaluation
- Consel, Danvy
- 1993
(Show Context)
Citation Context ...s phase (where information is gathered about which parts of the source program depend on known or unknown data), and a specialization phase (where constructs depending on known data are reduced away) =-=[3,15]-=-. Recent work specifies the analysis phase using type systems [7] and the specialization phase using operational semantics [14,25,26]. The type system and operational semantics formalisms can be unifi... |

207 | Type-directed partial evaluation
- Danvy
(Show Context)
Citation Context ...nce it is simple, and one of the few partial evaluators with a rigorous semantic foundation. It has also spawned additional work on the correctness of binding-time analysis [19,28] and specialization =-=[16]-=-. Our results are as follows. -- We give novel specifications of binding-time constraints and specialization as natural-deduction style logics. These specifications simplify meta-theory activities suc... |

175 | Logic programming in the LF logical framework
- Pfenning
- 1991
(Show Context)
Citation Context ...ng is decidable, purported deductions can be checked automatically for validity. -- We obtain prototypes directly from the formal specifications using Elf --- a logic programming language based on LF =-=[20]-=-. Elf gives an operational interpretation to LF types by treating them as goals. Thus, the LF specifications of the binding-time analysis and specializer are directly executable in Elf. -- We formaliz... |

171 | Semantics of Programming Languages - Tennent - 1991 |

120 | Bisimilarity as a theory of functional programming - Gordon - 1995 |

93 | A partial evaluator for the untyped lambda-calculus
- Gomard, Jones
- 1991
(Show Context)
Citation Context ...ce program depend on known or unknown data), and a specialization phase (where constructs depending on known data are reduced away) [3,15]. Recent work specifies the analysis phase using type systems =-=[7]-=- and the specialization phase using operational semantics [14,25,26]. The type system and operational semantics formalisms can be unified if one emphasizes their logical character: a type-based analys... |

85 | Abstract interpretation: A semantics-based tool for program analysis - Jones, Nielson - 1995 |

51 | Winskel is (almost) right: Towards a mechanized semantics - Nipkow - 1998 |

44 | Natural Semantics and some of its meta-theory in Elf
- Michaylov
- 1991
(Show Context)
Citation Context ...that these deductions (and hence the correctness proofs) are valid. This methodology of specification/implementation/verification using LF and Elf has been successfully applied in other problem areas =-=[11,17]-=-. In particular, we build on Hannan and Pfenning's work on compiler verification in Elf [11]. They conjectured that their techniques could also be applied to partial evaluation [11, p. 416]. They also... |

42 |
Proof of translation in natural semantics
- Despeyroux
- 1986
(Show Context)
Citation Context ...ilar to the one used in the proof of Theorem 1 gives the rules defining t2. The details are given in [13]. 7 Related work Despeyroux first emphasized using deductive systems to define transformations =-=[5]-=-. She specified a compiler, and source and target language semantics using deductive systems. The specifications were executed via encodings into Typol. Informal proofs of correctness were given as re... |

41 | Compiler verification in LF
- Hannan, Pfenning
- 1992
(Show Context)
Citation Context ...that these deductions (and hence the correctness proofs) are valid. This methodology of specification/implementation/verification using LF and Elf has been successfully applied in other problem areas =-=[11,17]-=-. In particular, we build on Hannan and Pfenning's work on compiler verification in Elf [11]. They conjectured that their techniques could also be applied to partial evaluation [11, p. 416]. They also... |

37 | Specifying the correctness of binding-time analysis - Wand - 1993 |

36 | A proof of the Church-Rosser theorem and its representation in a logical framework
- Pfenning
- 1992
(Show Context)
Citation Context ...s e 0 2 3 such that 0 d ` bta e 0 : �� [a : ' �� ] and e =3 e 0 . Proof. (summary) To formalize the proof, we give an encoding of the 3-calculus into Elf based on a similar encoding given by P=-=fenning [21]-=-. Next, we construct a function (via a relation as in Theorem 1) which constructs a deduction showing e converts to e 0 . t2 : spec W A -? bta E T W P -? bta E' T A P -? conv E E' -? type. A strategy ... |

34 | A self-applicable partial evaluator for the lambda calculus: correctness and pragmatics - Gomard - 1992 |

33 | A computational formalization for partial evaluation
- Hatcliff, Danvy
- 1997
(Show Context)
Citation Context ...tion phase (where constructs depending on known data are reduced away) [3,15]. Recent work specifies the analysis phase using type systems [7] and the specialization phase using operational semantics =-=[14,25,26]-=-. The type system and operational semantics formalisms can be unified if one emphasizes their logical character: a type-based analysis is a logic for deducing program properties, and an operational se... |

32 | Implementing the meta-theory of deductive systems
- Pfenning, Rohwedder
- 1991
(Show Context)
Citation Context ...s always exist (i.e., that t1 is total) cannot be captured in Elf. This phase of verification (called schema checking) must be done by hand, although its automation is the subject of current research =-=[23]-=-. Our definition makes t1 total because we give a rule for each possible pair of spec and bta rules (giving primitive recursive structure). In addition, the deduction of answer judgements tell us that... |

25 | Type systems for closure conversions - Hannan - 1995 |

20 | Total correctness by local improvement in program transformation
- Sands
- 1995
(Show Context)
Citation Context ...tion phase (where constructs depending on known data are reduced away) [3,15]. Recent work specifies the analysis phase using type systems [7] and the specialization phase using operational semantics =-=[14,25,26]-=-. The type system and operational semantics formalisms can be unified if one emphasizes their logical character: a type-based analysis is a logic for deducing program properties, and an operational se... |

20 |
Towards unifying partial evaluation, deforestation, supercompilation, and GPC
- S��rensen, Gluck, et al.
- 1994
(Show Context)
Citation Context ...tion phase (where constructs depending on known data are reduced away) [3,15]. Recent work specifies the analysis phase using type systems [7] and the specialization phase using operational semantics =-=[14,25,26]-=-. The type system and operational semantics formalisms can be unified if one emphasizes their logical character: a type-based analysis is a logic for deducing program properties, and an operational se... |

18 | Extended natural semantics - Hannan - 1993 |

17 | Correctness of binding-time analysis
- Palsberg
- 1993
(Show Context)
Citation Context ...a good illustrative case since it is simple, and one of the few partial evaluators with a rigorous semantic foundation. It has also spawned additional work on the correctness of binding-time analysis =-=[19,28]-=- and specialization [16]. Our results are as follows. -- We give novel specifications of binding-time constraints and specialization as natural-deduction style logics. These specifications simplify me... |

14 | Self-applicable partial evaluation for pure lambda calculus
- MOGENSEN
- 1992
(Show Context)
Citation Context ...ctness of binding-time analysis. Palsberg presents a generalization of Gomard and Jones criteria [7] for consistent binding-time annotations. Wand studies Mogensen's self-applicable partial evaluator =-=[18]-=- for the pure -calculus. His binding-time analysis is essentially the same as Gomard and Jones's as well the one presented here. Wand's goals with respect to correctness of the analysis and specialize... |

13 |
Natural Deduction, Almquist and Wiksell
- Prawitz
- 1965
(Show Context)
Citation Context ...tors that take proofs of hypothetical judgements as arguments. Such proofs are represented as functions mapping proofs of assumption judgments to proofs of consequent 7 We use the notation of Prawitz =-=[24]. bta z s : bta 0 : nat [0-=-s : sta] bta lam s : (bta x : ��1 [y : '1 ]) bta e : ��2 [w : '2 ] bta lam x : e : ��1 ! ��2 [lams y : w : '1 ! '2 ] bta app s : bta e0 : ��1 ! ��2 [w0 : '1 ! '2 ] bta e1 : �... |

12 | A proof tool for reasoning about functional programs - Collins - 1996 |

6 |
Efficient multi-level generating extensions
- Gluck, J��rgensen
- 1995
(Show Context)
Citation Context ...ne would use to verify the correctness of a hand-written cogen [15]. In fact, in a preliminary investigation we have prototyped a higher-order version of the multi-level cogen of Gluck and J��rgen=-=sen [6]-=-. It remains to be seen if these techniques scale up to (a) type-based analyses that include conjunctive types, polymorphism, and more general forms of subtyping, and (b) more robust forms of partial ... |

5 |
and Ranan Fraer. Reasoning with Executable Specifications
- Bertot
- 1995
(Show Context)
Citation Context ...er for FORTRAN using natural semantics, and derive a prototype from the specification using the Centaur programming environment. However, their correctness proofs are not formalized. Bertot and Fraer =-=[1]-=- show how similar correctness proofs (for a specializer for an imperative language) can be formalized and mechanically checked using Coq. 8 Conclusion We have specified the main components of an offli... |

5 | Pfenning and Conal Elliott. Higher-order abstract syntax - Frank |

4 | Deriving mixed evaluation from standard evaluation for a simple functional language
- Hannan, Miller
- 1989
(Show Context)
Citation Context .... Despeyroux [5, Section 8], and Hannan and Pfenning [11, Section 7], suggested that their methods could be used to specify "mixed computation" and partial evaluation, respectively. Hannan a=-=nd Miller [10] carried o-=-ut Despeyroux's suggestion; they use deductive systems encoded in -Prolog to obtain executable specifications of mixed computation (in their work, "mixed computation" = nondeterministic on-l... |

4 | Partial Evaluation and Correctness - WELINDER - 1996 |

2 | Encoding operational semantics in logical frameworks: A critical review of LF/Elf - Niss, Hatcliff - 1995 |

2 | Palsberg. Correctness of binding-time analysis - Jens - 1993 |

1 |
A modal analysis of staged compuation
- Davies, Pfenning
- 1995
(Show Context)
Citation Context ...our of the partial evaluator when self-applied. It would be interesting to see to what extent the meta-theory used by Palsberg and Wand could be formalized in Elf. In recent work, Davies and Pfenning =-=[4]-=- give a type system for expressing staged computation based on the intuitionistic modal logic S4. They have implemented the type system and a portion of the associated correctness proofs in Elf. Our w... |