Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Verified Code Generation from Isabelle/HOL

Verified Code Generation from Isabelle/HOL

In this thesis, I develop a verified compilation toolchain from executable specifications in Isabelle/HOL to CakeML abstract syntax trees. This improves over the state-of-the-art in Isabelle by providing a trustworthy procedure for code generation. The work consists of three major contributions.

First, I have implemented a certifying routine to eliminate type classes and instances in Isabelle specifications. Based on defining equations of constants, it derives new definitions that do not use type classes. This can be used to bypass an unverified step in the current code generator.

Second, I formalized an algebra for higher-order Lambda-terms that generalizes the notions of free variables, matching, and substitution. Terms can be thought of as consisting of a generic (free variables, constants, application) and a specific part (abstraction, bound variables). With this algebra, it becomes possible to reason abstractly over a variety of different types.

These two parts are independent from each other and can also be used for other purposes. For example, I have successfully instantiated the term algebra for other term types in the Isabelle universe.

Third, a compiler that works similarly to the existing code generator, but produces a CakeML abstract syntax tree together with a correctness theorem. More precisely, I have combined a simple proof producing translation of recursion equations in Isabelle into a deeply embedded term language with a fully verified compilation chain to the target language CakeML.

Lars Hupel

July 11, 2019
Tweet

More Decks by Lars Hupel

Other Decks in Research

Transcript

  1. V e r i f i e d C o d e
    G e n e r a t i o n
    f r o m
    I s a b e l l e / H O L
    L a r s H u p e l
    P h D D e f e n s e
    2 0 1 9 - 0 7 - 1 1

    View Slide

  2. I s a b e l l e
    • i n t e r a c t i v e p r o o f a s s i s t a n t
    • p o w e r f u l a u t o m a t i o n

    View Slide

  3. I s a b e l l e / H O L
    • i n t e r a c t i v e p r o o f a s s i s t a n t
    • p o w e r f u l a u t o m a t i o n
    • s u p p o r t s f u n c t i o n a l p r o g r a m m i n g
    i n d u c t i v e d a t a t y p e s
    r e c u r s i v e f u n c t i o n s
    p a t t e r n m a t c h i n g
    t y p e c l a s s e s

    View Slide

  4. F u n c t i o n a l P r o g r a m m i n g i n H O L
    S o u r c e
    d a t a t y p e
    α l i s t
    = N i l
    | C o n s
    α (α l i s t
    )
    f u n a p p e n d w h e r e
    a p p e n d N i l y s
    = y s
    a p p e n d
    (C o n s x x s
    ) y s
    = C o n s x
    (a p p e n d x s y s
    )

    View Slide

  5. F u n c t i o n a l P r o g r a m m i n g i n H O L
    T a r g e t
    datatype 'a list = Nil | Cons of 'a * 'a list;
    fun append Nil xs = xs
    | append (Cons (y, ys)) xs = Cons (y, append ys xs);

    View Slide

  6. C u r r e n t c o d e g e n e r a t o r
    1 . i n p u t : s e t o f e q u a t i o n s
    2 . p r e p r o c e s s
    3 . b u i l d d e p e n d e n c y g r a p h , c o m p u t e S C C s
    4 . t r a n s l a t e t o i n t e r m e d i a t e l a n g u a g e
    5 . s e r i a l i z e t o t a r g e t l a n g u a g e
    6 . o u t p u t : s o u r c e t e x t

    View Slide

  7. T e r m i n o l o g y
    t r u s t e d

    View Slide

  8. T e r m i n o l o g y
    t r u s t e d

    v e r i f y i n g

    View Slide

  9. T e r m i n o l o g y
    t r u s t e d

    v e r i f y i n g

    v e r i f i e d

    View Slide

  10. V e r i f y i n g c o d e g e n e r a t o r
    I d e a : t r a n s f o r m e q u a t i o n s i n t o i n t e r m e d i a t e f o r m a l o b j e c t
    i n t e r m e d i a t e l a n g u a g e i s a v a l u e i n t h e l o g i c
    M y r e e n & O w e n s . P r o o f - p r o d u c i n g s y n t h e s i s o f M L f r o m h i g h e r - o r d e r l o g i c . I C F P 2 0 1 2 .
    M y r e e n & O w e n s . P r o o f - p r o d u c i n g t r a n s l a t i o n o f h i g h e r - o r d e r l o g i c i n t o p u r e a n d s t a t e f u l M L .
    J A R 2 0 1 4 .
    S o n H o e t . a l . P r o o f - P r o d u c i n g S y n t h e s i s o f C a k e M L w i t h I / O a n d L o c a l S t a t e f r o m M o n a d i c H O L
    F u n c t i o n s . I J C A R 2 0 1 8 .
    H u p e l & N i p k o w . A V e r i f i e d C o m p i l e r f r o m I s a b e l l e / H O L t o C a k e M L . E S O P 2 0 1 8 .

    View Slide

  11. C a k e M L
    “ C a k e M L i s a f u n c t i o n a l p r o g r a m m i n g l a n g u a g e a n d a n e c o s y s t e m o f
    p r o o f s a n d t o o l s b u i l t a r o u n d t h e l a n g u a g e . T h e e c o s y s t e m i n c l u d e s
    a p r o v e n - c o r r e c t c o m p i l e r t h a t c a n b o o t s t r a p i t s e l f .”

    View Slide

  12. View Slide

  13. View Slide

  14. View Slide

  15. D i f f e r e n c e s i n t h e a p p r o a c h
    • M y r e e n & O w e n s g o d i r e c t l y f r o m H O L 4 e q u a t i o n s t o C a k e M L s y n t a x
    • t h i s w o r k :
    1 . f r o m I s a b e l l e e q u a t i o n s t o t e r m r e w r i t i n g s y s t e m ( v e r i f y i n g )
    2 . . . . t o C a k e M L s y n t a x ( v e r i f i e d )
    • d e a l i n g w i t h I s a b e l l e s p e c i a l t i e s
    H a f t m a n n & N i p k o w . C o d e G e n e r a t i o n v i a H i g h e r - O r d e r R e w r i t e S y s t e m s . F L O P S 2 0 1 0 .
    H u p e l . C e r t i f y i n g D i c t i o n a r y C o n s t r u c t i o n i n I s a b e l l e / H O L . F I , t o a p p e a r ( 2 0 1 9 ) .

    View Slide

  16. M o d u l e o v e r v i e w
    T h i s w o r k
    C a k e M L s p e c v i a L e m
     A F P
    D i c t i o n a r y c o n s t r u c t i o n  A F P
    H i g h e r - o r d e r t e r m a l g e b r a  A F P
    H u p e l . D i c t i o n a r y C o n s t r u c t i o n . A F P 2 0 1 7 .
    H u p e l & Z h a n g . C a k e M L . A F P 2 0 1 8 .
    H u p e l ( w i t h c o n t r i b u t i o n s f r o m Z h a n g ) . A n A l g e b r a f o r H i g h e r - O r d e r T e r m s . A F P 2 0 1 9 .

    View Slide

  17. M o d u l e o v e r v i e w
    T h i s w o r k
    C a k e M L s p e c v i a L e m
     A F P
    D i c t i o n a r y c o n s t r u c t i o n  A F P
    H i g h e r - o r d e r t e r m a l g e b r a  A F P
    I s a b e l l e c o d e g e n e r a t o r f o r C a k e M L � p e n d i n g ( A F P )
    H u p e l . D i c t i o n a r y C o n s t r u c t i o n . A F P 2 0 1 7 .
    H u p e l & Z h a n g . C a k e M L . A F P 2 0 1 8 .
    H u p e l ( w i t h c o n t r i b u t i o n s f r o m Z h a n g ) . A n A l g e b r a f o r H i g h e r - O r d e r T e r m s . A F P 2 0 1 9 .

    View Slide

  18. M o d u l e o v e r v i e w
    F u t u r e w o r k
    I s a b e l l e / H O L 4 � i n p r o g r e s s
    C a k e M L v i a H O L 4
    � u n c l e a r
    C a k e M L e p o c h 3 � i n p r o g r e s s
    N a t i v e t y p e s � p l a n n e d
    I m m l e r , R ä d l e & W e n z e l . V i r t u a l i z a t i o n o f H O L 4 i n I s a b e l l e . I T P 2 0 1 9 .

    View Slide

  19. P u b l i c a t i o n s ( s e l e c t i o n )
    D i e k m a n n , H u p e l & C a r l e . D i r e c t e d S e c u r i t y
    P o l i c i e s : A S t a t e f u l N e t w o r k I m p l e m e n t a t i o n .
    E S S S 2 0 1 4 .
    D i e k m a n n , H u p e l & C a r l e .
    S e m a n t i c s - P r e s e r v i n g S i m p l i f i c a t i o n o f
    R e a l - W o r l d F i r e w a l l R u l e S e t s . F M 2 0 1 5 .
    H u p e l & K u n c a k . T r a n s l a t i n g S c a l a P r o g r a m s
    t o I s a b e l l e / H O L . I J C A R 2 0 1 6 .
    D i e k m a n n & H u p e l . I p t a b l e s S e m a n t i c s . A F P
    2 0 1 6 .
    H u p e l . C o n s t r u c t o r F u n c t i o n s . A F P 2 0 1 7 .
    H u p e l . L a z i f y i n g c a s e c o n s t a n t s . A F P 2 0 1 7 .
    H u p e l . D i c t i o n a r y C o n s t r u c t i o n . A F P 2 0 1 7 .
    H u p e l & Z h a n g . C a k e M L . A F P 2 0 1 8 .
    H u p e l & N i p k o w . A V e r i f i e d C o m p i l e r f r o m
    I s a b e l l e / H O L t o C a k e M L . E S O P 2 0 1 8 .
    D i e k m a n n , H u p e l , M i c h a e l i s , H a s l b e c k & C a r l e .
    V e r i f i e d i p t a b l e s F i r e w a l l A n a l y s i s a n d
    V e r i f i c a t i o n . J A R 2 0 1 8 .
    H u p e l & Z h a n g . A n A l g e b r a f o r H i g h e r - O r d e r
    T e r m s . A F P 2 0 1 9 .
    H u p e l . C e r t i f y i n g D i c t i o n a r y C o n s t r u c t i o n i n
    I s a b e l l e / H O L . F I , t o a p p e a r ( 2 0 1 9 ) .

    View Slide

  20. Q & A
    L a r s H u p e l
    � l a r s . h u p e l @ i n n o q . c o m
    � @ l a r s r _ h
    w w w . i n n o q . c o m
    i n n o Q D e u t s c h l a n d G m b H
    K r i s c h e r s t r . 1 0 0
    4 0 7 8 9 M o n h e i m a . R h .
    G e r m a n y
    + 4 9 2 1 7 3 3 3 6 6 - 0
    O h l a u e r S t r . 4 3
    1 0 9 9 9 B e r l i n
    G e r m a n y
    L u d w i g s t r . 1 8 0 E
    6 3 0 6 7 O f f e n b a c h
    G e r m a n y
    K r e u z s t r . 1 6
    8 0 3 3 1 M ü n c h e n
    G e r m a n y
    c / o W e W o r k
    H e r m a n n s t r a s s e 1 3
    2 0 0 9 5 H a m b u r g
    G e r m a n y
    i n n o Q S c h w e i z G m b H
    G e w e r b e s t r . 1 1
    C H - 6 3 3 0 C h a m
    S w i t z e r l a n d
    + 4 1 4 1 7 4 3 0 1 1 1
    A l b u l a s t r . 5 5
    8 0 4 8 Z ü r i c h
    S w i t z e r l a n d

    View Slide

  21. L A R S H U P E L
    C o n s u l t a n t
    i n n o Q D e u t s c h l a n d G m b H
    L a r s e n j o y s p r o g r a m m i n g i n a v a r i e t y o f l a n -
    g u a g e s , i n c l u d i n g S c a l a , H a s k e l l , a n d R u s t . H e i s
    k n o w n a s a f r e q u e n t c o n f e r e n c e s p e a k e r a n d o n e
    o f t h e f o u n d e r s o f t h e T y p e l e v e l i n i t i a t i v e w h i c h
    i s d e d i c a t e d t o p r o v i d i n g p r i n c i p l e d , t y p e - d r i v e n
    S c a l a l i b r a r i e s .

    View Slide

  22. M L
    P r e -
    p r o c e s s i n g
    D e e p e m -
    b e d d i n g
    H O L
    U s e r
    d e f i n i t i o n s
    S i m p l i f i e d
    d e f i n i t i o n s
    T e r m s
    E m b e d d e d
    d e f i n i t i o n s
    C a k e M L
    p r o g r a m
    T e r m
    c o m p i l e r
    S i m p l i f i e r
    i m p l e m e n t e d a s p a r t o f t h i s t h e s i s
    g r e e n
    ( c h e c k e r e d : a l r e a d y a v a i l a b l e i n I s a b e l l e )
    b l u e s p e c i f i e d b y u s e r
    r e d g e n e r a t e d o b j e c t

    View Slide