Verified Code Generation from Isabelle/HOL

In this thesis, I develop a verified compilation toolchain from executable specifications in Isabelle/HOL to CakeML abstract syntax trees. This improves over the state-of-the-art in Isabelle by providing a trustworthy procedure for code generation. The work consists of three major contributions.

First, I have implemented a certifying routine to eliminate type classes and instances in Isabelle specifications. Based on defining equations of constants, it derives new definitions that do not use type classes. This can be used to bypass an unverified step in the current code generator.

Second, I formalized an algebra for higher-order Lambda-terms that generalizes the notions of free variables, matching, and substitution. Terms can be thought of as consisting of a generic (free variables, constants, application) and a specific part (abstraction, bound variables). With this algebra, it becomes possible to reason abstractly over a variety of different types.

These two parts are independent from each other and can also be used for other purposes. For example, I have successfully instantiated the term algebra for other term types in the Isabelle universe.

Third, a compiler that works similarly to the existing code generator, but produces a CakeML abstract syntax tree together with a correctness theorem. More precisely, I have combined a simple proof producing translation of recursion equations in Isabelle into a deeply embedded term language with a fully verified compilation chain to the target language CakeML.

Transcript

1. V e r i f i e d C o d e G e n e r a t i o n f r o m I s a b e l l e / H O L L a r s H u p e l P h D D e f e n s e 2 0 1 9 - 0 7 - 1 1
2. I s a b e l l e • i n t e r a c t i v e p r o o f a s s i s t a n t • p o w e r f u l a u t o m a t i o n
3. I s a b e l l e / H O L • i n t e r a c t i v e p r o o f a s s i s t a n t • p o w e r f u l a u t o m a t i o n • s u p p o r t s f u n c t i o n a l p r o g r a m m i n g i n d u c t i v e d a t a t y p e s r e c u r s i v e f u n c t i o n s p a t t e r n m a t c h i n g t y p e c l a s s e s
4. F u n c t i o n a l P r o g r a m m i n g i n H O L S o u r c e d a t a t y p e α l i s t = N i l | C o n s α (α l i s t ) f u n a p p e n d w h e r e a p p e n d N i l y s = y s a p p e n d (C o n s x x s ) y s = C o n s x (a p p e n d x s y s )
5. F u n c t i o n a l P r o g r a m m i n g i n H O L T a r g e t datatype 'a list = Nil | Cons of 'a * 'a list; fun append Nil xs = xs | append (Cons (y, ys)) xs = Cons (y, append ys xs);
6. C u r r e n t c o d e g e n e r a t o r 1 . i n p u t : s e t o f e q u a t i o n s 2 . p r e p r o c e s s 3 . b u i l d d e p e n d e n c y g r a p h , c o m p u t e S C C s 4 . t r a n s l a t e t o i n t e r m e d i a t e l a n g u a g e 5 . s e r i a l i z e t o t a r g e t l a n g u a g e 6 . o u t p u t : s o u r c e t e x t
7. T e r m i n o l o g y t r u s t e d �
8. T e r m i n o l o g y t r u s t e d � v e r i f y i n g �
9. T e r m i n o l o g y t r u s t e d � v e r i f y i n g � v e r i f i e d �
10. V e r i f y i n g c o d e g e n e r a t o r I d e a : t r a n s f o r m e q u a t i o n s i n t o i n t e r m e d i a t e f o r m a l o b j e c t i n t e r m e d i a t e l a n g u a g e i s a v a l u e i n t h e l o g i c M y r e e n & O w e n s . P r o o f - p r o d u c i n g s y n t h e s i s o f M L f r o m h i g h e r - o r d e r l o g i c . I C F P 2 0 1 2 . M y r e e n & O w e n s . P r o o f - p r o d u c i n g t r a n s l a t i o n o f h i g h e r - o r d e r l o g i c i n t o p u r e a n d s t a t e f u l M L . J A R 2 0 1 4 . S o n H o e t . a l . P r o o f - P r o d u c i n g S y n t h e s i s o f C a k e M L w i t h I / O a n d L o c a l S t a t e f r o m M o n a d i c H O L F u n c t i o n s . I J C A R 2 0 1 8 . H u p e l & N i p k o w . A V e r i f i e d C o m p i l e r f r o m I s a b e l l e / H O L t o C a k e M L . E S O P 2 0 1 8 .
11. C a k e M L “ C a k e M L i s a f u n c t i o n a l p r o g r a m m i n g l a n g u a g e a n d a n e c o s y s t e m o f p r o o f s a n d t o o l s b u i l t a r o u n d t h e l a n g u a g e . T h e e c o s y s t e m i n c l u d e s a p r o v e n - c o r r e c t c o m p i l e r t h a t c a n b o o t s t r a p i t s e l f .”
15. D i f f e r e n c e s i n t h e a p p r o a c h • M y r e e n & O w e n s g o d i r e c t l y f r o m H O L 4 e q u a t i o n s t o C a k e M L s y n t a x • t h i s w o r k : 1 . f r o m I s a b e l l e e q u a t i o n s t o t e r m r e w r i t i n g s y s t e m ( v e r i f y i n g ) 2 . . . . t o C a k e M L s y n t a x ( v e r i f i e d ) • d e a l i n g w i t h I s a b e l l e s p e c i a l t i e s H a f t m a n n & N i p k o w . C o d e G e n e r a t i o n v i a H i g h e r - O r d e r R e w r i t e S y s t e m s . F L O P S 2 0 1 0 . H u p e l . C e r t i f y i n g D i c t i o n a r y C o n s t r u c t i o n i n I s a b e l l e / H O L . F I , t o a p p e a r ( 2 0 1 9 ) .
16. M o d u l e o v e r v i e w T h i s w o r k C a k e M L s p e c v i a L e m  A F P D i c t i o n a r y c o n s t r u c t i o n  A F P H i g h e r - o r d e r t e r m a l g e b r a  A F P H u p e l . D i c t i o n a r y C o n s t r u c t i o n . A F P 2 0 1 7 . H u p e l & Z h a n g . C a k e M L . A F P 2 0 1 8 . H u p e l ( w i t h c o n t r i b u t i o n s f r o m Z h a n g ) . A n A l g e b r a f o r H i g h e r - O r d e r T e r m s . A F P 2 0 1 9 .
17. M o d u l e o v e r v i e w T h i s w o r k C a k e M L s p e c v i a L e m  A F P D i c t i o n a r y c o n s t r u c t i o n  A F P H i g h e r - o r d e r t e r m a l g e b r a  A F P I s a b e l l e c o d e g e n e r a t o r f o r C a k e M L � p e n d i n g ( A F P ) H u p e l . D i c t i o n a r y C o n s t r u c t i o n . A F P 2 0 1 7 . H u p e l & Z h a n g . C a k e M L . A F P 2 0 1 8 . H u p e l ( w i t h c o n t r i b u t i o n s f r o m Z h a n g ) . A n A l g e b r a f o r H i g h e r - O r d e r T e r m s . A F P 2 0 1 9 .
18. M o d u l e o v e r v i e w F u t u r e w o r k I s a b e l l e / H O L 4 � i n p r o g r e s s C a k e M L v i a H O L 4 � u n c l e a r C a k e M L e p o c h 3 � i n p r o g r e s s N a t i v e t y p e s � p l a n n e d I m m l e r , R ä d l e & W e n z e l . V i r t u a l i z a t i o n o f H O L 4 i n I s a b e l l e . I T P 2 0 1 9 .
19. P u b l i c a t i o n s ( s e l e c t i o n ) D i e k m a n n , H u p e l & C a r l e . D i r e c t e d S e c u r i t y P o l i c i e s : A S t a t e f u l N e t w o r k I m p l e m e n t a t i o n . E S S S 2 0 1 4 . D i e k m a n n , H u p e l & C a r l e . S e m a n t i c s - P r e s e r v i n g S i m p l i f i c a t i o n o f R e a l - W o r l d F i r e w a l l R u l e S e t s . F M 2 0 1 5 . H u p e l & K u n c a k . T r a n s l a t i n g S c a l a P r o g r a m s t o I s a b e l l e / H O L . I J C A R 2 0 1 6 . D i e k m a n n & H u p e l . I p t a b l e s S e m a n t i c s . A F P 2 0 1 6 . H u p e l . C o n s t r u c t o r F u n c t i o n s . A F P 2 0 1 7 . H u p e l . L a z i f y i n g c a s e c o n s t a n t s . A F P 2 0 1 7 . H u p e l . D i c t i o n a r y C o n s t r u c t i o n . A F P 2 0 1 7 . H u p e l & Z h a n g . C a k e M L . A F P 2 0 1 8 . H u p e l & N i p k o w . A V e r i f i e d C o m p i l e r f r o m I s a b e l l e / H O L t o C a k e M L . E S O P 2 0 1 8 . D i e k m a n n , H u p e l , M i c h a e l i s , H a s l b e c k & C a r l e . V e r i f i e d i p t a b l e s F i r e w a l l A n a l y s i s a n d V e r i f i c a t i o n . J A R 2 0 1 8 . H u p e l & Z h a n g . A n A l g e b r a f o r H i g h e r - O r d e r T e r m s . A F P 2 0 1 9 . H u p e l . C e r t i f y i n g D i c t i o n a r y C o n s t r u c t i o n i n I s a b e l l e / H O L . F I , t o a p p e a r ( 2 0 1 9 ) .
20. Q & A L a r s H u p e l � l a r s . h u p e l @ i n n o q . c o m � @ l a r s r _ h w w w . i n n o q . c o m i n n o Q D e u t s c h l a n d G m b H K r i s c h e r s t r . 1 0 0 4 0 7 8 9 M o n h e i m a . R h . G e r m a n y + 4 9 2 1 7 3 3 3 6 6 - 0 O h l a u e r S t r . 4 3 1 0 9 9 9 B e r l i n G e r m a n y L u d w i g s t r . 1 8 0 E 6 3 0 6 7 O f f e n b a c h G e r m a n y K r e u z s t r . 1 6 8 0 3 3 1 M ü n c h e n G e r m a n y c / o W e W o r k H e r m a n n s t r a s s e 1 3 2 0 0 9 5 H a m b u r g G e r m a n y i n n o Q S c h w e i z G m b H G e w e r b e s t r . 1 1 C H - 6 3 3 0 C h a m S w i t z e r l a n d + 4 1 4 1 7 4 3 0 1 1 1 A l b u l a s t r . 5 5 8 0 4 8 Z ü r i c h S w i t z e r l a n d
21. L A R S H U P E L C o n s u l t a n t i n n o Q D e u t s c h l a n d G m b H L a r s e n j o y s p r o g r a m m i n g i n a v a r i e t y o f l a n - g u a g e s , i n c l u d i n g S c a l a , H a s k e l l , a n d R u s t . H e i s k n o w n a s a f r e q u e n t c o n f e r e n c e s p e a k e r a n d o n e o f t h e f o u n d e r s o f t h e T y p e l e v e l i n i t i a t i v e w h i c h i s d e d i c a t e d t o p r o v i d i n g p r i n c i p l e d , t y p e - d r i v e n S c a l a l i b r a r i e s .
22. M L P r e - p r o c e s s i n g D e e p e m - b e d d i n g H O L U s e r d e f i n i t i o n s S i m p l i f i e d d e f i n i t i o n s T e r m s E m b e d d e d d e f i n i t i o n s C a k e M L p r o g r a m T e r m c o m p i l e r S i m p l i f i e r i m p l e m e n t e d a s p a r t o f t h i s t h e s i s g r e e n ( c h e c k e r e d : a l r e a d y a v a i l a b l e i n I s a b e l l e ) b l u e s p e c i f i e d b y u s e r r e d g e n e r a t e d o b j e c t