Pleasant Imperative Program Proofs with GallinaC

2025-09-16

AI Summary

Real-world imperative languages feature permissive semantics, making mechanized correctness proofs laborious and error-prone. To address this, we propose GallinaC—a semantically well-defined, proof-friendly imperative language shallowly embedded in Rocq’s Gallina. It supports Turing completeness and truly generic unbounded while loops. Our approach bridges imperative programming conventions with formal verification requirements: it reuses Gallina’s functional core to inherit proof techniques for pure functional programs—enhancing maintainability—and integrates forward simulation to formally connect GallinaC’s intermediate representation with CompCert’s Cminor backend, enabling machine-checked end-to-end verification. A prototype has successfully discharged a fully automated correctness proof for reversing an arbitrarily long linked list, demonstrating feasibility. Current work focuses on constructing and verifying the forward simulation relation between GallinaC and Cminor.

Technology Category

• Knowledge Representation and Reasoning: Automated Reasoning and Theorem Proving
• Constraint Satisfaction and Optimization: Satisfiability Modulo Theories
• Reasoning under Uncertainty: Stochastic Optimization

Application Category

• Semantics and Knowledge: Data modeling to support human-machine intelligence, including LLMs agents, intelligent system behavior, explanations, and user-friendly interactions
• Security and Privacy: Data transparency and provenance
• Economics, Online Markets and Human Computation: Cost models of using LLMs in production systems

Abstract

Even with the increase of popularity of functional programming, imperative programming remains a key programming paradigm, especially for programs operating at lower levels of abstraction. When such software offers key components of a Trusted Computing Base (TCB), e.g. an operating system kernel, it becomes desirable to provide mathematical correctness proofs. However, current real-world imperative programming languages possess "expressive", i.e. overly permissive, semantics. Thus, producing correctness proofs of such programs becomes tedious and error-prone, requiring to take care of numerous "administrative" details. Ideally, a proof-oriented imperative language should feature well-behaved semantics while allowing imperative idioms. To obtain a high-degree of confidence in the correctness of such a language, its tools should be developed inside a proof-assistant such that program proofs are machine checked. We present GallinaC, a shallow embedding of a Turing-complete imperative language directly inside the functional programming language of the Rocq proof assistant, Gallina. In particular, it features a truly generic and unbounded while loop. Having a functional core means proofs about GallinaC programs may use the same tactics as proofs about pure functional ones. Work on GallinaC is still under progress, but we present first promising results. A prototype implementation has shown the viability of GallinaC with the correctness proof of a list reversal procedure for linked-lists of unknown size. We currently focus on the forward simulation between the GallinaC intermediate representation (IR) and Cminor, the entry language of the CompCert back-end.

Problem

• Developing a proof-oriented imperative language with well-behaved semantics
• Providing machine-checked correctness proofs for imperative programs
• Enabling mathematical verification of low-level system software components

Innovation

• Shallow embedding of imperative language in Gallina
• Generic unbounded while loop for Turing-completeness
• Using same proof tactics as functional programs