Automated verification of termination certificates

Making sure that a computer program behaves as expected, especially in critical applications (health, transport, energy, communications, etc.), is more and more important, all the more so since computer programs become more and more ubiquitous and essential to the functioning of modern societies. But how to check that a program behaves as expected, in particular when the range of its inputs is very large or potentially infinite? To express with exactness what is the expected behavior of a program, one first needs to use some formal logical language. However, as shown by Godel, in any formal system rich enough for doing arithmetic, there are valid formulas that cannot be proved. Therefore, there is no program that can decide whether any property is true or not. However, we can have a program that decides whether any proof is correct or not, and the present work will use in an essential way such a program, namely Coq, to formally prove the correctness of some particular program. An important program property, especially in systems with strong time constraints, is termination: will the program always provide an answer? (Un)fortunately, as shown by Turing, termination is not decidable: there is no Turing-machine that, for any pair (p; i) made of a finite program description p and a finite input i for p, can tell in a finite amount of time whether p terminates on i or not. This led to the development of many different heuristics and tools (e.g. AProVE, TTT2, . . . ) for trying to prove the termination of programs. In particular, term rewriting theory, introduced by Knuth as a tool for deciding algebraic equational theories, provides a general framework for studying program termination with applications to concrete programming languages like Prolog, Haskell, Java, . This is the framework that we will consider in this work. But, in turn, how to guarantee that a program implementing such a heuristic is correct? One way to break this vicious circle relies on the fact that, for a given problem, checking that a solution is correct is usually easier than finding such a solution, because the latter involves some back-tracking mechanism while the former only requires blind computations. Hence, we can imagine the following scenario: modify the tool so that it does not only answer YES or NO, but also outputs some data, called certificate, that can be used to verify the correctness of the answer; and design these certificates in such a way that their verification is amenable to a complete formalization and correctness proof. Althought it seems to only move the problem from one program to another, the certificate verifier, there is in fact a gain in complexity. For instance, finding a boolean assignment satisfying some boolean formula (SAT problem) is (in the worst case) exponential in the number of boolean variables, while verifying the correctness of a given assignment (the certificate) is linear in the size of the formula. This is the approach that various automated provers for the termination of firstorder term rewrite systems started to adopt in 2007. A common formal language, CPF (Certification Problem Format), has then been designed for representing termination certificates, and certificate verifiers started to be developed: Rainbow, CiME3 and CeTA. In this work, we explain the development of a new, faster and formally proved version of Rainbow based on the extraction mechanism of Coq. The previous version of Rainbow verified a CPF file in two steps (see Figure 1.1). First, it used a non-certified OCaml program to translate a CPF file into a Coq script, using the Coq libraries on rewriting theory and termination CoLoR and Coccinelle. Second, it called Coq to check the correctness of the script. This approach is interesting for it provides a way to reuse in Coq termination proofs generated by external tools. This is also the approach followed by CiME3. However, it suffers from a number of deficiencies. First, because in Coq functions are interpreted, computation is much slower than with programs written in a standard programming language and compiled into binary code. Second, because the translation from CPF to Coq is not certified, it may contain errors and either lead to the rejection of valid certificates, or to the acceptance of wrong certificates. Moreover, the data type used for representing certificates internally and the parsing function used to create a value of this data type from a text file are written by hand. This is a possible source of errors and is time-consuming. To solve the latter problem, one needs to define and formally prove the correctness of a function checking whether a certificate is valid or not. To avoid the problem of parser, one can develop a simple compiler for generating a Coq data type definition for representing XML Schema data types, and an XML parser for CPF. To solve the former problem, one needs to compile this function to binary code. The present work shows how to solve these two problems by using the proof assistant Coq and its extraction mechanism to the programming language OCaml. Indeed, data structures and functions defined in Coq can be translated to OCaml and then compiled to binary code by using the OCaml compiler. A similar approach was first initiated in CeTA using the Isabelle proof assistant.