Safe external calls from formally verified functional code: exiting the monad, and a BDD case study
Résumé
It is commonplace, when developing formally verified programs in a proof assistant, to have these programs make external calls to unverified code, for instance for I/O or expensive computations that can be implemented more efficiently and more easily in a general-purpose programming language.
Is this practice safe? In this paper, we discuss issues arising from the assumption that all constructs are functional and deterministic, which may not be the case of external code. We argue that (a) much external functionality, including computational oracles and hash tables, can be wrapped in a "may return" monad (b) many desirable properties are simply ensured by the type safety of the external code. As working permanently in a nondeterministic monad is cumbersome, and absurd if a result is actually deterministic, we introduce a "deterministic exit" monadic operator.
We illustrate this with the example of a library for computing over BDDs (binary decision diagrams).
Domaines
Informatique [cs]Origine | Fichiers produits par l'(les) auteur(s) |
---|