[Paper Review] Structural Operational Semantics for Control Flow Graph Machines

Dmitri Garbuzov, William Mansky+2 more|arXiv (Cornell University)|May 14, 2018

Logic, programming, and type systems18 references3 citations

TL;DR

This paper establishes a tight, formally verified equivalence between Levy's call-by-push-value (CBPV) calculus and a control flow graph (CFG) machine operating in static single assignment (SSA) form. By aligning structural operational semantics (SOS) transitions of CBPV with CFG execution steps, it demonstrates that SSA CFGs are equivalent to CBPV terms, enabling equational reasoning and formal verification of low-level optimizations via higher-order language theory.

ABSTRACT

Compilers use control flow graph (CFG) representations of low-level programs because they are suited to program analysis and optimizations. However, formalizing the behavior and metatheory of CFG programs is non-trivial: CFG programs don't compose well, their semantics depends on auxiliary state, and, as a consequence, they do not enjoy a simple equational theory that can be used for reasoning about the correctness of program transformations. Lambda-calculus-based intermediate representations, in contrast, have well-understood operational semantics and metatheory, including rich equational theories, all of which makes them amenable to formal verification. This paper establishes a tight equivalence between (a variant of) Levy's call-by-push-value (CBPV) calculus and a control flow graph machine whose instructions are in static single assignment (SSA) form. The correspondence is made precise via a series of abstract machines that align the transitions of the structural operational semantics of the CBPV language with the computation steps of the SSA form. The target machine, which is derived from the CBPV language, accurately captures the execution model of control flow graphs, including direct jumps, mutually recursive code blocks, and multi-argument function calls, and the closure-free subset is similar to the SSA intermediate representations found in modern compilers such as LLVM and GCC. The definitions of all the language/abstract machine semantics and the theorems relating them are fully verified in Coq.

Motivation & Objective

• Address the lack of compositional, equational reasoning for control flow graph (CFG) programs used in compilers.
• Overcome the limitations of CFGs in formal verification due to non-compositional structure, auxiliary state, and weak equational theories.
• Establish a formal bridge between well-understood higher-order operational semantics (CBPV) and practical low-level intermediate representations (SSA CFGs).
• Enable machine-checked proofs of correctness for CFG-level optimizations using the rich equational theory of CBPV.
• Provide a foundation for verified compilation by showing that SSA CFGs are equivalent to CBPV terms in a way that preserves all observable behaviors.

Proposed method

• Define a variant of Levy's call-by-push-value (CBPV) calculus with structural operational semantics (SOS) for compositional, equational reasoning.
• Design a virtual machine that executes instructions in static single assignment (SSA) form, modeling direct jumps, multi-argument function calls, and mutually recursive code blocks.
• Construct a chain of intermediate abstract machines to gradually separate statically computable reductions from dynamic execution steps.
• Prove step-for-step correspondence between CBPV SOS transitions and CFG machine execution steps using a series of formal derivations.
• Fully verify all semantic definitions and equivalence theorems in Coq, ensuring machine-checked correctness.
• Demonstrate that every well-formed SSA CFG corresponds to a CBPV term, and vice versa, via a bijective translation preserving operational behavior.

Experimental results

Research questions

• RQ1 Can a formal, compositional operational semantics for control flow graphs be established using higher-order language theory?
• RQ2 Is there a precise, machine-checkable correspondence between the structural operational semantics of CBPV and a CFG machine in SSA form?
• RQ3 Can program transformations on SSA CFGs be formally verified by reasoning about their corresponding CBPV terms?
• RQ4 Does the equivalence between CBPV and SSA CFGs support a robust equational theory for reasoning about optimization correctness?
• RQ5 Can the closure-free subset of the CFG machine accurately model modern compiler IRs like those in LLVM and GCC?

Key findings

• A tight, formally verified equivalence is established between CBPV’s structural operational semantics and a CFG machine in SSA form, with each step in the CBPV reduction corresponding exactly to a machine instruction execution.
• The closure-free fragment of the CFG machine is isomorphic to SSA intermediate representations used in modern compilers such as LLVM and GCC.
• All optimizations applied to the CFG, including constant folding, dead code elimination, and identical branch simplification, are formally proven correct via the underlying CBPV equational theory.
• The correspondence is stronger than compiler correctness: it preserves all observational equivalences, not just trace equivalence or bisimilarity.
• The translation from CBPV terms to SSA CFGs is bijective, meaning every well-formed CFG corresponds to a unique CBPV term and vice versa.
• The entire formalization, including semantic definitions and equivalence theorems, is fully verified in Coq, enabling machine-checked proofs of program transformation correctness.