Semantics and application to program verification

TP1 - Denotational semantics

The goal of this session is to program an interpreter to compute the denotational semantics of a simple language.

We will use OCaml.


Start by downloading the package: codeV1.tgz.

The package contains:

Typing make should compile an executable that runs the simple driver.


The language is a very simple "curly brackets" C-like language. A program is composed of a sequence of statements of the form:

Non-standard statements include:

Expressions include:

The operators have their usual precedence, and you can group expressions using parentheses.

You can use /* ... */ and // comments.

Unlike C, variables do not need to be declared; they start existing when first assigned a value, and keep existing until the end of the program. There are no local variables, and no functions.


Variables have no type and can hold either an integer or a boolean value. Subsequently, we do not distinguish statically between boolean and integer expressions: only values have a type. It is an error to use operators with values of the wrong type, such as adding two boolean values. This is detected at run-time, when evaluating the expression in the current environment.

Other run-time errors include: divisions and modulos by zero; using a non-boolean value in tests, loops and assert conditions; using a variable that has never been assigned to; asserting a condition that is false; executing the halt statement.

To avoid having to handle overflows, our integer values will not be represented using machine integers, but as unbounded mathematical integers. You will use the ZArith library, which provides a simple API (similar to Int32) to manipulate unbounded integers.

Deterministic semantics

We first consider the deterministic subset of the language, i.e., we ignore the AST_int_rand expression node for now.

Write an interpreter that executes the program by induction on the syntax of statements and expressions; it returns either an environment mapping variables to values, or an error.

You can use the following steps:

  1. Define the type ival of values. It should contain integers and booleans. Also define the derived type ival_err which represents either a correct value, of type ival, or an error. You can use a string representation for errors, which will give the user some information on the location and cause of the error. The ival_err type will be useful to propagate errors during the evaluation of expressions.
  2. Define a type env for environments. You can use the Map functor from the standard OCaml library to represent mappings from variables to (non-erroneous) values. Likewise, the env_err type shall denote either an environment or an error.
  3. Write an expression evaluation function eval_expr: env -> expr ext -> ival_err by induction on the syntax of expressions.
  4. Write a statement evaluation function eval_stat: env_err -> stat ext -> env_err. When should the function return an error environment?
  5. Test your interpreter on the programs from the examples directory. Can you detect infinite loops in loop.c, loop2.c, and loop3.c? Under which condition does your interpreter terminate?

Non-deterministic semantics

We now consider the full language including the non-deterministic expression node rand(l,h).

Write an interpreter for this language that outputs the set of all possible environments at the end of the program as well as the set of all errors that can be encountered.

The structure of the interpreter will be similar to the one in the previous question. You can use the following steps:

  1. Define a type ival_err_set to represent sets of ival_err objects, i.e., sets containing values and errors. You can use OCaml's standard Set functor.
  2. Define a type env_err_set to represent sets of environments and errors.
  3. Program a function eval_expr: env -> expr ext -> ival_err_set to evaluate an expression in a single environment and return the set of its possible values (and errors) in that environment. When encountering a unary node, the operator must be applied to each possible value of its argument expression; you can use iterators such as fold. Binary nodes require nested fold.
  4. Program a filter function filter: env_err_set -> expr ext -> env_err_set that returns the subset of its env_err_set argument that can satisfy the expression, enriched with the errors encountered during the expression evaluation. This function will be useful to model loops, tests and assertions. Remember that an environment can satisfy both an expression and its negation!
  5. Program a generic fixpoint operator fix: ('a -> 'a) -> 'a -> 'a that iterates a function from a base element to reach a fixpoint. Use it then in the semantics of loops.
  6. Test your interpreter on the examples directory, including non-deterministic programs such as gcd_nd.c and loop4.c.


Here are a few possible extensions you can implement in the language:

Author: Antoine Miné