cakeml VS seL4

If I understand what you are asking about correctly, then I do think you are mistaken.

As a sibling comment observed, you would be proving something about a program, but proving things about programs is both possible and done.

This ranges from things like CakeML (https://cakeml.org/) and CompCert (compilers with verified correctness proofs of their optimizations) to something simple like absence of runtime type errors in statically strongly soundly-typed languages.

Of note is that you are proving properties of your program, not proving them perfect in every way. The properties of your program that you prove can vary wildly in both difficulty and usefulness. A sufficiently advanced formally verified compiler like CakeML can transfer a high-level proof about your source code to a corresponding proof about the behavior of the generated machine-executable code.

> A single IR with multiple passes is a good way to build a compiler

https://mlir.llvm.org/, which is using, is largely claiming the opposite. Most passes more naturally are not "a -> a", but "a -> b". data structures and data structures work hand in hand, it is very nice to produce "evidence" for what is done in the output data structure.

This is why https://cakeml.org/, which "can't cheat" with partial functions, has so many IRs!

Using just a single IR was historically done for cost-control, the idea being that having many IRs was a disaster in repetitive boilerplate. MLIR seeks to solve that exact problem!

You may want to look at [CakeML](https://cakeml.org) done in HOL4, there is also a nice proof pearl about a more .. minimalistic verified bootstrapped compiler also in HOL4.

CakeML

There is also Cake ML which is a formally verified functional programming language compiler and runtime.

There is also a CakeML -> Standard ML compiler though it seems to have been built to translate benchmarks and sort of old so I'm not sure how comprehensive it is: https://github.com/CakeML/cakeml/tree/master/unverified/front-end

> One guess is that lisps cope with being minimal through use of macros and metaprogramming, it's difficult for a typed language to support that level of metaprogramming while maintaining the various guarantees that one wants from such a system.

Difficult, but certainly not impossible [0].

[0] https://cakeml.org/

If this interests you, I'd highly recommend checking out CompCert (docs here) and CakeML.

> People like to snob Unix but the fact is: the world runs on Unix.

The world you are aware of runs on it.

> Can we really do that much better or is it just hubris?

Yes. Have a look at seL4[1] and Barrelfish too[2], even though that's no longer active. seL4 in particular is powering a lot of highly secure computing systems. There is a surprisingly large sphere outside of Unix/POSIX.

[1] https://sel4.systems/

[2] https://barrelfish.org/

There are also RTOS-capable microkernels such as seL4[0], with few but extremely fast syscalls[1]. Note times are in cycles, not usec.

0. https://sel4.systems/

1. https://sel4.systems/About/Performance/

https://sel4.systems

Working on a number of platforms, verified on some. Multicore support is an ongoing effort afaict.

On OS built on this kernel is still subject to some assumptions (like, hardware working correctly, bootloader doing its job, etc). But mostly those assumptions are less of a problem / easier to prove than the properties of a complex software system.

As I understand it, guarantees that seL4 does provide, go well beyond anything else currently out there.

Take a look at this: https://sel4.systems/

It's probably have to be seL4 (https://sel4.systems), running on some fully OSS hardware.

There are question marks over much of available RISC-V chips due to chinese producers, so maybe OpenPower based hardware?

Plus, the entire system (motherboard, etc) would need to be manufactured using a good supply chain.

Hmmm, this has probably all been thought through in depth before by others. :)

You can use it to (mostly) validate small snippets are the same. See Alive2 for the application of Z3/formalization of programs as SMT for that [1]. As far as I'm aware there are some problems scaling up to arbitrarily sized programs due to a lack of formalization in higher level languages in addition to computational constraints. With a lot of time and effort it can be done though [2].

1. https://github.com/AliveToolkit/alive2

2. https://sel4.systems/

Formal methods. This is not in most general-purpose programming languages and probably never will be (maybe we'll see formal methods to verify unsafe code in Rust...) because it's a ton of boilerplate (you have to help the compiler type-check your code) and also extremely complicated. However, formal methods is very important for proving code secure, such as sel4 (microkernel formally verified to not have bugs or be exploitable) which has just received the ACM Software Systems Award 3 days ago.

Today we'd look at seL4.