ANR PML

Context and positioning of the proposal

Ever since FORTRAN appeared fifty years ago, programming languages have been evolving rapidly. These languages now include more and more sophisticated concepts like "objects", "type inference", "modules"... However, this richness is also what makes it more and more complex to train programmers and makes it difficult for them to keep up with the innovations and changes in programming languages.

Another orthogonal phenomenon is the emergence of formal methods used in conjunction with various programming languages to test, check or prove software. This introduces another layer to languages in order to write specifications, and sometimes yet another one for proofs. Learning a programming language together with the associated specification/proof languages can take an important effort.

Projects such as ACL2, the successor of nqthm, the Boyer-Moore theorem prover uses a rather simple language (namely LISP) both as a programming language and specification language, allowing to keep a unity in the system. Unfortunately, LISP is somewhat limited both as a programming language (no good treatment of sum type, no module system) and a specification language (very limited quantification). Moreover, LISP has no compile-time type-checking, which has proved very useful to detect bugs and automatically assert properties.

The aim of this project is to build a very powerful language (with no loss of expressive power compared to state of the art languages) based on a very small number of simple features. We think this will be possible thanks to recent progress both in the semantics of programming languages and the apparition of new algorithms for type inference based on constraints-solving. In fact, we propose in [RAF10b] an innovative concept derived from the later to enable this: constraints-checking.

Moreover, the language will be used not only as a programming language and a specification language (like in ACL2), but also as the proof language. This is natural for an ML-like language because pattern-matching is a natural and powerful way to make a proof by case analysis. This also means that our tool will follow the KISS philosophy: relatively few (unified) features, yet powerful.

The idea of a new language arose from the discovery of a new typing algorithm [RAF10b] whose implementation gave birth to a first implementation of PML (Proved ML) by Christophe Raffalli. This implementation is already available from the web page of the language. However, turning PML into a real tool requires a lot of research and implementation work and this is why we request the help of the ANR. Some of the goals are highlighted in the next sections.

PML aproach to proofs of specification is unique PML has no dedicated proof language, but the user can still write proofs! Existing programming languages supporting specifications use two alternative: automated proofs (ACL2, Why) or proof obligation that the user can prove using specific language (Coq extraction, Focalize, Why). Several systems provide both, the manual proofs being used only when automation fails. PML is very different in spirit: it introduces a new instruction, written with a "scissors symbol" 8< to express that the corresponding position in the program is dead, meaning that it can not be reached during evaluation. This condition is checked by a terminating variant of the Knuth-Bendix completion algorithm. This is rather simple and therefore easier to trust than modern decision procedures. However, it only solves trivial cases: to write complex proofs, the user just uses the same syntax as for programs to do case analysis or induction (ie. recursive definitions). This means that the user needs not learn a specific proof language and hopefuly imples that PML is easier to learn and probably more adapted to industry that previous solutions.

The logic of PML is just the equational theory of its programming language; and we use variants of Knuth-Bendix completion as a proof-checker. The first experiments with the current implementation are promising. However, Knuth-Bendix procedure in the context of ML is a complex and new research problem. A lot more work is needed, for instance to handle proof in arithmetic which occur quite often. Here is an example of a proof in arithmetic, checked in the current version of PML. This not completely satisfactory (hard to write), but shows the use of a language for both proofs and programs and the use of recursive functions for inductive proofs:

 val rec mul_associative x y z |- (x * y) * z == x * (y * z)
   proof match x with
     Z[] -> 8< (* trivial case handled automatically by Knuth-Bendix *)
   | S[x'] ->
     let _ = mul_associative x' y z in (* There is a syntactic sugar for that... *)
       (* this adds the fact that (x'*y) * z == x' * (y*z) to the environment *)

     let _ = mul_right_distributive y (x' * y) z in
       (* this adds the fact that (y + x'*y) * z == y*z + (x'*y)*z *)

       (* the environment now contains enough information for Knuth Bendix to handle the rest:
        *    - x*(y*z)  ==  y*z + x'*(y*z)  : by definition
        *    - x*y == y + x'*y : by definition
        *      and so (x*y)*z == (y + x'*z)*z
        *    - (x'*y) * z == x' * (y*z)  :  by the recursive call to mul_associative
        *    - (y + x'*y) * z == y*z + (x'*y)*z : by the call to mul_right_distributive  *)
     8<

Moreover, this style of proof is declarative and relatively readable (like Mizar proofs) while concise at the same time. This is very important when you want to maintain large developments.

PML is different from the other modern programming languages because its design focuses on a few powerful concepts. One consequence is that it is more difficult for a compiler to produce efficient code. In particular, since PML unifies several notions of products (modules, tuples and records), there is no simple way to choose the internal representation of a product, especially with implicit subtyping. Writing a good compiler for PML will thus require more complex optimization schemes (probably driven by typing) than languages like OCaml or Haskell. A Polish student (Wojciech Matyjewicz) is just starting a PhD on this very topic.

Here is a simple example, accepted by the current version of PML, demonstrating product type, sum type and subtyping. We define ternary trees as an extension of binary trees with an implicit subtyping relation (all functions accepting binary_trees will accept ternary trees, by ignoring the middle_son):

type rec binary_tree (A) =
  [ Nil[] | Node[A with val left_son : binary_tree(A) val right_son : binary_tree(A)] ]
type rec ternary_tree(A) =
  binary_tree({ A with val middle_son : ternary_tree(A)})

PML requires a termination criterion because a proof by induction will just be a normal recursive program. Such a program has to be well-founded in order to correspond to a valid proof. A subset of Haskell can now use the Aprove tool to establish termination for simple programs. However, we want the test to be fully integrated with the language, and be compatible with very modular programs. At the moment, these goals seem difficult to achieve with Aprove or other external termination checkers. A first termination criterion based on Lee, Jones & Ben-Amram's "size-change termination principle" was implemented by Pierre Hyvernat [Hyv10b]. While this test is quite powerful, it is necessarily incomplete, and quite some work is required to make termination proofs of complex programs tractable.

Scientific and technical description

Background, state of the art

Programming language

The ML programming language, created by Robin Milner et al in the 80's has two major distinctive features:

• Algebraic data-types and pattern matching: data types are basically all constructed using fixpoint, cartesian product (product types) and disjoint union (sum types).
• Static type inference: the type of every piece of code is automatically inferred using Hindley-Milner algorithm (HM). By by construction, once compiled, an ML program can not crash (no segmentation fault). More precisely, when we do not use unsafe features of the language (like interface with unsafe libraries written in C), if an ML program produces a segmentation fault, then there is a bug in the type-checker or the compiler.

Recent progress in type inference algorithm uses constraint solving. This means that the type system can be described in first-order predicate logic in such a way that a type inference problem is a formula written in a decidable fragment of first-order predicate logic (often the purely existential fragment). Hence, any constraint solver can be turned into a type-checker for ML. These approach is known as HM(X) (see [SOW97]).

There are two problems with this approach:

• The complexity of constraint solving can be too high for practical use, especially when using a general purpose constraint solver. To our knowledge, there are currently no mainstream implementation of ML based on HM(X).
• HM(X) does not completely solve the problem of subtyping. The language to express the types constructed by the constraint solver is the same as the language of types used by programmers. With constraints $\alpha \subseteq \beta$ and $\alpha \subseteq \gamma$ for three types $\alpha$, $\beta$ and $\gamma$, the most natural solution is $\alpha =\beta \cap \gamma$. This implies that intersection needs to be part of the language for types. This means that constraints such as $\beta \cap \gamma \subseteq \delta$ may also appear and they are problematic to deal with. Similar reasoning shows that constraints of the form $\beta \cap \gamma \subseteq \beta '\cup \gamma '$ may appear, increasing the complexity of constraint solving by an exponential factor.

PML's approach is to replace type-inference by constraint checking rather than constraint solving: we only check that the constraints are satisfiyable in some model. Type-checking in the current implementation of PML can be seen as a black box ensuring that nothing can go wrong during execution. Moreover, since we do not need to write solutions for the constraints, the language for types can be relatively simple. In fact, the types written by the programmer aren't even the actual type constraints that are checked: they are syntactic sugar for the projection operator onto the intended type (giving for free nice feature like higher-order parametric types, that is types with parameters which may be themselves types with parameters). In other words, the expression x:nat is a synonym for (id_nat x) where

 val rec id_nat x = match x with
     Z[] -> Z[]
   | S[x'] -> S[id_nat x']

is defined internally by PML. The constraint generated by x:nat mean exactly that x is of type nat...

With this approach, we loose type-inference and the ability to display types in error messages. Nevertheless, PML error reporting is quite helpful because, in case of problem, it displays three positions in the code and an error message like this error at position 1, label "id" projected at position 2 do not appear in the value constructed at position 3. This kind of error message is in fact of bounded length and often more useful than OCaml or SML messages. We can understand this as showing three points in the slice of the error, as introduced by Joe Wells in [HW04].

Proof assistant

Proof assistants have evolved rapidly since Automath in the 70th. Two main trends coexist: automated proof assistants such as ACL2, PVS and safe ones such as Coq, Isabelle, PhoX, Lego, HOL, Matita, etc. The former incorporate very sophisticated automated deduction strategies, with no certificate for the validity of the proof, while the later require all proofs to be done in a specific framework (like natural deduction or type theory) allowing for a simple check of the proof. The gap between the two approaches tend to be reduced by the emergence of complex tactics (for Coq or Isabelle mainly) which build proofs for the user. For instance Zenon is an advanced automated first-order theorem prover outputing a Coq proof.

The common defect of all these proof assistants is that a proof can not be written nor understood without running the proof assistant. Some proof assistants such as Mizar or Alf do not follow exactly the above scheme: Mizar has a declarative style for proof which is (in theory) readable by a human and checked by a limited checker. (This proof style has been adapted to Coq and Isabelle.) Unfortunately, there is no formal description of the Mizar proof checker. Alf on the other hand is based on proof theory and requires the user to basically write the complete proof tree just leaving out a few details. The logic is very well formalized and simple, but writing proof is tedious and not similar to the usual practice of informal mathematics.

This picture of the world of proof assistants shows that some fundamental work is needed. In the current version of PML, the logic is just an equational theory of the underlying programming language. This is easily described formally. The proof engine is, like in Mizar, a limited automated checker inspired by the Knuth-Bendix completion algorithm (KB). The completion algorithm used in PML had to be adapted to the higher-order constructs of ML-like languages and restricted to ensure termination and an acceptable complexity. The current limitation is probably too strong: it is limited to closed terms and cannot use universal theorems automatically (as in the first example of section 1, where one has to give explicitly the argument to use distributivity).

Nevertheless, preliminary examples in the current version shows that the approach is worth trying: proofs are concise and readable once you know the language. A very encouraging point is that all examples where written without interface. This really means that proofs are readable without the help of a computer.

Rationale highlighting the originality and novelty of the proposal

The final objective of our project would be a full PML compiler, bootstrapped and completely proved with itself (full bootstrap). This does not exist for any language and is far too ambitious for a four years project. More realistically, we plan to produce a compiler for PML, written in PML, but not proved in PML yet.

We also want to develop proof-checking in such a way as to allow very elegant proofs, supporting the feasibility of a full bootstrap by various examples, some of them being near to industrial application, some others being algorithms coming from implementation of programming languages.

We have focused the existing development on the quality of the language both for proofs and programs. By quality, we mean easy to understand and write (and therefore, easy to learn). We think that using the programming language as a proof language could make formal methods more attractive to the industry without the defect of systems like PVS and ACL2 where the automated tactics replace the need for a proof language, but are sometimes hard to control and use. For instance, finding the right lemmas to make a proof possible in ACL2 is quite difficult.

Comparison with other proof systems devoted to programming. Many other proof systems have been used or specifically developed to allow the production of certified code: extraction in Coq, Why with its automated prover Who from the Proval project, Focalize, PVS, ATS, ... None of these system uses the programming language as a proof language. They all have a dedicated language for proofs and even if some of them like Focalize or Coq extraction using a Mizar style mode for proof, have readable proofs, learning the proof language is never trivial. Other systems like PVS, ATS, Why using Who rely on automated deduction. In those cases, the behavior of the automated prover is always hard to predict.

Another selling point is that the logic and programming language are fully integrated. This is not a two level systems like most systems (but not all, ACL2 for instance is fully integrated). In PML, the statements of theorems and their proofs are expressions at the same level than programs. This means that a program can contain specifications that contains program definitions in their statement or proof and so on. This is generally not possible (even in ACL2) and makes it possible to write modules with their specifications.

On of the key idea for this project is that any ML-like programming language has all the features needed for a proof language: case analysis via pattern matching and exception handling, induction, calling previously defined program/theorems. This means that it is natural to explore this direction.

Comparison with other programming languages. Another key idea in PML is to develop the language and its proof-checker together. This has a great impact on the design of PML. Let's illustrate this with a concrete example: exception handling. In ML, there is a

 try P with e -> R

but, this is not sufficient to do case analysis on the fact that a program P raises or not an exception. In particular, R can be the proof just in case P raises an exception. However there is no place holder for the normal case (without exception). This is why we had to introduce a

 let try x = P in Q with e -> R

where R is evaluated only when P reduces to a value.

A great number of decisions on the language design comes from the interaction between the development of the programming language and its proof-checker. Another key feature of PML, which makes the project original even as a programming language compared to many other projects of programming language research (GALLIUM, Haskell, Scala, ...) is the use of constraint checking. This choice arises from the fact that we want a language as small as possible, because a proof-checker is complex and therefore, we want to fully unify all sorts of Cartesian product including modules, records, tuples and variant with multiple argument. This is already achieved in the current implementation of PML and to my knowledge, no ML like language have a unique but still powerful notion of Cartesian product.

All the systems previously mentioned allow to prove programs in limited subsets of existing languages like ML or Haskell. The prover has to find ways to deal with those languages' defects rather than improve them...

Scientific and technical program, project management

Specific aims of the proposal

As said in the previous section, the final objective would be to have a fully bootstrapped PML language: this would mean that PML is entirely written and proved in PML. This would be too ambitious at first, and we chose to focus here on the design of the language plus a proof of concept, that is compilation and proof of various examples, searching to do our best on the following points:

• Natural way of writing programs (Task 1)
• Efficiency of the code generated by the compiler, despite the heavily use of subtyping (Task 3)
• Readable and short proofs (Task 1, Task 4)
• Efficiency of type-checking and compilation (Task 2 and 6)
• Efficiency of proof-checking (Task 4 and 6)
• All of the above points need testing, and we created a transverse fifth task for that.

Project management

We plan to have one 3 days workshop per year with all the members of the project, invited speakers and interested outsiders. We think these meetings are fundamental to keep the project running, inform everybody of the project progress and problems. We already have the agreement of some people to participate in such meetings: Joe Wells, Assia abouby, Andras Abel, ... We plan to have one 3 days meetings per year with all the members of the project, invited speakers and interested outsiders. We think these meetings are fundamental to keep the project running, inform everybody of the project progress and problems.

We will also organize two project meeting per year, just to keep track of progress, share idea and organize the above workshop and other invitation.

We want also to organize visits of one or two members of the project to visit researcher on similar topic (typically a member of the project could visit one of the invited speaker of our workshop). Members of the project should also travel to conference on the subject like POPL, LICS, CSL, TYPES or the recently created CPP (first conference in 2011).

Detailed description of the work organized by tasks

Task 1 - theoretical work, design of the language

Coordinator: Christophe Raffalli

Participants: Pierre Hyvernat, Alexandre Miquel, Tom Hirschowitz

1.a - Correctness of the constraint checking algorithm (delivered 09/2012): [RAF10b] already cover the correctness without polymorphism. A draft version of the correctness proof with polymorphism do exists but needs more work. The main open problem here is the interaction with the termination-check. The current work proves that when constraints are checked, the program can only loop via recursive definitions. Then, we would like to prove that the program are terminating if recursive definitions are accepted by the termination checker. However, this is non trivial.

This being one of the central piece of PML, it should be also one of the first test for PML in task 5. We could also prove this part of PML in Coq (in fact 2 provers proving themselves and each other correct is a much stronger warranty than one prover proving itself).

1.b - Consistency of proof-checking (beginning 09/2011, delivered before 09/2013 for the core of the language): This is essential for clearly defining the logic of PML and prove its consistency. This should not be too hard for the core of the language. However, this proof has to be extended to take into account all future extensions of the language and could be seen as a permanent task.

1.c - Adaptation of the uniqueness typing to the context of constraint checking (beginning 09/2012, delivered 01/2014): The current version of PML is a pure functional programming language, with no imperative feature. This is problematic, because input/output are necessary for real programs and affectations are required for efficiency especially when using large arrays. We plan to adapt the approach of the Clean language [AGR92], [AcP95], [AcP97], [VPA07]. In Clean, all programs can be analyzed as purely functional programs, but the type system can check that some data are not used any more and reuse the place in memory for other data (allowing affectation). For instance, in such a context writing in a file f can be written as let f' = write f str in ..., but the compiler must check that f will not be used anymore implying the equivalence between the standard imperative semantics of writing to file and the purely functional semantics used by proofs.

1.d - Private, abstract and existential types. (beginning 09/2011, delivered 09/2012 for private type, beginning 09/2012, delivered 09/2013 for existential type and beginning 09/2013, delivered 09/2015 for abstract types)

Abstract data types hides the definition of a data type and allow the user of a library to be sure that his code will continue to work event if the internal representation of data are changed. In the context of constraint-checking in PML, adding abstract data types seems to be a challenging task. Moreover, abstract data-types is a form of existential quantification over types and could raise some consistency issues. We hope to find a way to incorporate abstract types in PML without loosing coherence.

A first step would be private data types. They are a very simple yet very powerful mechanism for easily ensuring invariants on all the values of a data type. This mechanism is as follows: the compiler simply checks that the constructors of a data type are not used for constructing values. Values are constructed by using construction functions like with abstract data types. However, unlike with abstract data types, constructors can still be used as patterns for defining functions by pattern-matching. Hence, a library on a private data type is not closed but can be extended easily. Private data types are therefore an important and very useful feature for defining data structures with complex invariants and proving their correctness more easily. They have been implemented in OCaml by Pierre Weis and are described in Frédéric Blanqui, Thérèse Hardin and Pierre Weis ESOP'07 paper [BHW07].

A second step would be existential types, which are very similar to abstract types, but with no free name for the abstract type. On a logical level, they do imply an existential quantification of type which has to be limited to ensure consitency. However existential types do not require the type to have a free name, which corresponds in logic to a definite description operater (similar to the Hilbert epsilon operator) which being connected to the axiom of choice (over types) may be really problematic for consitency. Some work related to this exists in the phd thesis of F. Ruyer a former student of C. Raffalli [Ruy06].

Task 2 - termination

Coordinator: Pierre Hyvernat

Participants: Christophe Raffalli, Andreas Abel, Frederic Blanqui

Remark: this is an essential task, running during the 4 years. There will always be some embarrassing examples that do not work, but could work... both for the core and auxiliary criterion (see below for the distinction) meaning that this research field will remain open forever.

Even if it might be counter-intuitive at first, it is often necessary to write programs whose execution can be infinite. For example, any kind of "server", or almost any interactive program might have infinite executions. Even in purely mathematical setting, it can be interesting to have intermediary non-terminating functions. Consider a function outputting the stream of prime numbers : even if this function is non-terminating, we might use it in a terminating manner in a proof by requesting the n first prime numbers.

Since PML uses full recursion (keyword rec), writing such programs is easy. On the other hand, the notion of "terminating", or "well-founded" recursive function isn't part of the core of PML: such programs are just special cases of recursive programs. The user will have to specify which functions are in fact terminating and might have to prove it himself when PML cannot infer termination automatically.

Proofs of specifications are just PML programs, and those cannot be allowed to run infinitely. More precisely, even if proof will never be run at all (no computational content), they are required to be well-founded. The consistency of PML relies on this. In order to relieve the user from proving that all proofs are in fact terminating, PML should offer a way to check automatically that (some) functions are terminating. Because the halting problem is undecidable, it is hopeless to do that in all generality, but this is seldom necessary: many proofs terminate for obvious reasons. PML should only work for most of the functions, most of the time (rather than work for all the functions, all the time...)

Technically speaking, PML can infer an error called Loop when it encounters a program which, it thinks, may not terminate. Such an error cannot be captured: this is an error rather than an exception. The property we need to guarantee is that if PML doesn't infer the error Loop possible, then the program in question does indeed terminate. If the error Loop is possible for a terminating function, the user can still provide PML with a proof that this error is never raised. PML current syntax for that is [p proof ... ] where p is a term and ... is a proof that p doesn't raise any exception nor error (this is the desired property for proofs).

2.a - Core termination criterion (delivered 09/2010)

This first test is now part of PML. Since primitive recursive function isn't enough in practice, even for proofs, a subtler and more powerfull termination criterion has been implemented. This is an extension of the "size change principle" of Lee, Jones and Ben-Amram [LJ01]. This test successfully checks termination for primitive recursion, lexicographic ordering and permutation of arguments and thus covers most simple practical cases. The implementation is quite similar to the original size-change principle, but the proof of correctness is surprisingly more difficult: see [Hyv10b].

2.b - Improvement of the core termination criterion (beginning 01/2011, delivered 03/2012)

The size-change principle is simple and powerfull, but many cases occuring in practice aren't tagged as terminating. We plan to adapt to PML a termination criterion based on the technique of type-based termination, which allow for recursive calls through size preserving functions such as List.map. There are several possibilities, ranging from very simple systems such as the one developed by Abel (RAIRO'04) [Abel04], Barthe et al (MSCS'04) [Bar04] or Blanqui (RTA'04, CSL'05) [Bla04, Bla05c], to the very rich system of Blanqui and Riba (LPAR'06) [BlR06]. In the latter, given for each function some formula in Presburger arithmetic describing how the size of the output is related to the size of the inputs (the correctness of which can be checked automatically), the termination follows from the fact that recursive calls are done on strictly decreasing arguments, using for instance lexicographic or multiset comparisons together with linear combinations of the arguments. Intermediate systems, such as the one of Barthe, Grégoire and Riba (CSL'08) [BGR08] which is powerful but with a lower complexity than Presburger arithmetic, have also to be considered.

This developpment looks rather orthogonal to the implemented criterion and might require small modification of other parts of PML in order to get the appropriate information. On a different level, slight extensions should be added to the existing criterion to enhance its complexity on some specific examples that are recognized as termination, but not in a reasonable time.

This core termination needs to reach an acceptable compromise between power and simplicity. In particular, the most complex developpments may not find their way into the core termination criteria, but rather be used in the next task...

2.c - develop external termination criterion (beginning 03/2012, delivered 09/2013)

Here, we want to be able to allow the use of any possible kind of termination checker. The first goal is simply to rely on some external tool asserting (or not) the termination of a PML piece of code. This is relatively easy as it is enough to output a version of the function in a language accepted by the termination checker.

Ideally, the next step is then to transform the original piece of PML into an extended version (by adding argument for example) which is accepted by the core termination checker. To do this, one idea is to extend the CoLoR and Coccinelle platforms which basically do a similar task for Coq. This adaptation might be difficult mainly because the proof languages of PML and Coq are very different. However, the fact that we can use the core criteria, rewrite programs, produce proofs... offers many possibility that are not present in Coq. Moreover, the equational nature of PML's proof-checking may be well adapted for this task.

Among the possible tests we are planning we can cite:

• The higher-order recursive path ordering, developed by Jouannaud, Rubio and Blanqui (LPAR'07) [BJR07] for automatically proving the termination of higher-order rewrite systems.

• The techniques developed by Giesl et al for automatically proving the termination of Haskell programs by using the powerful state-of-the-art termination techniques developed for rewrite systems (RTA'06) [Gie06] and implemented in Giesl et al automated termination prover Aprove (winner of the last termination competition).

Of course, the casual user could simply accept that the external tool is correct and not care about checking internally that his program is terminating. This might well be the only solution for advanced termination checker...

Task 3 - compilation

Coordinator: Christophe Raffalli

Participants: Pierre Hyvernat, Wojciech Matyjewicz, Tom Hirschowitz

3.a - A first compiler using LLVM (beginning 12/2010, delivered 1/2012) LLVM is a compiler infrastructure providing many tools: compilation strategy, virtual instruction set, compiler infrastructure, tools to write high level virtual machines, etc. LLVM is very attractive, because it is rather simple to use (it even has an OCaml interface) and can compile for a bytecode interpreter, can be used as a JIT compiler or a standard compiler. Moreover, it support a lot of platforms. It also provide some optimizations, which is important. We think that writing a compiler, with no optimization, for PML using LLVM should not be too hard (this is important that this task be easy, because this is not really research ...)

A polish phd student Wojciech Matyjewicz has started to work on this in december. He visited the LAMA during one week to start the project. It is important to note that he is a first year phd in Poland and the first year there is equivalent to our Master 2. Which means that Wojciech Matyjewicz is a potential candidate.

Then, we would like to improve our compiler in various direction. We mention here the ones that are innovative in this domain (we should also consider more standard optimization, but we do not mention them specifically).

3.b - Representation of cartesian product and disjoint sum (beginning 12/2010, delivered 1/2012 for product) PML allows only one kind of cartesian product which in general (because of multiple inheritance and implicit subtyping) must be represented as a table (hash-table or maps based on binary search trees). These can impact performance. We plan to generate extra constraints for each occurrence of a constructor of a cartesian product in a program. Then, solving this constraint in a way that maximize speed (or size) should allow for a representation of cartesian product that is more efficient than using, for instance, OCaml. The same kind of optimization (with a different optimization criterion) should be done for sum types and the implementation of pattern matching. This optimisation should be included in the first compiler because the implentation with tables is too costly for a temporary solution.

3.c - Unboxing (depends on some parts of 3.b, beginning 1/2012, delivered 1/2013) In general, 32 bits integer and floating point number are boxed (that is represented by a pointer). This allows a more elegant language. This can lead to major impact on performance especially when arrays are involved. We think that constraint-checking is a good framework to propagate type information and allow efficient unboxing. Nevertheless, doing enough unboxing to try to match the performance of low level languages like C is very hard. We hope that we can reuse some of the work of task 3.b, because unboxing can be seen also as the optimization of the representation of a cartesian product with only one field.

3.d - compilation of affectation (reference and arrays) and IO (depend upon 1.c, beginning 03/2012, delivered 09/2013) After adapting uniqueness typing to PML (task 1.c), we will be able to compile affectation and IO imperatively as in any imperative programming language.

Task 4 - Automated reasoning

Coordinator: Christophe Raffalli

Participants: Frédéric Blanqui

The kernel of the proof engine will be based on completion techniques. Knuth-Bendix completion tries to transform a set of unoriented equations into a set of (inter-reduced and) convergent, that is, terminating and confluent, set of rewrite rules. It can therefore be used for proving that some equality is the equational consequence of some equational theory. Indeed, when an equational theory can be completed into a convergent rewrite system, two terms are equivalent in this equational theory if their normal form in the convergent rewrite systems are equal.

4.a - Adaptation of the Knuth-Bendix completion algorithm to PML (already started, delivered 09/2012) As explained just before, Knuth-Bendix completion is based on rewriting. However, in PML or in Moca (see task 4.b), programs are not rewriting systems. We therefore need to adapt Knuth-Bendix completion. We need both generalization, to use the notion of constructor present in ML and take care of the higher-order nature of ML (even if we can not hope much here). As said above, something is already implemented, but it is trivial because completely restricted to closed terms. A first version should be able at least to rewrite a closed term modulo some simple equational (and universal) theory. An important point here is to ensure termination of this algorithm and even a low complexity. The price to pay, will be incompleteness. A lot of care should also be devoted to the correctness of the implementation, because like for task 3.a, the consistency of PML relies on it.

This task in one of the major task for PML and a first version already exists, but is non terminationg in presence of equalities between functions: if we have an equation like f = f o f, PML may use this equation has a definition of f and loop. We are considering a fix which involves some notions similar to those of geometry of interaction.

Moreover, we include other task not only related to PML, but that concern equational reasoning and that could be directly or indirectly related to task 4.a.

4.b - Development of a stand-alone tool for completion modulo associative and commutative symbols (beginning 09/2012, delivered 01/2014), like it is the case with addition and multiplication on integers. We want to develop a stand-alone tool so that it can be easily reused by other people in other projects or tools. Apart from PML, it will be useful for Moca, a generator of construction functions for private data types with algebraic invariants, and Europa, a proof assistant based on the lambda-pi-calculus modulo rewriting developed by Gilles Dowek and Mathieu Boespflug. Note that, for implementing this tool, we could start from the CiME library.

4.c - Improvement of Moca and adaptation to PML (depend upon parts of tasks 1.d and 4.b, beginning 09/2013, delivered 09/2015) Completion is at the heart of Moca, it is used for automatically generating construction functions for private data types with algebraic properties as described in Frédéric Blanqui, Thérèse Hardin and Pierre Weis ESOP'07 paper [BHW07]. As an example, consider a type with a constructor taking as argument a list. If this constructor is declared "commutative", then Moca will generate construction functions for this type that will guarantee that the list argument is always sorted (using a user-defined comparison function).

Moca also suffer from some limitation because it really works for commutative and associative symbols and a few other specific equations (neutral element, inverse, ...). The task 4.b should allow to generalize the application of this tool.

Moca currently generates OCaml code without guarantee on its correctness. Using PML instead, Moca could also generate a proof of the correctness of the generated construction functions. Then, later, when trying to prove the correctness of a function defined on this private date type, one could use the invariants satisfied by the values of the private data type as assumptions, since these invariants are satisfied by construction.

Task 5 - validation (transverse task)

Coordinator: Christophe Raffalli

Participants: Pierre Hyvernat, Christophe Mouilleron, Tom Hisrshowitz.

The validation requires to write numerous examples to check that we fulfill our main goal, which is that all programs (with or without proof) are written in the best possible way. This work being research, we think that it is important that any piece of code written in PML that does not look right is carefully examined to check that this is not due to a defect in language design.

Christophe Mouilleron and Erik Martin-Dorel started to work on the axiomatisation of computer arithmetics within an ongoing PEPS project. This is a good test for PML and moreover a requirement because we want PML to be a real programming language and thefore the limited arithmetic of processors (32 and 64 bits integer and floating point number) must be supported by PML. However, proving software using them is not trivial at all and Christophe Mouilleron member of the ARAINER team in ENS Lyon is a specialist in this domain.

Tom Hirshowitz and Christophe Raffalli already started (and almost finished) a proof in PML that category form a 2-category (this delopment is available in the example directory in the current version of PML). We plan to continue with Tom such abstract development and we think that they could lead to interesting perspective about the modularity of PML.

More general code, including a standard library and some significant mathematical should be developped (there is already around 10.000 lines of PML code in the current distribution). Moreover, we started to port to PML the course of software foundation written in Coq. The three first files are translated and there remain a dozen of files of around 2500 lines to translate. This is a major work, but would provide a very good test for PML and a good tutorial.

This task should deliver at least 100.000 lines of PML code to have a sufficient corpus to say in which respect we fulfilled our goals.

Task 6 - Optimisation of PML (transverse task)

Coordinator: C. Raffalli

Participants: All (anyone could optimize the part of PML he was involved in).

Some of the choice in the design of PML involve rather complex algorithm. Notably, this is the case of the constraint checking algorithm and completion procedure. The first implementation is not trivial but not optimized either. And very often, we have discoverd and will continue to discover that PML is too slow. This goal of this trasversal task is to ensure that PML is usable.

Currently, some optimisations were already added. For instance, PML uses a sat solver for various tasks: completeness and usefulness of cases in pattern matching and dealing with negative hypothesis (like x is not equal to S[x]) in the completion procedure. Improving the sat solver using J.C. Filliâtre work [] and simploifying the formula before giving them to the sat solver were a major improvement.

A lot of other optimisations are planned:

• The graph used to encode the typing constraints should probably be reduced (that is we should compute its transitive reduction).
• The completion procedure stores a set of terms of the language and we need a fast way to recover the set of all term using a given sub-term. The current implementation is too naïve.
• ...

Planning of tasks, deliverables and milestones

The following diagram represents the summary of the tasks and subtasks, together with the intended planning:

à refaire

Data management, data sharing, intellectual property and results exploitation

Results in each of the tasks will be published in journals (APAL, TCS, ...) and international conferences as usual (LICS, TLCA, CSL, CIE, ...).

PML language is already distributed as open source software under the Cecill-B license. We think that for such a research platform, this is the only possible way to ensure that people will try it. As soon as a first compiler is available, we plan to produce easy-to-install packages, at least for some well-known Linux distributions (Debian and its derivatives seem a good choice).

Consortium organization and description

Relevance of the partner for the project

This project involve only one partner, the LAMA (UMR 5127), where the coordinator of the project already developed the proof assistant PhoX. The main characteristic of PhoX is to be rather simple to use due to a set of tactics which is limited (less than 20 for the principal ones), but powerful. Moreover, tactics are extensible by incorporating theorems inside the tactics.

Clearly, this means that efficiency was the main goal of PhoX. Unfortunately, like all tactical theorem prover, PhoX proofs are not readable. After a few attempts with a Mizar-like mode for PhoX, Christophe Raffalli decided to move to a new theorem prover, starting from scratch.

Pierre Hyvernat is also in Chambery and the second developer of PML (he wrote the current termination checker). Tom Hirshowitz has some prior experience in his phd about the compilation of functional languages. At ENS Lyon, which is very near to Chambéry, Alexandre Miquel is a specialist of consistency proof for logical framework. Therefore, Chambery is the very natural partner for this project.

Qualification of the project coordinator and members

The coordinator and various members of the project comes from various horizon (see section 7), but they have a common background around the use and development of programming language and/or formal methods. We think that this variety, the small number of members, should allow for good communication and should be very fruitful.

We think, that compared with the development of PML by Christophe Raffalli alone, such a team should speed up the development of PML approximately by a factor 3, making it possible to deliver a very innovative and useful tool at the end of the project. The lack of support for such a team would certainly limit the tool to an experimental toy with many development only partially (or even not at all) integrated in the project.

Christophe Raffalli will also ask for delegations during the project to be able to spend even more time on it.

Scientific justification of requested budget

Meetings (total 9720€ per year)

Two meetings and one workshop per year, 3 days each, for 7 people. Each meeting costs 1 train ticket in France, 3 days and 2 nights: 3*7*(100 + 3*20 + 2*80) = 6720€.

For the workshop, we have to invite 2 to 3 guests. Some may come from foreign country and we estimate the cost to 3000€ per year. Which mean a total of 9720€ per year.

Visits (total 10000€)

We think that this is very important for this project to interact with other project. For instance, Andreas Abel came to visit Chambéry in 2010 for two weeks financed by our PEPS project and during this time induced an important bootstrap to the implementation of the termination checker [Hyv10b] and contributed a non trivial example with a proved implentation of left-leaning red-black trees.

We want to continue such interaction. Andreas Abel already agreed as well as Joe Wells for discusion about error reporting and , Assia Mahboubi for complex proofs involving the reflexion principle. Many other discussion would be profitable about PML runtime (with multithreading ?), interaction with external tools (termination checker or automated theorem prover), uniqueness typing (meeting with people already using such technics), ...

We plan around 4 short visits of one or two weeks from people outside the project to Chambéry and the same amount for short visit in the other direction. This means around 12 weeks per year with 8 travels for a cost of 500€ per week (x12) plus in average (depending if we use plane or train) the same amount for each travel (x8), with a total of 10000€ per year.

Conferences (total 9600€ per year)

The members of the ANR will submit papers to international conferences and journals and attend to specialized workshop. We have 2.5 person/year on the project with means around 3 international conferences or workshop per year (estimated cost 2000€) and one national conference or workshop per year (estimated cost 1200€)

Master internships (total 1500€ per year)

We plan to host around four master internships in good conditions (possibly followed by PhD studentships not financed by the ANR): one per year with a total cost of 6000€ (1500€ each: 300€ for travel and 200€ per month for an accommodation at the CROUS).

Computers (total 2000€ per year)

We consider that the ANR project has to participate in the renewal of the computers of its participants. The lifetime of a computer being 4 years and the total number of month for permanent members of the project being 112, we think that we should pay for 4 computers with an average value of 2000€ each (we need powerful computers and laptops, because automated reasoning requires a lot of computations and memory).

Human resources financed by the ANR (1 PhD student, 2 two years postdocs and 4 month of invited professor)

This project involves many tasks and 7 members. However, all members apart from the coordinator and Pierre Hyvernat can only devote 2-3 month per year to this project (they are involved in other ongoing research). Although this is far from negligible, we think that we will need more human power: we estimate that 1 PhD and 2 postdocs are reasonable.

We also consider that one year post-doc are not sufficient, because the time need to understand the existing code base is long and the student has both to write code and publish its result. Moreover, the code produced by the student will not be an experimental code to support its publication, but code which should remain in the project and be maintened by other member of the project. In one year, this seems impossible to achieve.

Moreover, as mentioned in the section about visits, we would like to have 1 month per year of invited professor.

This would give a total 88 months (4 month invited, 36 for the PhD and 48 for the 2 postdocs) To be compared with the total of 104/112 month not payed by the ANR. We consider that this is a good balance.

Human resources not financed by the ANR

Name	month/year	percentage	Cout annuel	Cout pondéré
Christophe Raffalli	10	85%	65000 * 1/2	27083
Frédéric Blanqui	3	25%	65000	16250
Emmanuel Chailloux	2	15%	85000 * 1/2	7084
Tom Hirshowitz	3	25%	66000	16500
Pierre Hyvernat	6	50%	60000 * 1/2	5000
Alexandre Miquel	2	15%	65000	5417
Christophe Mouilleron	0/2	0/15%	0	0
Total per year	26/28			77334
Total for 4 year	104/112			309336

Remark: the situation of Christophe Mouilleron is unknown next year. If it is possible he will continue is work on PML started with the PEPS for around 2 month per year. But if it is not possible, or if he is selected for the post-doc position, then we should not count it. We used the worst case on the website.

Annexes

CV, Resume of all project members

Christophe Raffalli (project coordinator)

Age 41, MCF at the LAMA (UMR 5127) since September 1997.

After his PhD in Paris VII (defended in February 1994), Christophe Raffalli spent 1 and a half year at the LFCS in Edinburgh, 2 years at Chalmers university in Göteborg (post-doc of the TYPES European project) and 1 year as ATER in Créteil University.

Research administration: For ten years, the LAMA was sub-site of the Paris VII site inside the TYPES project which was renewed several times and Christophe Raffalli was the coordinator for this sub-site. Currently the project is not financed by the E.U. Nevertheless, Christophe Raffalli is in charge of the organization of the next TYPES meeting in Aussois in May 2009.

His research interests include:

• theory and implementation of proof assistants,
• proof theory,
• implementation of programming languages (especially type-systems).

Selected publications

• [Raf10b] Realizability for programming languages (submitted, available as hal-00474043)

• [Raf08a] PML and strong normalisation conference at the Types workshop, April 2008, Turino, Italy

• [Raf07b] PML: a new proof assistant conference at the Types workshop, may 2007, Cividale del Friuli (Udine), Italy

• [Raf06a] Realizability of the axiom of choice in HOL (An analysis of Krivines's work) with Frédéric Ruyer in Fundamenta Informaticae (2006)

• [Raf05a] PhoX with Paul Rozière in The seventeen provers of the World, Freek Wiedijk (editor) LNAI 3600 pages 67-71

• [Raf03b] System ST Schedae Informatica, proceedings of the Chambery-Krawow-Lyon Workshop, Vol. 12, pages 97-112 (June 2003)

• [Raf02c] Getting results from programs extracted from classical proofs, TCS 2004, volume 323, pages 49-70

• [Raf02b] System ST, beta-reduction and completeness, presented at LICS 2003, publication IEEE, pages 21-32

• [Raf02a] Computer Assisted Teaching in Mathematics, with René David, to appear in the proceedings of the Workshop on 35 years of Automath (April 2002, Edingurgh)

• [Raf01d] System ST, towards a Type System for Extraction and Proof of Programs, Archive for Pure and Applied Logic, 2003, volume 122, pages 107-130

• [Raf01c] Apprentissage du raisonnement assité par ordinateur, avec René David, Quadrature numéro 45, printemps 2002, pages 25-36). Version courte parue dans la gazette de la SMF, avril 2002, numéro 92, pages 48-56

Frederic Blanqui (INRIA, Rocquencourt)

Age 38, permanent full-time researcher at INRIA.

Frederic Blanqui is expert in the following areas:

• type theory,
• rewriting theory,
• termination,
• functional programming,
• proof assistants,
• and formal certification of program properties.

Since September 2008, he is INRIA researcher at LIAMA, the Sino-French Laboratory in Computer Science, Automation and Applied Mathematics.

Between 2003 and 2008, he was INRIA researcher at LORIA, Nancy, in the Protheo research team led by Pr Claude Kirchner, focusing on the use of rewriting techniques for programming, as well as specifying and proving program properties.

Since 2004, he is leading the CoLoR project which aims at providing tools for automatically certifying the termination of programs. Since 2007, CoLoR is the best certification back-end in the international competition on certified termination provers.

In 2007 and 2008, he led the INRIA Quotient project which aims at extending the OCaml programming language with types whose values automatically satisfy equational invariants using the Moca tool.

He supervised 2 master thesis and 3 PhD students on the extension of type theory with decision procedures, the termination of typed higher-order rule-based programs, and the certification of termination proofs.

He did his PhD with Pr Jean-Pierre Jouannaud at University Paris Sud between October 1998 and September 2001 on the combination of type theory and rewriting theory.

Between October 2001 and August 2002, he worked on the certification of cryptographic protocols with Pr Larry Paulson at Cambridge, UK.

Between September 2002 and September 2003, he worked at Ecole Polytechnique in the Coq development team on the extension of the proof assistant Coq with rewriting.

More details on his activities and publications can be found on his web page and in his CV.

Selected publications

International journals with reading committee: 7

International conferences with reading committee: 15

Other publications (thesis, workshops, invited papers, reports, etc.): 15

Prizes: 2001 SPECIF Award for his PhD thesis by the French national society of teachers and researchers in computer science; and 2001 Kleene Award for the best young researcher paper at the IEEE Symposium on Logic in Computer Science (LICS).

Five most significant publications in the last 5 years:

• [Bla11] F. Blanqui and A. Koprowski. CoLoR: a Coq library on well-founded rewrite relations and its application to the automated verification of termination certificates. To appear in Mathematical Structures in Computer Science.

• [BRK10] F. Blanqui, C. Riba and C. Kirchner. On the confluence of lambda-calculus with conditional rewriting. Theoretical Computer Science 411(37), p. 3301-3327.

• [BR09] F. Blanqui and C. Roux. On the relation between sized-types based termination and semantic labelling. CSL'09. LNCS 5771.

• [BJS08] F. Blanqui, J.-P. Jouannaud and P.-Y. Strub. From formal proofs to mathematical proofs: a safe, incremental way for building in first-order decision procedures. TCS'08. IFIP 273.

• [BHW07] F. Blanqui, Thérèse Hardin and Pierre Weis. On the Implementation of Construction Functions for Non-free Concrete Data Types. ESOP 2007: 95-109.

Tom Hirshowitz (LAMA, Chambéry)

34 ans, CR CNRS (informatique) , LAMA

• 2007 CR CNRS au LAMA (UMR 5127) à Chambéry
• 2004-2007 CR CNRS au LIP (UMR5668) à Lyon
• 2003-2004 ATER, équipe Plume, LIP, ENS Lyon
• 2000-2003 Doctorat (dir.: X. Leroy, INRIA Rocquencourt, projet Cristal)
• 1999-2000 DEA à Paris 7
• 1996-2000 Ecole Nationale des Ponts et Chaussées

10 publications dans des revues et conférences internationales

publications choisies

1. T. Hirschowitz, X. Leroy, and J. B. Wells. Compilation of extended recursion in call-by-value functional languages, PPDP 2003. Version journal dans Higher-Order and Symbolic Computation 22-1. 2009.
2. R. Garner, T. Hirschowitz, and A. Pardon. Variable Binding, Symmetric Monoidal Closed Theories and Bigraphs. CONCUR'09. 2009.
3. A. Hirschowitz, M. Hirschowitz, T. Hirschowitz. Contraction-free Proofs and Finitary Games for Linear Logic. MFPS, 2009.
4. A. Hirschowitz, M. Hirschowitz, T. Hirschowitz. A Theory for Game Theories. FSTTCS, 2007.
5. T. Hirschowitz, X. Leroy. Mixin Modules in a Call-by-Value Setting, ESOP, 2002, journal version in ACM Transactions on Programming Languages and Systems, 2005.

Pierre Hyvernat (LAMA, Chambéry)

Age 30, "maître de conférences" at the Université de Savoie (in Chambéry) since September 2006, member of the LAMA.

He obtained his PhD thesis in December 2005, under the supervision of Thierry Coquand (Chalmers, Göteborg, Sweden) and Thomas Ehrhard (at the time, IML, Luminy, Marseille, France)

His research interests relevant to PML include

• denotational semantics,
• type theory and constructive mathematics.

Selected publications

• [Hyv10b] The Size-Change Termination Principle for Constructor Based Languages (hal-00547440, submitted)

• [HHy06] with P. Hancock: Programming Interfaces and Basic Topology. "Annals of Pure and Applied Logic", volume 137, January 2006,

• [Hyv05] Synchronous Games, Simulations and lambda-calculus, proceedings of the "GaLoP" workshop, ETAPS 2005. (journal version submitted to Annals of Pure and Applied Logic),

• [Hyv04] Predicate Transformers and Linear Logic: yet another Denotational Model, Lecture Notes in Computer Science, vol. 3210, September 2004.

Alexandre Miquel (PPS, Paris 7)

Age 37, "maître de conférences" at the Université Paris-Diderot (Paris 7) since September 2003, member of PPS. Currently CNRS research associate ("délégation") in the Plume team at the LIP (ENS Lyon) since September 2008.

He obtained his PhD thesis in December 2001, under the supervision of Hugo Herbelin (INRIA/LIX) in the Coq team (now TypiCal).

From October 2001 to August 2002 he was postdoc in the Chalmers Institute of Technology (Göetborg, Sweden) under the supervision of Thierry Coquand, and from September 2002 to August 2003 he was "ATER" at the LRI (Orsay).

He is a specialist of the models of type theory (especially the calculus of constructions) and of the correspondence between set theory and type theory. His research interests also include:

• logic, proof-theory, rewriting,
• denotational semantics (set- and domain-theoretic),
• realizability in classical logic.

Selected publications

His most significant publications are:

• [Miq07] Classical program extraction in the calculus of constructions (CSL'07),

• [Miq06] with A. Arbiser and A. Ríos. A lambda-calculus with constructors (RTA'06),

• [Miq04] Lambda-Z: Zermelo's Set Theory as a PTS with 4 Sorts (TYPES'04),

• [Miq03] A Strongly Normalising Curry-Howard Correspondence for IZF Set Theory (CSL'03),

• [Miq00] A Model for Impredicative Type Systems with Universes, Intersection Types and Subtyping (LICS'00).

Christophe Mouilleron (LIP, ENS de Lyon)

Age 26, PhD student in the Arenaire team at the LIP (ENS de Lyon) since September 2008. He works under the supervision of Claude-Pierre Jeannerod (INRIA/LIP) and Gilles Villard (CNRS/LIP).

His research interests relevant to PML include :

• computer arithmetic,
• code generation,
• formal proof of numerical properties in programs.

Publications

• [MouRev10] C. Mouilleron and G. Revy. Automatic Generation of Fast and Certified Code for Polynomial Evaluation. (submitted, available as ensl-00531721)

• [JeaMou10] C.-P. Jeannerod and C. Mouilleron. Computing Specified Generators of Structured Matrix Inverses. (ISSAC'10)

• [BJJK+10] C. Bertin, C.-P. Jeannerod, J. Jourdan-Lu, H. Knochel, C. Monat, C. Mouilleron, J.-M. Muller, and G. Revy. Techniques and tools for implementing IEEE 754 floating-point arithmetic on VLIW integer processors. (PASCO'10)

• [LTdD+10] V. Lefèvre, P. Théveny, F. de Dinechin, C.-P. Jeannerod, C. Mouilleron, D. Pfannholzer, and N. Revol. LEMA : Towards a Language for Reliable Arithmetic. (PLMMS'10)

Relevant publications by non participants to the project

Here are some publication or resources of interest for the project:

Laguage design and theory:

• [SOW97] Martin Sulzmann, Martin Odersky, Martin Wehr, Type inference with constrained types, TAPOS, 1997.
• [HW04] Christian Haack and J. B. Wells, Type error slicing in implicitly typed higher-order languages, Sci. Comput. Programming, 50:189-224, 2004.
• [Ruy06] Frédéric Ruyer, Preuves, types et sous-type, phd 2006 directed by C. Raffalli.

Termination:

• [LJ01] Lee, Jones, et al. The size-change principle for program termination - ACM SIGPLAN Notices - 2001
• [Abel04] Andreas Abel, Termination Checking with Types ,Special Issue: Fixed Points in Computer Science (FICS'03 and RAIR'04)
• [Bar04] G. Barthe, M. J. Frade and E. Giménez, L. Pinto and T. Uustalu, Type-Based Termination of Recursive Definitions, 2004, Mathematical Structures in Computer Science.
• [Gie06] J. Giesl, S. Swiderski, P. Schneider-Kamp, and R. Thiemann Automated Termination Analysis for Haskell: From Term Rewriting to Programming Languages, Proceedings of the 17th International Conference on Rewriting Techniques and Applications (RTA-06), Lecture Notes in Computer Science 4098.

the Clean language:

• [AGR92] Peter Achten, John van Groningen and Rinus Plasmeijer (1992). High-level specification of I/O in functional languages, Proc. of the Glasgow workshop on Functional programming, ed. J. Launchbury and P. Sansom, Ayr, Scotland, Springer-Verlag, Workshops in Computing, pp. 1-17.
• [AcP95] Peter Achten and Rinus Plasmeijer (1995). The Ins and Outs of CONCURRENT CLEAN I/O, Journal of Functional Programming, 5, 1, pp. 81-110.
• [AcP97] Peter Achten and Rinus Plasmeijer (1997). Interactive Functional Objects in CLEAN, Proc. of the 1997 Workshop on the Implementation of Functional Languages (IFL'97), ed. K. Hammond Davie, T., and Clack, C., St.Andrews, Scotland,
• [VPA07] Edsko de Vries, Rinus Plasmeijer, and David M. Abrahamson, Uniqueness Typing Simplified, by Edsko de Vries,
• the language report by Rinus Plasmeijer and Marko van Eekelen,
• the language homepage.

Involvement of project participants to other grants, contracts, etc …

• Frederic Blanqui is involved in the Sino-French ANR SIVES 2009-2011 on SImulation and Verification based platform for developing Embedded Systems.
• Pierre Hyvernat and Lionel Vaux are members of the ANR CHOCO ("Curry Howard for COncurrency"), whose leader is Thomas Ehrhard.
• Marianne Simonot ans Maria-Virginia Aponte are members of the ANR REVE ("Safe Reuse of Embedded components in heterogeneous enVironmEnts ") whose leader is Lionel Seinturier at INRIA-ADAM.
• Julien Forest and Olivier Pons are involved in the ANR A3Pat whose leader is Xavier Urbain.
• Olivier Pons is also a member of the ANR [Focal] (certified development, compiler and framework).