CompCert

CompCert
Name	CompCert
Developer	INRIA; Robbert Krebbers; Xavier Leroy; CNRS; AdaCore
Released	2006
Programming language	OCaml (programming language); Coq (proof assistant)
Platform	x86; ARM architecture; PowerPC; RISC-V
License	Proprietary software; Commercial software

CompCert CompCert is a formally verified optimizing compiler for the C subset that targets multiple processor architectures; it is used in safety-critical contexts where correctness is paramount. It combines techniques from program verification, operational semantics, denotational semantics, proof assistants, and formal methods to provide a machine-checked guarantee that compiled code preserves the semantics of source programs. The project involves collaborations among researchers from INRIA, CNRS, and several universities and companies including Averroès and AdaCore.

Overview

CompCert compiles a significant fragment of C90 and parts of C99 into assembly for targets such as x86_64, ARM architecture, PowerPC, and RISC-V. The compiler is implemented in OCaml (programming language) and its correctness proofs are developed and checked in Coq (proof assistant). The project builds on foundational work in programming language theory, including lambda calculus, Hoare logic, type theory, and the semantics frameworks pioneered by Gordon Plotkin and Christopher Strachey. CompCert’s soundness claims relate to research by Tony Hoare, Dana Scott, and Robin Milner.

Design and Implementation

CompCert’s architecture is a pipeline of formally specified passes from an abstract C intermediate representation through multiple lower-level IRs to assembly. The implementation leverages OCaml (programming language) for code generation and Coq (proof assistant) for mechanized proofs, integrating ideas from Xavier Leroy and Robbert Krebbers. The internal passes reuse concepts from SSA representations used in compilers like LLVM and optimization strategies reminiscent of GCC. The codebase interacts with software engineering practices from organizations such as Microsoft Research, Google Research, and Amazon Web Services for deployment considerations. Tooling and continuous integration reflect methods used at Eclipse Foundation, Apache Software Foundation, and Facebook engineering teams.

Formal Verification and Semantics

Formal verification in CompCert relies on semantics definitions—small-step and big-step operational semantics—developed in the tradition of Gordon Plotkin and Milner. Proofs in Coq (proof assistant) cover preservation of semantics across transforms, using techniques from denotational semantics credited to Dana Scott and Christopher Strachey. The development draws on related verified systems like SeL4, Fstar, Isabelle/HOL, and HOL4, and interacts with proof engineering practices from projects at Carnegie Mellon University, ETH Zurich, IMDEA Software Institute, and University of Cambridge. Verified compiler concepts have antecedents in Edgar T. Codd's formal approaches to translation correctness and are connected to program extraction research by Georges Gonthier.

Performance and Optimizations

CompCert implements optimizations such as constant propagation, register allocation, instruction selection, and dead code elimination with proofs that these transforms preserve semantics. Its register allocator uses principles related to those in Chaitin, while code generation strategies echo work from Retargetable Code Generator approaches at Bell Labs and AT&T Bell Laboratories. Benchmarks compare CompCert-generated code to outputs from GCC and LLVM on suites including workloads studied at SPEC CPU and research from Princeton University, MIT, and Stanford University. While not always matching peak performance of aggressive optimizers from GCC releases and Clang frontends, CompCert provides competitive performance with formal guarantees similar to those sought by teams at NASA, European Space Agency, and SpaceX.

Adoption and Use Cases

CompCert is used in industrial and academic settings where correctness is critical, including avionics programs certified under DO-178C, automotive systems aligned with ISO 26262, and medical devices influenced by standards from FDA. Research and teaching institutions such as INRIA, University of Paris, Carnegie Mellon University, ETH Zurich, and University of Cambridge use it for experiments in verified software. Companies in safety domains including AdaCore, Thales Group, Airbus, Bosch, and Siemens have evaluated or integrated CompCert-inspired workflows. The compiler also features in collaborations with projects like seL4 and is cited in verification initiatives at DARPA and European Commission research programs.

Development History and Versions

CompCert’s development began in the early 2000s under researchers at INRIA and collaborators including Xavier Leroy; early milestones were presented at conferences such as POPL (ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages), ICFP (International Conference on Functional Programming), and CPP (ACM SIGPLAN Conference on Certified Programs and Proofs). Major releases expanded target architectures to ARM architecture and PowerPC and later to RISC-V, with commercial versions distributed by AdaCore. The project’s evolution parallels advances in proof assistants like Coq (proof assistant) and verification projects including CompCertX and verified toolchains at Microsoft Research and Google Research. Community contributions and industrial partnerships have driven versioned releases that reflect trends from Open Source Initiative ecosystems and standards from ISO/IEC bodies.

Category:Compilers