An Approach for Proving the Correctness of Inspector/Executor Transformations

To take advantage of multicore parallelism, programmers and compilers rewrite, or transform, programs to expose loop-level parallelism. Showing the correctness, or legality, of such program transformations enables their incorporation into compilers. However, the correctness of inspector/executor strategies, which develop parallel schedules at runtime for computations with nonaffine array accesses, rests on the correctness of the inspector code itself. Since inspector code is often provided in a run-time library, showing the correctness of an inspector/executor transformation in a compiler requires proving the correctness of any hand-written or compiler-generated inspector code as well. In this paper, we present a formally defined language (called PseudoC) for representing loops with indirect array accesses. We describe how using this language, where the reads and writes in array assignments are distinguished, it is be possible to formally prove the correctness of a wavefront parallelism inspector in HOL4. The key idea is to reason about the equivalence of the original code and the inspector/executor code based on operational semantics for the PseudoC grammar and properties of an executable action graph representation of the original and executor loops.