The project led to a number of major breakthrough results in program semantics and verification. These results have been published in top venues in Programming Languages, such as POPL and PLDI, as well as receiving a number of major awards. In particular, our work on *Iris* has had major impact on the field of separation logic verification, and *RustBelt* spearheaded an exciting line of work on the semantics and verification of Rust.
- Relaxed-Memory Concurrency: Rust inherits its relaxed-memory concurrency model from C/C++11, but the C11 model is known to suffer from a fatal flaw called the "out-of-thin-air" problem. We proposed a breakthrough solution to this problem, which we called the "promising semantics". In addition, we have identified a previously unknown flaw in C11 pertaining to the treatment of sequentially consistent accesses, and we proposed a revised semantics, dubbed RC11, that fixes this flaw. Our fix to C11 was incorporated into the language standard.
- Low-Level Program Verification: We have developed Iris, a general framework for higher-order concurrent separation logic, which supports the verification of complex, low-level, concurrent programs in the Coq proof assistant. Crucially, Iris is *parameterized* by the language we are reasoning about, which enabled us to experiment with different semantics and memory models for Rust. In addition, Iris was designed to make it easy to soundly *derive* custom logics for different application domains, a facility we make essential use of in the RustBelt verification. Last but not least, we have equipped Iris with a powerful interactive proof mode, which has made it possible for users to develop interactive proofs within Iris in the same convenient tactical style that they normally use when developing proofs within Coq.
- Formalizing the Rust Language: We have given a formal definition of a core typed calculus called LambdaRust, which encapsulates the central features of the Rust language. This is the first formal account of such a significant subset of the Rust language.
- Proving Safety of Rust: We have developed RustBelt, a semantic soundness proof for LambdaRust, which establishes formally that Rust's safety guarantees do in fact hold both for the LambdaRust type system, as well as for a variety of widely-used Rust libraries that internally make use of unsafe features. This constitutes the first formal validation of the safety of a significant subset of the Rust language, under both sequentially consistent and relaxed-memory semantics. Our verification makes essential use of the power of Iris to define custom domain-specific logics.
We have also made several breakthroughs on problems that were not envisioned at the start of the project:
- Validating Powerful Compiler Optimizations for Rust: We developed Stacked Borrows, a new semantics for memory accesses in Rust which is in the process of being integrated into the language specification. Stacked Borrows makes it possible for the Rust compiler to safely employ strong type-based optimizations, even in the presence of unsafe code.
- Automated and Foundational Verification of C: Going beyond Rust, we have also developed a new tool called RefinedC, which uses refined ownership types to support automated verification of C programs while also producing foundational, machine-checked proofs of their correctness in Iris/Coq. RefinedC is closely inspired by the semantic soundness proof of RustBelt.
