A Toolchain to Produce Correct-by-Construction OCaml Programs

This paper presents a methodology to get correct-by-construction OCaml programs using the Why3 tool. First, a formal behavioral specification is given in the form of an OCaml module signature extended with type invariants and function contracts, in the spirit of JML. Second, an implementation is written in the programming language of Why3 and then verified with respect to the specification. Finally, an OCaml program is obtained by an automated translation. Our methodology is illustrated with the proof of a union-find library. Several other proofs of data structures and algorithms are included in the companion artifact to this paper.