Piton: A Mechanically Verified Assembly-Level Language

Mountaineers use pitons to protect themselves from falls. The lead climber wears a harness to which a rope is tied. As the climber ascends, the rope is paid out by a partner on the ground. As described thus far, the climber receives no protection from the rope or the partner. However, the climber generally carries several spike-like pitons and stops when possible to drive one into a small crack or crevice in the rock face. After climbing just above the piton, the climber clips the rope to the piton, using slings and carabiners. A subsequent fall would result in the climber hanging from the piton-if the piton stays in the rock, the slings and carabiners do not fail, the rope does not break, the partner is holding the rope taut and secure, and the climber had not climbed too high above the piton before falling. The climber’s safety clearly depends on all of the components of the system. But the piton is distinguished because it connects the natural to the artificial. In 1987 I designed an assembly-level language for Warren Hunt’s FM8501 verified microprocessor. I wanted the language to be conveniently used as the object code produced by verified compilers. Thus, I envisioned the language as the first software link in a trusted chain from verified hardware to verified applications programs. Thinking of the hardware as the rock I named the language Piton.