2026 Volume 34 Pages 656-670
The Codegen plugin for Rocq (formerly Coq) performs verified compilation from Gallina to C. As an intermediate step, it transforms Gallina terms into a restricted subset of Gallina that is structurally closer to C. For each transformation, Codegen automatically generates a proof that the transformed function is extensionally equal to the original one, i.e., ∀args, f args =f' args. Some transformations yield terms that are not definitionally equal in Rocq, and therefore cannot be justified by simple computation. One such case is distributing function applications over match expressions, which transforms (match e with C1 ⇒ t1 |...| Cn ⇒ tn end args) into (match e with C1 ⇒ t1 args |...| Cn ⇒ tn args end). To prove the semantic preservation of transformations involving recursion, Codegen constructs proof terms that mirror the structure of the original recursive functions. This approach supports recursive structures that cannot be handled by Rocq's standard induction principles such as nat_ind, including mutually recursive and nested fixpoint functions. Because the generated proofs share the same recursive structure as the original functions, they are accepted by Rocq's termination checker without additional annotations. This method enables Codegen to automatically produce verified semantic preservation proofs even for complex Gallina-to-Gallina transformations, providing a solid formal foundation for subsequent verified compilation to C.
