Instead of laboriously and interactively proving the correctness of a C program with respect to a functional specification, one might wish to compile the functional spec directly to an imperative program (C or assembly language). That is, replace the box labeled "proof of correctness" with one labeled "compiler." In that case, one would need a formally verified functional-language compiler. Several approaches have been demonstrated.

Instead of laboriously and interactively proving the correctness of a C program with respect to a functional specification, one might wish to compile the functional spec directly to an imperative program (C, or assembly language).

That is, replace the box labeled "specification" with one labeled "imperative program" or "assembly language".

In that case, one would need a formally verified functional-language compiler. Several approaches have been demonstrated.