## Efficient execution in an automated reasoning environment (2006)

### Cached

### Download Links

- [www.cs.utexas.edu]
- [www.cs.utexas.edu]
- [www.cs.utexas.edu]
- [www.cs.utexas.edu]
- DBLP

### Other Repositories/Bibliography

Venue: | Journal of Functional Programming |

Citations: | 8 - 4 self |

### BibTeX

@ARTICLE{Greve06efficientexecution,

author = {David A. Greve and Matt Kaufmann and Panagiotis Manolios and J Strother Moore S and Rob Sumners and Daron Vroon and Matthew Wilding},

title = {Efficient execution in an automated reasoning environment},

journal = {Journal of Functional Programming},

year = {2006},

volume = {2007}

}

### OpenURL

### Abstract

Abstract We describe a method to permit the user of a mathematical logic to write elegant logical definitions while allowing sound and efficient execution. We focus on the ACL2 logic and automated reasoning environment. ACL2 is used by industrial researchers to describe microprocessor designs and other complicated digital systems. Properties of the designs can be formally established with the theorem prover. But because ACL2 is also a functional programming language, the formal models can be executed as simulation engines. We implement features that afford these dual applications, namely formal proof and execution on industrial test suites. In particular, the features allow the user to install, in a logically sound way, alternative executable counterparts for logically-defined functions. These alternatives are often much more efficient than the logically equivalent terms they replace. We discuss several applications of these features. 1 Introduction This paper is about a way to permit the functional programmer to prove efficientprograms correct. The idea is to allow the provision of two definitions of the program: an elegant definition that supports effective reasoning by a mechanizedtheorem prover, and an efficient definition for evaluation. A bridge of this sort,

### Citations

940 |
Term Rewriting and All That
- Baader, Nipkow
- 1998
(Show Context)
Citation Context ...n proofs are important as they are used to prove liveness properties, i.e., that some desired behavior is not postponed forever. Proving termination amounts to showing that a relation is well-founded =-=[3]-=-. From a basic theorem of set theory, the Axiom of Choice implies that every well-founded relation can be extended to a total order that is isomorphic to an ordinal. Thus, the ordinal numbers provide ... |

530 |
A computational logic
- Boyer, Moore
- 1979
(Show Context)
Citation Context ...ned functions could be evaluated on such constants via the invocation of code produced by a translator from Boyer-Moore logic into the host Lisp (and thence into machine code by the resident compiler)=-=[8, 7, 9]-=-. This version of the Boyer-Moore theorem prover was called Nqthm. By the mid-1980s the Boyer-Moore community was tackling such problems as 2sthe first mechanically checked proof of Gödel’s incomplete... |

395 |
A Computational Logic Handbook
- Boyer, Moore
- 1988
(Show Context)
Citation Context ...e within the framework of the ACL2 theorem prover. ACL2 is a logic based on functional Common Lisp [54]. The logic is supported by a mechanized theorem proving environment in the BoyerMoore tradition =-=[9]-=-. The acronym ACL2 stands for “A Computational Logic for Applicative Common Lisp.” We briefly describe ACL2 and its relationship to Common Lisp, establishing some relevant background. It is perhaps su... |

214 | Unification theory
- Baader, Schulz
- 1998
(Show Context)
Citation Context ...n algorithm is an algorithm that decides whether two given terms are unifiable, and in that case it returns a most general unifier. A complete description of the theory of unification can be found in =-=[4]-=-. The unification algorithm implemented is based essentially on the relation ⇒u given by the transformation rules in Figure 4 (known as the Martelli-Montanari transformation system). This set of rules... |

154 |
Prolegomena to a theory of mechanized formal reasoning
- Weyhrauch
- 1980
(Show Context)
Citation Context ... example in Section4.2. More complex examples may be found in the linear pathfinding example presented in [23] and a unification algorithm (seeSection 4). 9s1.6 Putting This Work in Context Weyhrauch =-=[58]-=- coined the term semantic attachment for the mechanism inthe FOL theorem prover by which the user could attach programs to logical theories. The programs were to be partial models of the theories. Man... |

102 |
Metafunctions: proving them correct and using them efficiently as new proof proceedures
- Boyer, Moore
- 1981
(Show Context)
Citation Context ...ned functions could be evaluated on such constants via the invocation of code produced by a translator from Boyer-Moore logic into the host Lisp (and thence into machine code by the resident compiler)=-=[8, 7, 9]-=-. This version of the Boyer-Moore theorem prover was called Nqthm. By the mid-1980s the Boyer-Moore community was tackling such problems as 2sthe first mechanically checked proof of Gödel’s incomplete... |

99 |
Proof Theory
- Schütte
- 1977
(Show Context)
Citation Context ...Gentzen's proof of the consistency of Peano arithmetic using the ordinal number ffl0 [21], proof theorists routinely use ordinals andordinal notations to establish the consistency of logical theories =-=[51, 57]-=-. In computing science, the ordinals are used to prove termination of systems,an important component of total correctness proofs for transformational systems [2]. Even in the context of reactive syste... |

96 |
Verification of Sequential and Concurrent Programs
- Apt, Boer, et al.
- 2009
(Show Context)
Citation Context ... consistency of logical theories [51, 57]. In computing science, the ordinals are used to prove termination of systems, an important component of total correctness proofs for transformational systems =-=[2]-=-. Even in the context of reactive systems, non-terminating systems that engage in on-going interactions with an environment (e.g., operating systems and network protocols), termination proofs are impo... |

88 | W.E.: The Semantics of Reflected Proof
- Allen, Constable, et al.
- 1990
(Show Context)
Citation Context ... a means to ensure the correspondence between the axioms and the runtime environment. Since then, many theorem provers have adopted means of efficient computation on ground constants (see for example =-=[53, 1, 42, 18, 22]-=-). Generally speaking, the features described here provide the ACL2 user with finer-grained control over the code that is executed to compute ground terms. This is not unexpected, since ACL2 is much m... |

72 |
Beiträge zur Begründung der transfiniten Mengenlehre II
- Cantor
(Show Context)
Citation Context ... about ordinal arithmetic. The ordinal numbers are an extension of the natural numbers into the transfinite. They were introduced by Cantor over 100 years ago and are at the core of modern set theory =-=[12, 13, 14]-=-. The ordinal numbers are important tools in logic, e.g., after Gentzen’s proof of the consistency of Peano arithmetic using the ordinal number ǫ0 [21], proof theorists routinely use ordinals and ordi... |

49 |
Die Widerspruchsfreiheit der reinen Zahlentheorie
- Gentzen
- 1936
(Show Context)
Citation Context ...and are at the core of modern set theory [12, 13, 14]. The ordinal numbers are important tools in logic, e.g., after Gentzen’s proof of the consistency of Peano arithmetic using the ordinal number ǫ0 =-=[21]-=-, proof theorists routinely use ordinals and ordinal notations to establish the consistency of logical theories [51, 57]. In computing science, the ordinals are used to prove termination of systems, a... |

49 | Structured theory development for a mechanized logic
- Kaufmann, Moore
(Show Context)
Citation Context ...unctional program-ming language supported by a mechanized theorem prover, we now give a brief introduction to ACL2 as needed for reading this paper. For more thoroughtreatments of the ACL2 logic, see =-=[28, 29]-=-. The syntax of the ACL2 logic is that of Lisp. For example, in ACL2 wewrite (+ (expt 2 n) (f x)) instead of the more traditional 2n + f (x). Termsare used instead of formulas. For example, 1AMD, the ... |

47 |
Contributions to the founding of the theory of transfinite numbers
- Cantor
- 1915
(Show Context)
Citation Context ... about ordinal arithmetic. The ordinal numbers are an extension of the natural numbers into the transfinite. They were introduced by Cantor over 100 years ago and are at the core of modern set theory =-=[12, 13, 14]-=-. The ordinal numbers are important tools in logic, e.g., after Gentzen’s proof of the consistency of Peano arithmetic using the ordinal number ǫ0 [21], proof theorists routinely use ordinals and ordi... |

35 |
A rehabilitation of Robinson’s unification algorithm
- Corbin, Bidoit
- 1983
(Show Context)
Citation Context ...fication algorithm on term dags, which is mainly based on the Pascal implementation given in section 4.8 of Baader and Nipkow’s book [3], which in turn is based on the exposition by Corbin and Bidoit =-=[16]-=-. The main difference is that instead of using records with pointers, we use a single-threaded object. It should be noted that this implementation, although linear in space, may still require exponent... |

28 |
The Joy of Sets: Fundamentals of Contemporary Set Theory. 2. edn
- Devlin
- 1993
(Show Context)
Citation Context ...ns of ordinal arithmetic operations for reasoning purposes and algorithmically more efficient ones for computation. 3.3.1 Set Theoretic Ordinals We start with a brief review of the theory of ordinals =-=[20, 32, 51]-=-. A relation, ≺, is well-founded if every decreasing sequence is finite. A woset is a pair 〈X, ≺〉, where X is a set, and ≺ is a well-ordering, a total, well-founded relation, over X. An ordinal is a w... |

26 | Inductive assertions and operational semantics
- Moore
- 2003
(Show Context)
Citation Context ...initional axiom. Such non-terminating tail-recursive equations can arise in non-trivial con-texts, for example in formalizing microprocessor interpreters or low-level procedural programming languages =-=[41]-=-. For example, the formal language interpreteris often defined in ACL2 by specifying a function step such that, given a ma-chine state s, (step s) returns the state after executing one instruction fro... |

24 |
Formal definitions in the theory of ordinal numbers
- Church
- 1936
(Show Context)
Citation Context .... is called ǫ0, and it is the smallest ordinal, α, for which ωα = α; such ordinals are called ǫ-ordinals. 24s3.3.3 Ordinal Notations The theory of ordinal notations was initiated by Church and Kleene =-=[15]-=- and is recounted in Chapter 11 of Roger’s book on computability [46]. A system of notations for ordinals up to some ordinal α consists of a constructive, syntactic way of denoting each and every ordi... |

16 |
W.D.: Special issue on system verification
- Bevier, Hunt, et al.
- 1989
(Show Context)
Citation Context ...ss theorem [52] and the correctness of a gate-level description of an academic microprocessor [26]. These projects culminated in the late 1980s with the “verified stack” of Computational Logic, Inc., =-=[5]-=-, a mechanically checked proof of a hierarchy of systems with a gate-level microprocessor design at the bottom, several simple verified high-level language applications at the top, and a verified asse... |

15 |
R.: Efficient Rewriting of Data Structures in ACL2
- Kaufmann, Sumners
- 2002
(Show Context)
Citation Context ...eys) and performs the appro-priate return of associated value or update of the mapping. Finally, to remove this additional "well-formedness" hypothesis, we use a generic method discov-ered by Sumners =-=[31]-=-. The method involves defining two functions acl2->mapand map->acl2, so that acl2->map transforms an ACL2 object into a well-formed map and map->acl2 inverts this transformation. The paper shows howto... |

14 | Executing the Formal Semantics of the Accellera Property Specification Language by Mechanised Theorem
- Gordon, Hurd, et al.
- 2003
(Show Context)
Citation Context ... a means to ensure the correspondence between the axioms and the runtime environment. Since then, many theorem provers have adopted means of efficient computation on ground constants (see for example =-=[53, 1, 42, 18, 22]-=-). Generally speaking, the features described here provide the ACL2 user with finer-grained control over the code that is executed to compute ground terms. This is not unexpected, since ACL2 is much m... |

13 | Evaluating, testing, and animating PVS specifications
- Crow, Owre, et al.
- 2001
(Show Context)
Citation Context ... a means to ensure the correspondence between the axioms and the runtime environment. Since then, many theorem provers have adopted means of efficient computation on ground constants (see for example =-=[53, 1, 42, 18, 22]-=-). Generally speaking, the features described here provide the ACL2 user with finer-grained control over the code that is executed to compute ground terms. This is not unexpected, since ACL2 is much m... |

12 |
Finite Set Theory based on Fully Ordered Lists
- Davis
- 2004
(Show Context)
Citation Context ...be and defexec. Cowles et al [17] implement fast matrix algebra operations using mbt which is a derivative of mbe. Matthews and Vroon [40] also use mbt to define an efficient machine simulator. Davis =-=[19]-=- implements efficient finite set theory operations using mbe. 1.7 Organization of This Paper The rest of this paper begins with a detailed description of the mbe and defexec features in the next secti... |

11 | Algorithms for Ordinal Arithmetic
- Manolios, Vroon
- 2003
(Show Context)
Citation Context ...d efficient algorithms, with complexity analyses, for ordinal arithmetic on the ordinals up to ffl0, using a notational system that isexponentially more succinct than the one used in ACL2 Version 2.7 =-=[36, 39]-=-. The above notations and algorithms were implemented in the ACL2 system,their correctness was mechanically verified, and a library of theorems developed that can be used to significantly automate rea... |

10 | Single-threaded objects in ACL2
- Boyer, Moore
(Show Context)
Citation Context ...l features of ACL2 designed to allow the efficient execution of ground terms while preserving the axiomatic semantics of the language. Another such feature is the provision of single-threaded objects =-=[10]-=-, which allow destructive modification of some data structures. Still another feature, related to guards, is ACL2’s support for Common Lisp inline type declarations (and their proofs of correctness), ... |

10 |
FM8501: A Verified Microprocessor, volume 795 of LNAI
- Hunt
- 1994
(Show Context)
Citation Context ...ore community was tackling such problems as 2sthe first mechanically checked proof of G"odel's incompleteness theorem [52] andthe correctness of a gate-level description of an academic microprocessor =-=[26]-=-. These projects culminated in the late 1980s with the "verified stack" of Compu-tational Logic, Inc., [5], a mechanically checked proof of a hierarchy of systems with a gate-level microprocessor desi... |

10 | Efficiently executing PVS
- Shankar
- 1999
(Show Context)
Citation Context ...s a means to ensure the correspondence between the axioms and the runtime environment.Since then, many theorem provers have adopted means of efficient computation on ground constants (see for example =-=[53, 1, 42, 18, 22]-=-). Generallyspeaking, the features described here provide the ACL2 user with finer-grained control over the code that is executed to compute ground terms. This is notunexpected, since ACL2 is much mor... |

9 | Ordinal arithmetic in acl2 - Manolios, Vroon - 2003 |

7 |
Formal analysis of the motorola CAP DSP
- Brock, Hunt
- 1999
(Show Context)
Citation Context ...del of a Motorola digital signal processor, which was mechanically verified to implement a certain microcode engine, ran three times faster on industrial test data than the previous simulation engine =-=[11]-=-. At Advanced Micro Devices, the RTL for the elementary floating-point operations on the AMD Athlon TM processor 1 was mechanically verified with ACL2 to be IEEE compliant. But before the modeled RTL ... |

7 |
Using ACL2 Arrays to Formalize Matrix Algebra
- Cowles, Gamboa, et al.
(Show Context)
Citation Context ...ormance demands made by its industrial users are consequently heavier. 10sFinally, since the initial development of this paper, several other ACL2 applications have used mbe and defexec. Cowles et al =-=[17]-=- implement fast matrix algebra operations using mbt which is a derivative of mbe. Matthews and Vroon [40] also use mbt to define an efficient machine simulator. Davis [19] implements efficient finite ... |

7 | Integrating reasoning about ordinal arithmetic into ACL2
- Manolios, Vroon
- 2004
(Show Context)
Citation Context ...ickson's lemma [56]. Starting with ACL2 Version 2.8, ordinals are now denoted using the newnotation (which we introduce below) and a new, improved library for reasoning about the ordinals is provided =-=[38]-=-. The new library allows us to dischargeautomatically all the proof obligations involving the ordinals in the proof of Dickson's lemma, mentioned previously. There are many issues in developingsuch a ... |

6 |
Proving theorems about pure lisp functions
- Boyer, Moore
- 1975
(Show Context)
Citation Context ... system already honed by decades of focus on efficient functional execution in a logical setting. ACL2 descends from the Boyer-Moore Pure Lisp Theorem Prover, produced in Edinburgh in the early 1970s =-=[6]-=-. That system supported a first-order mathematical logic based on a tiny subset of Pure Lisp. Constants were represented by variable-free applications of constructor functions like cons, and ground te... |

3 |
Formal Correctness of a Quadratic Unification Algorithm. J. of Automated Reasoning
- Ruiz-Reina, Alonso, et al.
- 2006
(Show Context)
Citation Context ...onabove demonstrates. However, non-trivial reflexive definitions arise in practice. The TR describes such a case study, namely a sophisticated implementation ofa unification algorithm using term dags =-=[48]-=-. Furthermore, authors Greve and Wilding describe the use of the same approach in an efficient implementationof a path finding algorithm in a graph [23]. Finally, we return to a point made about invar... |

2 |
Formal analysis of the motorola
- Brock, Hunt
- 1999
(Show Context)
Citation Context ...el of a Motorola digital signal processor, which was mechani-cally verified to implement a certain microcode engine, ran three times faster on industrial test data than the previous simulation engine =-=[11]-=-. At Advanced Mi-cro Devices, the RTL for the elementary floating-point operations on the AMD AthlonTM processor1 was mechanically verified with ACL2 to be IEEE compli-ant. But before the modeled RTL ... |

2 |
Beitr"age zur Begr"undung der transfiniten Mengenlehre. Mathematische Annalen
- Cantor
- 1952
(Show Context)
Citation Context ...g about ordinal arithmetic. The ordinal numbers are an extension of the natural numbers intothe transfinite. They were introduced by Cantor over 100 years ago and are at the core of modern set theory =-=[12, 13, 14]-=-. The ordinal numbers are importanttools in logic, e.g., after Gentzen's proof of the consistency of Peano arithmetic using the ordinal number ffl0 [21], proof theorists routinely use ordinals andordi... |

1 |
The semantics of reflectedproof
- Allen, Constable, et al.
- 1990
(Show Context)
Citation Context ...s a means to ensure the correspondence between the axioms and the runtime environment.Since then, many theorem provers have adopted means of efficient computation on ground constants (see for example =-=[53, 1, 42, 18, 22]-=-). Generallyspeaking, the features described here provide the ACL2 user with finer-grained control over the code that is executed to compute ground terms. This is notunexpected, since ACL2 is much mor... |

1 |
Term Rewriting and All That. CambridgeUniversity
- Baader, Nipkow
- 1998
(Show Context)
Citation Context ...ion proofs are important as they are used toprove liveness properties, i.e., that some desired behavior is not postponed forever. Proving termination amounts to showing that a relation is well-founded=-=[3]-=-. From a basic theorem of set theory, the Axiom of Choice implies that every well-founded relation can be extended to a total order that is isomorphic to anordinal. Thus, the ordinal numbers provide a... |

1 |
A Computational Logic Handbook. AcademicPress, second edition
- Boyer, Moore
- 1997
(Show Context)
Citation Context ...de within the framework of the ACL2 theorem prover. ACL2 is a logic based on functional Common Lisp [54]. Thelogic is supported by a mechanized theorem proving environment in the BoyerMoore tradition =-=[9]-=-. The acronym ACL2 stands for "A Computational Logicfor Applicative Common Lisp." We briefly describe ACL2 and its relationship to Common Lisp, establishing some relevant background.It is perhaps surp... |

1 |
Metatheory and reflection in theorem proving: Asurvey and critique
- Harrison
- 1995
(Show Context)
Citation Context ...in particular. Semantic attachment was an approach to the more general problem of reflec-tion, which has come to denote the use of computation in a metatheory to derive theorems in a theory. Harrison =-=[25]-=- provides an excellent survey of reflection.For obvious reasons, when soundness is considered of great importance, work on reflection (which is often computation on ground terms in a formal metathe-or... |

1 |
Computer-Aided Reasoning:An Approach
- Kaufmann, Manolios, et al.
- 2000
(Show Context)
Citation Context ...ages. These developments in turn led to increased demand for efficient computation and theeventual abandonment of the home-grown Nqthm version of Pure Lisp. This also led to the decision to base ACL2 =-=[27]-=- on Common Lisp [54] with a wide arrayof development environments with efficient optimizing compilers. The decision to build ACL2 on top of Common Lisp created the need for the formulation ofguards as... |

1 |
Executable JVM model for analytical reasoning:A study
- Liu, Moore
- 2003
(Show Context)
Citation Context ...chitectural design of the world's first silicon Java VirtualMachine which was used as the simulation engine and executed at about 50% of the speed of the previously written C simulator. Liu and Moore =-=[33]-=- describeanother ACL2 model of the Java Virtual Machine, capable of executing many bytecode programs and including support for multiple threads, object creation,method resolution, dynamic class loadin... |

1 |
Ordinal arithmetic: Algorithmsand mechanization. Journal of Automated Reasoning
- Manolios, Vroon
- 2006
(Show Context)
Citation Context ...d efficient algorithms, with complexity analyses, for ordinal arithmetic on the ordinals up to ffl0, using a notational system that isexponentially more succinct than the one used in ACL2 Version 2.7 =-=[36, 39]-=-. The above notations and algorithms were implemented in the ACL2 system,their correctness was mechanically verified, and a library of theorems developed that can be used to significantly automate rea... |

1 |
Synthesis of ML programs in the systemCoq. Journal of Symbolic Computation
- Paulin-Mohring, Werner
- 1993
(Show Context)
Citation Context ...s a means to ensure the correspondence between the axioms and the runtime environment.Since then, many theorem provers have adopted means of efficient computation on ground constants (see for example =-=[53, 1, 42, 18, 22]-=-). Generallyspeaking, the features described here provide the ACL2 user with finer-grained control over the code that is executed to compute ground terms. This is notunexpected, since ACL2 is much mor... |

1 | Verification of an in-place quick-sort in ACL2
- Ray, Sumners
- 1987
(Show Context)
Citation Context ...that modifies a stobj returns that stobj. The restrictions ensure thatexecution using destructive updates on arrays is consistent with the constructive list semantics in the logic. 15sRay and Sumners =-=[45]-=- present an efficient in-place implementation of quick-sort in ACL2 using stobjs, which is similar to the classical imperative implementation of the algorithm. In particular, they define a function so... |

1 |
Mechanicalverification of a rule-based unification algorithm in the Boyer-Moore theorem prover
- Ruiz-Reina, Alonso, et al.
- 1999
(Show Context)
Citation Context ...implementation of a syntactic first-order unification algorithm that uses directed acyclic graphs to represent terms. There exist several previously published unification algorithms verifications (see=-=[43, 47]-=-, for example) but none of them use directed acyclic graphs. In this implementation, some of the auxiliary functions involved in the algorithm needcomputationally expensive conditions in their logical... |

1 |
Common Lisp The Language. Digital Press, second edition,1990. [55] R. Sumners. Correctness proof of a BDD manager in thecontext of satisfiability checking
- Steele
- 2000
(Show Context)
Citation Context ...an approach that has been implemented to support provablycorrect semantic attachment of efficient code within the framework of the ACL2 theorem prover. ACL2 is a logic based on functional Common Lisp =-=[54]-=-. Thelogic is supported by a mechanized theorem proving environment in the BoyerMoore tradition [9]. The acronym ACL2 stands for "A Computational Logicfor Applicative Common Lisp." We briefly describe... |