## The Isabelle Collections Framework

### Cached

### Download Links

Citations: | 12 - 7 self |

### BibTeX

@MISC{Lammich_theisabelle,

author = {Peter Lammich and Andreas Lochbihler},

title = {The Isabelle Collections Framework},

year = {}

}

### OpenURL

### Abstract

The Isabelle Collections Framework (ICF) provides a unified framework for using verified collection data structures in Isabelle/HOL formalizations and generating efficient functional code in ML, Haskell, and OCaml. Thanks to its modularity, it is easily extensible and supports switching to different data structures any time. For good integration with applications, a data refinement approach separates the correctness proofs from implementation details. The generated code based on the ICF lies in better complexity classes than the one that uses Isabelle’s default setup (logarithmic vs. linear time). In a case study with tree automata, we demonstrate that the ICF is easy to use and efficient: An ICF based, verified tree automata library outperforms the unverified Timbuk/Taml library by a factor of 14.

### Citations

717 |
Isabelle/HOL — A Proof Assistant for Higher-Order Logic, volume 2283 of LNCS
- Nipkow, Paulson, et al.
- 2002
(Show Context)
Citation Context ...a, we demonstrate that the ICF is easy to use and efficient: An ICF based, verified tree automata library outperforms the unverified Timbuk/Taml library by a factor of 14. 1 Introduction Isabelle/HOL =-=[15]-=- is an interactive theorem prover for higher order logic. Its code generator [7] extracts (verified) executable code in various functional languages from formalizations. However, the generated code of... |

242 | The Standard Template Library
- Stepanov, Lee
- 1994
(Show Context)
Citation Context ...llections framework that uses type constructor classes and multi-parameter constructor classes. Unfortunately, Isabelle’s type system supports neither of them. The C++ Standard Template Library (STL) =-=[18]-=- provides the abstract concepts for the ICF: concepts (= ADTs), container classes (= implementations), algorithms (= generic algorithm), and iterators. In the STL, iterators are firstclass objects tha... |

107 | An Industrial Strength Theorem Prover for a Logic Based on Common Lisp
- Kaufmann, Moore
- 1997
(Show Context)
Citation Context ...pe definition without losing the capability to generate code. At present, Isabelle does not support this, i.e., the data structure invariants must be carried through all theorems explicitly. For ACL2 =-=[10]-=-, there is a set implementation based on ordered lists, too. For Haskell, Peyton Jones [17] proposes an elegant collections framework that uses type constructor classes and multi-parameter constructor... |

22 | Interpretation of locales in Isabelle: Theories and proof contexts
- Ballarin
(Show Context)
Citation Context ...n within Isabelle/HOL In this section, technical details and challenges of the ICF’s realization within Isabelle/HOL are discussed. Abstract Data Types. The ICF uses Isabelle/HOL’s locale mechanism 6 =-=[1]-=- to specify an ADT. For each ADT, a base locale fixes the data structure invariant and the abstraction function. Each operation is specified by its own locale, which extends the base locale, fixes the... |

17 |
Code generation via higher-order rewrite systems
- Haftmann, Nipkow
- 2010
(Show Context)
Citation Context ...ed tree automata library outperforms the unverified Timbuk/Taml library by a factor of 14. 1 Introduction Isabelle/HOL [15] is an interactive theorem prover for higher order logic. Its code generator =-=[7]-=- extracts (verified) executable code in various functional languages from formalizations. However, the generated code often suffers from being prohibitively slow. Finite sets and maps are represented ... |

12 | Imperative functional programming with Isabelle/HOL
- Bulwahn, Krauss, et al.
- 2008
(Show Context)
Citation Context ...de into strings of integers, which must be injective. For natural numbers, e.g., we compute the 16-adic representation starting with the lowest digit, i.e. 1000 = 3 · 16 2 + 14 · 16 + 8 is encoded as =-=[8, 14, 3]-=-. The type class for this encoding pairs every encode function with a left-inverse partial function decode that decodes the strings. Since encode is one-to-one, only countable types may be used as key... |

12 | Bulk types with class
- Jones
- 1996
(Show Context)
Citation Context ... support this, i.e., the data structure invariants must be carried through all theorems explicitly. For ACL2 [10], there is a set implementation based on ordered lists, too. For Haskell, Peyton Jones =-=[17]-=- proposes an elegant collections framework that uses type constructor classes and multi-parameter constructor classes. Unfortunately, Isabelle’s type system supports neither of them. The C++ Standard ... |

8 | Formalizing the Logic-Automaton Connection
- Berghofer, Reiter
(Show Context)
Citation Context ...es are scattered across other projects, thus limiting code reuse. For example, Berghofer and Reiter implemented tries for binary strings (called BDDs there), within a solver for Presburger arithmetic =-=[2]-=-. This paper presents the Isabelle Collections Framework (ICF) that addresses the above problems. The main contribution is a unified framework (Sec. 2) todefine and use verified collection data struc... |

7 |
The normal number of prime factors of a number n, Quart
- Hardy, Ramanujan
(Show Context)
Citation Context ...de into strings of integers, which must be injective. For natural numbers, e.g., we compute the 16-adic representation starting with the lowest digit, i.e. 1000 = 3 · 16 2 + 14 · 16 + 8 is encoded as =-=[8, 14, 3]-=-. The type class for this encoding pairs every encode function with a left-inverse partial function decode that decodes the strings. Since encode is one-to-one, only countable types may be used as key... |

3 | Tree automata
- Lammich
- 2009
(Show Context)
Citation Context ...e standard code generator setup and to library data structures of Haskell, OCaml, and Java. (ii) To demonstrate its usability in a case study, we implemented a formally verified tree-automata library =-=[13]-=- based on the ICF, using the data refinement approach. The ICF based tree-automata library outperforms the OCaml-based Timbuk/Taml library [6] by a factor of 14 and is competitive with the Java librar... |

2 | Formal Certification of a Resource-Aware Language Implementation - Dios, Peña |

2 |
Isabelle collection library
- Lammich
- 2009
(Show Context)
Citation Context ...library outperforms the OCaml-based Timbuk/Taml library [6] by a factor of 14 and is competitive with the Java library LETHAL [14]. The ICF is published electronically in the Archive of Formal Proofs =-=[12]-=-. As the AFP is only updated with new Isabelle releases, a more recent version may be available at http://cs.uni-muenster.de/sev/projects/icf/. 1.1 Related Work Most interactive theorem provers provid... |

1 |
V.V.T.: Timbuk 2.2. http://www.irisa.fr/celtique/genet/timbuk
- Genet, Tong
(Show Context)
Citation Context ...we implemented a formally verified tree-automata library [13] based on the ICF, using the data refinement approach. The ICF based tree-automata library outperforms the OCaml-based Timbuk/Taml library =-=[6]-=- by a factor of 14 and is competitive with the Java library LETHAL [14]. The ICF is published electronically in the Archive of Formal Proofs [12]. As the AFP is only updated with new Isabelle releases... |

1 |
Binary search trees
- Kuncak
(Show Context)
Citation Context ...t obtained via formal verification. There are some Isabelle/HOL formalizations of efficient collection data structures such as red-black trees (RBT), AVL trees [16], and unbalanced binarysearch trees =-=[11]-=-, each providing its own proprietary interface. This forces the user to chose the data structures at the start of formalization, and severely hinders switching to another data structure later. Moreove... |

1 |
C.: AVL trees
- Nipkow, Pusch
(Show Context)
Citation Context ...nerated, they in fact undermine the trust obtained via formal verification. There are some Isabelle/HOL formalizations of efficient collection data structures such as red-black trees (RBT), AVL trees =-=[16]-=-, and unbalanced binarysearch trees [11], each providing its own proprietary interface. This forces the user to chose the data structures at the start of formalization, and severely hinders switching ... |