## Toward a practical module system for ACL2 (2009)

Venue: | Proc. of the 11th International Symposium on Practical Aspects of Declarative Languages |

Citations: | 4 - 1 self |

### BibTeX

@INPROCEEDINGS{Eastlund09towarda,

author = {Carl Eastlund and Matthias Felleisen},

title = {Toward a practical module system for ACL2},

booktitle = {Proc. of the 11th International Symposium on Practical Aspects of Declarative Languages},

year = {2009},

pages = {46--60}

}

### OpenURL

### Abstract

Abstract. Boyer and Moore’s ACL2 theorem prover combines firstorder applicative Common Lisp with a computational, first-order logic. While ACL2 has become popular and is being used for large programs, ACL2 forces programmers to rely on manually maintained protocols for managing modularity. In this paper, we present a prototype of Modular ACL2. The system extends ACL2 with a simple, but pragmatic functional module system. We provide an informal introduction, sketch a formal semantics, and report on our first experiences. 1 A logic for Common Lisp, Modules for ACL2 In the early 1980s, the Boyer and Moore team decided to re-build their Nqthm theorem prover [1] for a first-order, functional sub-language of a standardized, industrial programming language: Common Lisp [2]. It was an attempt to piggyback theorem proving on the expected success of Lisp and functional programming. Although Common Lisp didn’t succeed, the ACL2 system became the most widely used theorem prover in industry. Over the past 20 years, numerous hardware companies and some software companies turned to ACL2 to verify critical pieces of their products [3]; by 2006, their contributions to the ACL2 regression test suite amounted to over one million lines of code. The ACL2 team received the 2005 ACM Systems Award for their achievement. 1 During the same 20 years, programming language theory and practice have evolved, too. In particular, programming language designers have designed, implemented, and experimented with numerous module systems for managing large functional programs [4]. One major goal of these design efforts has been to help programmers reason locally about their code. That is, a module should express its expectations about imports, and all verification efforts for definitions in a module should be conducted with respect to these expectations. Common Lisp and thus ACL2, however, lack a proper module system. Instead, ACL2 programmers emulate modular programming with Common Lisp’s namespace management mechanisms, or by hiding certain program fragments from the theorem prover. Naturally, the manual maintenance of abstraction boundaries is difficult and error prone. Worse, it forces the programmer to choose between local reasoning and end-to-end execution, as functions hidden from the theorem prover cannot be run.

### Citations

188 | Units: Cool modules for HOT languages
- Flatt, Felleisen
- 1998
(Show Context)
Citation Context ...ks between modules, specified via interfaces. The other one is to think of modules as relations from interfaces to interfaces and to link modules separately. Based on our experience with Scheme units =-=[8, 9]-=- and ML functors [4], we have chosen the second alternative. Finally, we also decided to separate module invocation from module linking. The rest of the section presents a model of Modular ACL2, its s... |

89 | Modularity meets inheritance
- Bracha, Lindstrom
- 1992
(Show Context)
Citation Context ...s interfaces and verifying their correct implementation as exports.5 Related Work The design of the module system derives from PLT Scheme’s unit system [8, 9], with linking semantics based on mixins =-=[10, 11]-=-. More precisely, Modular ACL2 contributes contracts to the unit model, but inherits the idea of linking primitive and compound modules in hierarchical shape. It subtracts recursive linking as this wo... |

78 | IMPS: An interactive mathematical proof system
- Farmer, Guttman, et al.
- 1990
(Show Context)
Citation Context ...s leading, general-purpose, automated theorem prover. Some theorem proving languages also provide named scopes, such as Isabelle’s locales [17], Coq’s sections [18], and the “little theories” of IMPS =-=[19]-=-. These scopes allow local and global definitions, and export the global ones by translating or abstracting over the local ones. They provide a lightweight approach to abstraction and namespace manage... |

35 | Locales: A sectioning concept for Isabelle
- Kammüller, Wenzel, et al.
- 1999
(Show Context)
Citation Context ...m prover. In contrast, Modular ACL2 is based on the industry’s leading, general-purpose, automated theorem prover. Some theorem proving languages also provide named scopes, such as Isabelle’s locales =-=[17]-=-, Coq’s sections [18], and the “little theories” of IMPS [19]. These scopes allow local and global definitions, and export the global ones by translating or abstracting over the local ones. They provi... |

34 | Formal program development in Extended ML for the working programmer
- Sannella
- 1990
(Show Context)
Citation Context ...ct induction schemes, the inexpressibility of higher-order logical statements such as a module’s proof obligation, and the lack of execution-preserving proof abstraction mechanisms. Extended ML (EML) =-=[15]-=- equips SML [16] with logical properties and a verification semantics. The language is designed around the methodology of beginning with an abstract specification and refining it step-by-step to a con... |

31 |
Computer-Aided Reasoning: ACL2 Case Studies
- Kaufmann, Manolios, et al.
- 2000
(Show Context)
Citation Context ...stem became the most widely used theorem prover in industry. Over the past 20 years, numerous hardware companies and some software companies turned to ACL2 to verify critical pieces of their products =-=[3]-=-; by 2006, their contributions to the ACL2 regression test suite amounted to over one million lines of code. The ACL2 team received the 2005 ACM Systems Award for their achievement. 1 During the same ... |

25 |
Design considerations for MLstyle module systems
- Harper, Pierce
- 2005
(Show Context)
Citation Context ...e theory and practice have evolved, too. In particular, programming language designers have designed, implemented, and experimented with numerous module systems for managing large functional programs =-=[4]-=-. One major goal of these design efforts has been to help programmers reason locally about their code. That is, a module should express its expectations about imports, and all verification efforts for... |

24 |
From structures and functors to modules and units
- Owens, Flatt
- 2006
(Show Context)
Citation Context ...ks between modules, specified via interfaces. The other one is to think of modules as relations from interfaces to interfaces and to link modules separately. Based on our experience with Scheme units =-=[8, 9]-=- and ML functors [4], we have chosen the second alternative. Finally, we also decided to separate module invocation from module linking. The rest of the section presents a model of Modular ACL2, its s... |

23 | A module calculus for pure type systems
- Courant
- 1997
(Show Context)
Citation Context ...tracts to the unit model, but inherits the idea of linking primitive and compound modules in hierarchical shape. It subtracts recursive linking as this would complicate ACL2’s termination proofs. Coq =-=[12, 13]-=-, Twelf [14], and similar proof assistants adopt an ML-like module system for encapsulating proofs about metatheory. Our modules and interfaces correspond closely to ML’s functors and signatures. Modu... |

20 |
A module system for a programming language based on the LF logical framework
- Harper, Pfenning
- 1992
(Show Context)
Citation Context ...it model, but inherits the idea of linking primitive and compound modules in hierarchical shape. It subtracts recursive linking as this would complicate ACL2’s termination proofs. Coq [12, 13], Twelf =-=[14]-=-, and similar proof assistants adopt an ML-like module system for encapsulating proofs about metatheory. Our modules and interfaces correspond closely to ML’s functors and signatures. Modular ACL2 can... |

16 | Mixin’ up the ML module system
- Dreyer, Rossberg
- 2008
(Show Context)
Citation Context ...s interfaces and verifying their correct implementation as exports.5 Related Work The design of the module system derives from PLT Scheme’s unit system [8, 9], with linking semantics based on mixins =-=[10, 11]-=-. More precisely, Modular ACL2 contributes contracts to the unit model, but inherits the idea of linking primitive and compound modules in hierarchical shape. It subtracts recursive linking as this wo... |

11 |
Implementing Modules in the Coq System
- Chrzaszcz
- 2003
(Show Context)
Citation Context ...tracts to the unit model, but inherits the idea of linking primitive and compound modules in hierarchical shape. It subtracts recursive linking as this would complicate ACL2’s termination proofs. Coq =-=[12, 13]-=-, Twelf [14], and similar proof assistants adopt an ML-like module system for encapsulating proofs about metatheory. Our modules and interfaces correspond closely to ML’s functors and signatures. Modu... |

10 |
M.: ACL2 in DrScheme
- Vaillancourt, Page, et al.
- 2006
(Show Context)
Citation Context ...aching a senior-level course sequence on software engineering in ACL2 [5]. Students reported difficulty with the text-based interface to ACL2; in response, Felleisen and Vaillancourt produced Dracula =-=[6]-=- as a graphical user interface for ACL2. Dracula has since been used in courses on software engineering and symbolic logic [7]. Dracula. Dracula is a language level in the DrScheme integrated developm... |

6 |
G.L.: Common Lisp—The Language
- Jr
- 1984
(Show Context)
Citation Context ...the early 1980s, the Boyer and Moore team decided to re-build their Nqthm theorem prover [1] for a first-order, functional sub-language of a standardized, industrial programming language: Common Lisp =-=[2]-=-. It was an attempt to piggyback theorem proving on the expected success of Lisp and functional programming. Although Common Lisp didn’t succeed, the ACL2 system became the most widely used theorem pr... |

6 |
ACL2 for freshmen— first experiences
- Eastlund, Vaillancourt, et al.
- 2007
(Show Context)
Citation Context ...terface to ACL2; in response, Felleisen and Vaillancourt produced Dracula [6] as a graphical user interface for ACL2. Dracula has since been used in courses on software engineering and symbolic logic =-=[7]-=-. Dracula. Dracula is a language level in the DrScheme integrated development environment. It provides a simulation of Applicative Common Lisp (ACL), the executable component of ACL2. Dracula incorpor... |

5 |
Mechanized reasoning about programs and computing machines
- Boyer, Moore
- 1996
(Show Context)
Citation Context ...sketch a formal semantics, and report on our first experiences. 1 A logic for Common Lisp, Modules for ACL2 In the early 1980s, the Boyer and Moore team decided to re-build their Nqthm theorem prover =-=[1]-=- for a first-order, functional sub-language of a standardized, industrial programming language: Common Lisp [2]. It was an attempt to piggyback theorem proving on the expected success of Lisp and func... |

5 | Engineering software correctness
- Page
- 2007
(Show Context)
Citation Context ...ocally about individual modules. One goal is to empower ACL2 programmers with large code bases to gradually migrate their monolithic program into a modular world. Another goal is to expand Rex Page’s =-=[5]-=- use of this industrial-strength theorem prover in software engineering courses to teach theorem proving in a modular setting. Without modules, such a software engineering course simply isn’t convinci... |

1 |
D.: The Definition of Standard ML (2e
- Milner, Tofte, et al.
- 1990
(Show Context)
Citation Context ...emes, the inexpressibility of higher-order logical statements such as a module’s proof obligation, and the lack of execution-preserving proof abstraction mechanisms. Extended ML (EML) [15] equips SML =-=[16]-=- with logical properties and a verification semantics. The language is designed around the methodology of beginning with an abstract specification and refining it step-by-step to a concrete implementa... |