ACL2 in DrScheme

Vaillancourt, Dale; Page, Rex; Felleisen, Matthias

doi:10.1145/1217975.1217999

Cited by 17 publications

(11 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Dracula [23] is an extension of the ACL2 theorem prover, implemented as a language level in the DrScheme integrated development environment (IDE) [13]. Dracula uses the DrScheme runtime system to simulate ACL2 programs, and the ACL2 theorem prover to reason about them.…”

Section: Dracula: An Ide For Acl2mentioning

confidence: 99%

Automatic verification for interactive graphical programs

Eastlund

Felleisen

2009

Proceedings of the Eighth International Workshop on the ACL2 Theorem Prover and Its Applications

Self Cite

View full text Add to dashboard Cite

Modern software applications come with interactive graphical displays. In the past, verification efforts for such programs have usually ignored the I/O aspects of programs and focused instead on their core functionality. This approach leaves open the question of how errors in the interactive part of the program can affect its overall functionality.In this paper we present an extension of Dracula (the ACL2 development environment for DrScheme) with a simple graphical framework. With Dracula we can automatically prove theorems about interactive graphical programs, guaranteeing their complete behavior. We have successfully verified theorems about a number of interactive programs with Dracula; we have also successfully used Dracula as a motivational tool to introduce students to the world of automated theorem proving. Formal verification has been applied to other forms of I/O; notably, the Sparkle theorem prover can verify a model of concurrent filesystem operations [9]. We go even further and automatically prove correctness theorems about interactive graphical programs. Our approach relies on an event loop with functional callbacks, exploits images as first-class values, and introduces liveness properties. We use ACL2 [16] because it is the most successful industrialstrength theorem prover. Categories and Subject Descriptors1 ACL2 has verified large projects including commercial floating point processors, a complete micro-processor, and a Java virtual machine.In this paper we present Dracula, the first tool providing automatic theorem proving for interactive, graphical programs. The rest of the paper proceeds as follows. We describe the language and user interface of Dracula in section 2 and its graphical toolkit in section 3. Section 4 explains how we prove theorems about Dracula programs, and section 5 details the projects we have verified. We conclude with section 6 on related work and section 7 to summarize our contribution. Dracula [23] is an extension of the ACL2 theorem prover, implemented as a language level in the DrScheme integrated development environment (IDE) [13]. Dracula uses the DrScheme runtime system to simulate ACL2 programs, and the ACL2 theorem prover to reason about them. Every feature of Dracula comes with both an executable behavior and a logical meaning for ACL2. DRACULA: AN IDE FOR ACL2ACL2 stands for "Applicative Common Lisp: a Computational Logic". It consists of a first-order functional language ("Applicative Common Lisp") and a first-order equational logic ("Computational Logic"). The theorem prover infers induction strategies to prove a programmer's conjectures. Figure 1 shows a small program in ACL2 containing a function plus of two arguments and a conjecture plus-natp 1 campus.acm.org/public/pressroom/press_releases/3_ 2006/software.cfm

show abstract

Section: Dracula: An Ide For Acl2mentioning

confidence: 99%

Automatic verification for interactive graphical programs

Eastlund

Felleisen

2009

Proceedings of the Eighth International Workshop on the ACL2 Theorem Prover and Its Applications

Self Cite

View full text Add to dashboard Cite

show abstract

“…They now use it from the Dracula programming environment [15] [16] in the DrScheme system [8]. This environment provides the type of point-and-click interface that most students are accustomed to and extends ACL2 i/o to include graphics and interactions with keyboard and pointing devices and includes an automated testing facility that generates random tests based on statements of theorems [15].…”

Section: Software Engineeringmentioning

confidence: 99%

Computational logic in the undergraduate curriculum

Page

2009

Proceedings of the Eighth International Workshop on the ACL2 Theorem Prover and Its Applications

Self Cite

View full text Add to dashboard Cite

Logic provides the mathematical basis for hardware design and software development. In fact, digital circuits and computer programs are logic formulas expressed in a formal language. Accordingly, educated computer scientists should have experience in reasoning about the formulas that their digital circuits and programs represent. An exemplary way to get this experience is to use computational logic in support of such reasoning. This paper searches the typical undergraduate curriculum in computer science for opportunities to include material on computational logic in the context of hardware and software design and implementation. It explains how computational logic has been included as an element of two courses required in most computer science programs. It discusses some successes and a few missteps that the author has experienced over the past nine years in developing this material and using it in the classroom, and it suggests opportunities for similar efforts in other courses. Categories and Subject Descriptors General TermsDesign, Reliability, Languages, Verification. KeywordsFormal methods, theorem provers, ACL2, software engineering, computer science curriculum. RATIONALELogic provides the mathematical basis for hardware design and software development. In fact, digital circuits and computer programs are logic formulas expressed in a formal language.Accordingly, educated computer scientists should have experience in reasoning about the formulas that their digital circuits and programs represent. An exemplary way to get this experience is to use computational logic in support of such reasoning.Using ACL2 [10] as a computational logic engine for exposing students to this technology provides some advantages over other choices. It employs the widely used syntax of Common Lisp and smoothly integrates its theorem proving system within this syntax. This is important because it alleviates problems that come with introducing radically new elements into the curriculum. One such problem is resistance from students, computer science faculties, and outside advisors of academic programs. A programming notation in widespread use over a long period is easier to sell than one that has seen less use. Practical applications of ACL2 in industry and government are important in this regard.Another problem has to do with the steepness of the learning curve. Many computational logic systems require a substantial investment of intense study before they begin to pay off. ACL2 presents a relatively simple basis for stating properties of software (and of hardware models), one that most students recognize from their knowledge of predicate calculus. Furthermore, the reasoning engine of ACL2 automatically generates inductive proofs of many correctness properties. This makes it possible for students to succeed early. Once they understand how to state properties as formulas in logic, ACL2 delivers proofs of many of those properties without assistance.The following sections describe experience with computational logic in three cou...

show abstract

“…. $10.00 ACL2 [22,26]. While Page's first course focuses on small, singleprogrammer projects, the second course applies these techniques in a team-programming context.…”

Section: Programs and Proofsmentioning

confidence: 99%

“…Dracula [26], the dialect of ACL2 for the DrScheme programming environment [7], includes a simulation of Modular ACL2's runtime behavior and an interface to the theorem prover for logical verification. Dracula links and runs modules in its own simulation based on figure 9.…”

Section: Implementation and Benchmarksmentioning

confidence: 99%

Making induction manifest in modular ACL2

Eastlund

Felleisen

2009

Proceedings of the 11th ACM SIGPLAN Conference on Principles and Practice of Declarative Programming

Self Cite

View full text Add to dashboard Cite

ACL2, a Common Lisp-based language for programming and theorem proving, has enjoyed industrial success despite lacking modern language features such as a module system. In previous work, we equipped ACL2 with modules, interfaces, and explicit linking and measured our system with a series of experiments. One experiment revealed a serious lack of expressivity; the interfaces cannot describe the induction schemes necessary to reason about exported functions with nontrivial patterns of recursion. In this paper we revise our language, Modular ACL2, to overcome this weakness. The first novelty is the inclusion of manifest function definitions in interfaces from which ACL2 can infer induction schemes. The second novelty consists of the first proofs of soundness and expressivity for Modular ACL2; we also reaffirm the usefulness of our system with updated benchmarks. Categories and Subject Descriptors Programs and ProofsOver the past two decades, a number of industrial labs have adopted ACL2 as a primary tool. The ACL2 system combines a purely functional, first-order subset of Common Lisp with the latest incarnation of the Boyer-Moore theorem prover [12,13]. Roughly speaking, it extends first-order logic with axioms based on the function definitions in a program. Industrial programmers use ACL2 primarily as a modeling language for hardware and low-level software components. A typical usage pattern is to model the component as an ACL2 program, to validate the model with the (very large) preexisting test suite for the component, and then to prove the desired theorems about the component via the model.Four years ago, we started supporting Rex Page's educational project of training software engineering students in high-assurance methods with ACL2 [21]. Page's year-long course sequence introduces students to unit testing, integration testing, random testing, and theorem proving-all available in Dracula, our dialect of * This research was partially supported by several grants from the National Science Foundation.Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. PPDP'09, September 7-9, 2009, Coimbra, Portugal. Copyright c 2009 ACM 978-1-60558-568-0/09/09. . . $10.00 ACL2 [22,26]. While Page's first course focuses on small, singleprogrammer projects, the second course applies these techniques in a team-programming context.The problem for both industrial and educational uses of ACL2 is that its programming language lacks a modern module system, and the theorem prover doesn't support modular reasoning. Modules and interfaces provide scope, abstraction, and specification boundaries, as well as reusable components. These principles are especially important for ACL2. Wit...

show abstract

ACL2 in DrScheme

Cited by 17 publications

References 10 publications

Automatic verification for interactive graphical programs

Automatic verification for interactive graphical programs

Computational logic in the undergraduate curriculum

Making induction manifest in modular ACL2

Contact Info

Product

Resources

About