Lem

Abstract

Recent years have seen remarkable successes in rigorous engineering: using mathematically rigorous semantic models (not just idealised calculi) of real-world processors, programming languages, protocols, and security mechanisms, for testing, proof, analysis, and design. Building these models is challenging, requiring experimentation, dialogue with vendors or standards bodies, and validation; their scale adds engineering issues akin to those of programming to the task of writing clear and usable mathematics. But language and tool support for specification is lacking. Proof assistants can be used but bring their own difficulties, and a model produced in one, perhaps requiring many person-years effort and maintained over an extended period, cannot be used by those familiar with another.We introduce Lem, a language for engineering reusable largescale semantic models. The Lem design takes inspiration both from functional programming languages and from proof assistants, and Lem definitions are translatable into OCaml for testing, Coq, HOL4, and Isabelle/HOL for proof, and LaTeX and HTML for presentation. This requires a delicate balance of expressiveness, careful library design, and implementation of transformations -akin to compilation, but subject to the constraint of producing usable and human-readable code for each target. Lem's effectiveness is demonstrated by its use in practice.

Simplifying ARM concurrency: multicopy-atomic axiomatic and operational models for ARMv8

“…The axiomatic model can then be expressed using just inductive definitions of binary relations, e.g. as in the herd model definition language, whereas the enumeration of operational model transitions requires a more expressive metalanguage Ð it is essentially a typed pure terminating functional program (or higher-order-logic definition), in lem [Mulligan et al 2014].…”

QED at Large: A Survey of Engineering of Formally Verified Software

“…The more general proof assistant-agnostic specification language Lem (Mulligan et al, 2014) also includes definition of recursive functions and other programming language constructs, as well as a standard library useful for semantic definitions. Ott files can be exported to Lem format and thus incorporated into larger definitions.…”

Executable formal semantics for the POSIX shell

“…Approaches to such whole-language semantics fall broadly into two styles of modeling: large semantics that cover a broad range of language constructs, using light syntactic sugar; and small semantics that cover a narrow range of language constructs, using heavy syntactic sugar/elaboration. K and Lem epitomize the former style [Mulligan et al 2014;Roşu and Şerbănuţă 2010], while λ JS is emblematic of the latter style, defining a small calculus to which it elaborates JavaScript [Guha et al 2010]. Why did we choose the large semantics route?…”

“…Even though it is a completely usable shell, the mechanized small-step operational semantics for Smoosh is relatively compact: the two core stepping functions (Section 5) are a combined total of 1 034 SLOC of Lem [Mulligan et al 2014]. The small-step nature of the semantics makes it easy to capture and report information.…”