EPTCS 280 Proceedings of the 15th International Workshop on the ACL2 Theorem Prover and Its Applications Austin, Texas, USA, November 5-6, 2018 Edited by: Shilpi Goel and Matt Kaufmann Published: 29th October 2018 DOI: 10.4204/EPTCS.280 ISSN: 2075-2180 Open Publishing Association i Table of Contents TableofContents .................................... ...................................... i Preface............................................ ........................................ iii Shilpi Goel and Matt Kaufmann A Simple Java Code Generator for ACL2 Based on a Deep EmbeddingofACL2inJava.......... 1 Alessandro Coglio Formalising Filesystems in the ACL2 Theorem Prover: an Application to FAT32 . 18 Mihir Parang Mehta Trapezoidal Generalization over Linear Constraints . ....................................... 30 David Greve and Andrew Gacek Incremental SAT Library Integration Using Abstract Stobjs..................................... 47 Sol Swords Using ACL2 in the Design of Efficient, Verifiable Data Structures for High-Assurance Systems . 61 David Hardin and Konrad Slind Adding 32-bit Mode to the ACL2 Model of the x86 ISA . ............................. 77 Alessandro Coglio and Shilpi Goel A Toolbox For Property Checking From Simulation Using Incremental SAT (Extended Abstract) . 95 Rob Sumners The Fundamental Theorem of Algebra in ACL2 . ................................ 98 Ruben Gamboa and John Cowles Real Vector Spaces and the Cauchy-Schwarz Inequality in ACL2(r).............................111 Carl Kwan and Mark R. Greenstreet ConvexFunctions inACL2(r)........................... ....................................128 Carl Kwan and Mark R. Greenstreet Smtlink2.0......................................... .......................................143 Yan Peng and Mark R. Greenstreet DefunT: A Tool for Automating Termination Proofs by Using the Community Books (Extended Abstract).......................................... ........................................161 Matt Kaufmann ii Hint Orchestration Using ACL2’s Simplifier . ....................................164 Sol Swords Preface This volume contains the proceedings of the Fifteenth International Workshop on the ACL2 Theorem Prover and Its Applications (ACL2-2018), a two-day workshop held in Austin, Texas, USA, on Novem- ber 5-6, 2018, immediately after FMCAD (http://www.fmcad.org/FMCAD18), on the University of Texas campus. ACL2 workshops occur at approximately 18-month intervals, and they provide a major technical forum for users of the ACL2 theorem proving system to present research related to the ACL2 theorem prover and its applications. ACL2 is an industrial-strength automated reasoning system, the latest in the Boyer-Moore family of theorem provers. The 2005 ACM Software System Award was awarded to Boyer, Kaufmann, and Moore for their work in ACL2 and the other theorem provers in the Boyer-Moore family. The proceedings of ACL2-2018 include eleven long papers and two extended abstracts. Each sub- mission received three reviews. The workshop also included several “rump session” talks — short un- published presentations that discussed ongoing research — as well as three invited talks: - Small Team, Short Ramp, Industrial-scale Problems: Some Experiments in the Practicum of Inter- active Theorem Proving — Sandip Ray (University of Florida) - Creating Formal Specifications of the Arm Processor Architecture — Alastair Reid (ARM) - Building Blocks for RTL Verification in ACL2 — Sol Swords (Centaur Technology) This workshop would not have been possible without the support of a large number of people. We thank our generous sponsors, Centaur Technology and Oracle Corporation. We thank those who con- tributed papers, as well as the members of the Program Committee for providing careful reviews and for engaging in lively discussion. We thank the members of the Steering Committee for their help and guidance. We are grateful to the invited speakers for sharing their insights. We thank The University of Texas (UT Austin), Warren Hunt, Jr., and Lindy Aleshire for helping us to get a venue for our workshop. We thank EasyChair, EPTCS, arXiv, and RegOnline for providing assistance with the logistics of the workshop. Thanks are also due to David Rager for helping us administer registration. We are also grate- ful for support of our time spent on workshop preparations from Centaur Technology, UT Austin, the Kestrel Institute, and DARPA under Contract Nos. FA8650-17-1-7704 and FA8750-15-C-0007. Last, but not least, we thank Mertcan Temel for his assistance with local arrangements. It has been a pleasure and an honor to chair this event. Shilpi Goel and Matt Kaufmann November, 2018 Shilpi Goel and Matt Kaufmann (Eds.): c Goel and Kaufmann ACL2 Theorem Prover and its Applications (ACL2-2018) This work is licensed under the EPTCS 280, 2018, pp. iii–iv, doi:10.4204/EPTCS.280.0 Creative Commons Attribution License. iv Preface ACL2 2018 Program Committee Harsh Chamarthi Intel AlessandroCoglio KestrelInstitute Jared Davis Apple RubenGamboa UniversityofWyoming ShilpiGoel CentaurTechnology Dave Greve Rockwell-Collins WarrenHunt TheUniversityofTexas Sebastiaan Joosten University of Twente MattKaufmann TheUniversityofTexas John O’Leary Intel Grant Passmore AestheticIntegration David Rager Oracle SandipRay UniversityofFlorida David Russinoff ARM Julien Schmaltz Eindhoven University of Technology AnnaSlobodova CentaurTechnology EricSmith KestrelInstitute SolSwords CentaurTechnology A Simple Java Code Generator for ACL2 Based on a Deep Embedding of ACL2 in Java Alessandro Coglio Kestrel Institute http://www.kestrel.edu AIJ (ACL2 In Java) is a deep embedding in Java of an executable, side-effect-free, non-stobj- accessing subset of the ACL2 language without guards. ATJ (ACL2 To Java) is a simple Java code generator that turns ACL2 functions into AIJ representations that are evaluated by the AIJ interpreter. AIJ and ATJ enable possibly verified ACL2 code to run as, and interoperate with, Java code, without much of the ACL2 framework or any of the Lisp runtime. The current speed of the resulting Java code may be adequate to some applications. 1 Motivation and Contributions A benefit of writing code in a theorem prover is the ability to prove properties about it, such as the satis- faction of requirements specifications. A facility to generate code in one or more programming languages from an executable subset of the prover’s logical language enables the possibly verified code to run as, and interoperate with, code written in those programming languages. Assuming the correctness of code generation (whose verification is a separable problem, akin to compilation verification) the properties proved about the original code carry over to the generated code. The ACL2 theorem provers’s tight integration with the underlying Lisp platform enables the exe- cutable subset of the ACL2 logical language to run readily and efficiently as Lisp, without the need for explicit code generation facilities. Nonetheless, some situations may call for running ACL2 code in other programming languages: specifically, when the ACL2 code must interoperate with external code in those programming languages in a more integrated and efficient way than afforded by inter-language commu- nication via foreign function interfaces [4, 9], or by inter-process communication with the ACL2/Lisp runtime via mechanisms like the ACL2 Bridge [2, :doc bridge]. Using Lisp implementations written in the target programming languages [1] involves not only porting ACL2 to them, but also including much more runtime code than necessary for the target applications. Compilers from Lisp to the target programming languages may need changes or wrappers, because executable ACL2 is not quite a subset of Lisp; furthermore, the ability to compile non-ACL2 Lisp code is an unnecessary complication as far as ACL2 compilation is concerned, making potential verification harder. The work described in this paper contributes to the goal of running ACL2 code in other programming languages in the integrated manner described above: • ATJ (ACL2 To Java) is a Java code generator for ACL2. ATJ translates executable, side-effect- free, non-stobj-accessing ACL2 functions, without their guards, into Java. It does so in a simple way, by turning the functions into deeply embedded Java representations that are executed by an ACL2 evaluator written in Java. • AIJ (ACL2 In Java) is a deep embedding in Java of an executable, side-effect-free, non-stobj- accessing subset of the ACL2 language without guards. AIJ consists of (i) a Java representation of the ACL2 values, terms, and environment, (ii) a Java implementation of the ACL2 primitive Shilpi Goel and Matt Kaufmann (Eds.): © Alessandro Coglio ACL2 Theorem Prover and its Applications (ACL2-2018) This work is licensed under the EPTCS 280, 2018, pp. 1–17, doi:10.4204/EPTCS.280.1 Creative Commons Attribution License. 2 Java Code Generator and Deep Embedding functions, and (iii) an ACL2 evaluator written in Java. AIJ executes the deeply embedded Java representations of ACL2 functions generated by ATJ. AIJ is of independent interest and can be used without ATJ. The ACL2 language subset supported by ATJ and AIJ includes all the values, all the primitive functions, and many functions with raw Lisp code—see Section 2 for details on these two kinds of functions. The initial implementation of AIJ favored assurance over efficiency: it was quite simple, to reduce the chance of errors and facilitate its potential verification, but it was also quite slow. The careful