VLISP A Verified Implementation of Scheme

The VLISP project showed how to produce a comprehensively verified implemen­ tation for a programming language, namely Scheme [4, 15). Some of the major elements in this verification were: • The proof was based on the Clinger-Rees denotational semantics of Scheme given in [15). Our goal was to produce a "warts-and-all" verification of a real language. With very few exceptions, we constrained ourselves to use the se­ mantic specification as published. The verification was intended to be rigorous,