Dafny export clause in a module - module

Question

module A {
export S reveals f
export M provides g
function f (x:int):int
{x+1}
function g (x:int):int
{x-1}
}
module B {
import opened A`{S,M}
//export K reveals k
//export K provides k
function k (x:int):int
requires f(x) == 0
{x*2}
}
Activating any of the commented export clauses in module B makes the imported function f to be unknown for module B. Some help?

Answer 1

The error message is a bit confusing, or at least subtle. Uncommenting either of the two export K ... declarations produces the following two errors:
This export set is not consistent: K
Raised while checking export set K: unresolved identifier: f
Let me explain. I will focus on the export K provides k declaration; the other is similar.
By declaring an export set, a module makes available a subset of its declarations to the module's importers. The provides clause puts the "signature" of a declaration into the export set, and a reveals clause puts both the "signature" and the "body" of the declaration into the export set. For a function, the "signature" of the declaration includes the function's type signature as well as the function's specification. So, the provides k clause in your example essentially says to export the following portion of the declaration of k:
function k (x:int):int requires f(x) == 0
The relevant thing to notice here is that this portion of the declaration also mentions f. (This is also true for the export declaration with reveal k.)
An export set has to be self consistent. This means that everything mentioned in the exported declarations (more precisely, the exported portions--"signature" or "signature + body"--of the exported declarations) must make sense separately. In particular, this means that every symbol that is mentioned in the portions that are exported (here, the mention of f in the precondition of k) must also be part of the export set.
So, the problem is that you're trying to export k but not f. If f were declared in module B, you would know what to do: just add f to a provides clause of your export set. But in your case, f is declared in module A, not in B. This seems like a problem, because an export set in module B is only allowed to export symbols defined in B.
The problem has a simple solution. To explain it more clearly, let me temporarily change your module B a little:
module B {
import A = A`S
export K provides k
function k (x:int):int requires A.f(x) == 0 {x*2}
}
Here, I'm importing only A`S (not A`M), I'm explicitly showing the local name for A`S (namely, A), and I have omitted the opened keyword. Since I omitted the opened keyword, I also had to qualify the mention of f in k's specification (writing A.f instead of just f).
Okay, in this module B, export set K is still not consistent, because it tries to provide k without providing A.f. More precisely, the second error message now says that A is unresolved. This is good, because (the local name) A is declared in B, which means we can export it. To solve this problem, simply add provides A to the export set:
export K provides k, A
This makes export set K consistent, because every symbol mentioned in the ("signature" portion of the) declaration of k is visible. It is not necessary for K to export f directly, because f is mentioned by .f as a member of A, and A is exported.
Let's work our way back to your example, in four steps.
As a first step, let's change my import declaration to import both of A's export sets, S and M:
import A = A`{S,M}
Here, I'm still showing the local name A explicitly.
As a second step, let's add back the opened keyword:
import opened A = A`{S,M}
This makes it possible to refer to the imported declarations either as qualified (like A.f) or as unqualified (just f).
As a third step, let's make use of the fact that, inside B, we can refer to f as unqualified:
function k (x:int):int requires f(x) == 0 {x*2}
As a fourth and final step to get back to your example, let's omit the explicit local name A in the import declaration. The default local name is the same as the module being imported, namely A. Now, we have the following error-free program:
module B {
import opened A`{S,M}
export K provides k, A
function k (x:int):int requires f(x) == 0 {x*2}
}
I hope this helps.
Rustan