Object-oriented programming languages allow inter-object aliasing. Although necessary to construct linked data structures and networks of interacting objects, aliasing is problematic in that an aggregate object's state can change via an alias to one of its components, without the aggregate being aware of any aliasing. Ownership types form a static type system that indicates object ownership. This provides a flexible mechanism to limit the visibility of object references and restrict access paths to objects, thus controlling a system's dynamic topology. The type system is shown to be sound, and the specific aliasing properties that a system's object graph satisfies are formulated and proven invariant for well-typed programs. Keywords Alias protection, sharing, containment, ownership, representation exposure, programming language design 1

Aliasing is endemic in object oriented programming. Because an object can be modified via any alias, object oriented programs are hard to understand, maintain, and analyse. Flexible alias protection is a conceptual model of inter-object relationships which limits the visibility of changes via aliases, allowing objects to be aliased but mitigating the undesirable effects of aliasing. Flexible alias protection can be checked statically using programmer supplied aliasing modes and imposes no runtime overhead. Using flexible alias protection, programs can incorporate mutable objects, immutable values, and updatable collections of shared objects, in a natural object oriented programming style, while avoiding the problems caused by aliasing.

Ownership types provide a statically enforceable notion of object-level encapsulation. We extend ownership types with computational e#ects to support reasoning about objectoriented programs. The ensuing system provides both access control and e#ects reporting. Based on this type system, we codify two formal systems for reasoning about aliasing and the disjointness of computational e#ects. The first can be used to prove that evaluation of two expressions will never lead to aliases, while the latter can be used to show the non-interference of two expressions.

Aggregation and containment are important concepts in object-oriented modeling. In component-based approaches to software development, aggregation and containment are touted as one of the primary mechanisms for component reuse. Containment relationships are typically implemented with object references in most object-oriented programming languages. This encourages sharing of component objects between aggregates, but does not yield faithful representations of the containment relationships.

Object-oriented programming languages allow inter-object aliasing to represent linked data structures and networks of interacting objects. Aliasing complicates formal reasoning about programs, as it can occur anywhere in a program. In our mode system programs are annotated with modes that indicate object ownership and control the extent of object aliases. By localising aliases, our mode system provides a context for formal reasoning about object systems. Being statically checkable our system offers a practical target for the formal refinement of object-based specifications. 1