Results 11  20
of
131
Semantics of Types for Mutable State
, 2004
"... Proofcarrying code (PCC) is a framework for mechanically verifying the safety of machine language programs. A program that is successfully verified by a PCC system is guaranteed to be safe to execute, but this safety guarantee is contingent upon the correctness of various trusted components. For in ..."
Abstract

Cited by 60 (4 self)
 Add to MetaCart
(Show Context)
Proofcarrying code (PCC) is a framework for mechanically verifying the safety of machine language programs. A program that is successfully verified by a PCC system is guaranteed to be safe to execute, but this safety guarantee is contingent upon the correctness of various trusted components. For instance, in traditional PCC systems the trusted computing base includes a large set of lowlevel typing rules. Foundational PCC systems seek to minimize the size of the trusted computing base. In particular, they eliminate the need to trust complex, lowlevel type systems by providing machinecheckable proofs of type soundness for real machine languages. In this thesis, I demonstrate the use of logical relations for proving the soundness of type systems for mutable state. Specifically, I focus on type systems that ensure the safe allocation, update, and reuse of memory. For each type in the language, I define logical relations that explain the meaning of the type in terms of the operational semantics of the language. Using this model of types, I prove each typing rule as a lemma. The major contribution is a model of System F with general references — that is, mutable cells that can hold values of any closed type including other references, functions, recursive types, and impredicative quantified types. The model is based on ideas from both possible worlds and the indexed model of Appel and McAllester. I show how the model of mutable references is encoded in higherorder logic. I also show how to construct an indexed possibleworlds model for a von Neumann machine. The latter is used in the Princeton Foundational PCC system to prove type safety for a fullfledged lowlevel typed assembly language. Finally, I present a semantic model for a region calculus that supports typeinvariant references as well as memory reuse. iii
A bisimulation for type abstraction and recursion
 SYMPOSIUM ON PRINCIPLES OF PROGRAMMING LANGUAGES
, 2005
"... We present a bisimulation method for proving the contextual equivalence of packages in λcalculus with full existential and recursive types. Unlike traditional logical relations (either semantic or syntactic), our development is “elementary, ” using only sets and relations and avoiding advanced mach ..."
Abstract

Cited by 54 (6 self)
 Add to MetaCart
(Show Context)
We present a bisimulation method for proving the contextual equivalence of packages in λcalculus with full existential and recursive types. Unlike traditional logical relations (either semantic or syntactic), our development is “elementary, ” using only sets and relations and avoiding advanced machinery such as domain theory, admissibility, and ⊤⊤closure. Unlike other bisimulations, ours is complete even for existential types. The key idea is to consider sets of relations—instead of just relations—as bisimulations.
A Variable Typed Logic of Effects
 Information and Computation
, 1993
"... In this paper we introduce a variable typed logic of effects inspired by the variable type systems of Feferman for purely functional languages. VTLoE (Variable Typed Logic of Effects) is introduced in two stages. The first stage is the firstorder theory of individuals built on assertions of equalit ..."
Abstract

Cited by 50 (13 self)
 Add to MetaCart
(Show Context)
In this paper we introduce a variable typed logic of effects inspired by the variable type systems of Feferman for purely functional languages. VTLoE (Variable Typed Logic of Effects) is introduced in two stages. The first stage is the firstorder theory of individuals built on assertions of equality (operational equivalence `a la Plotkin), and contextual assertions. The second stage extends the logic to include classes and class membership. The logic we present provides an expressive language for defining and studying properties of programs including program equivalences, in a uniform framework. The logic combines the features and benefits of equational calculi as well as program and specification logics. In addition to the usual firstorder formula constructions, we add contextual assertions. Contextual assertions generalize Hoare's triples in that they can be nested, used as assumptions, and their free variables may be quantified. They are similar in spirit to program modalities in ...
Dynamic Opacity for Abstract Types
"... Existential types are the standard formalisation of abstract types. While this formulation is sufficient in entirely statically typed languages, it proves to be too weak for languages enriched with forms of dynamic typing: in the presence of operations performing type analysis, the abstraction barri ..."
Abstract

Cited by 47 (10 self)
 Add to MetaCart
Existential types are the standard formalisation of abstract types. While this formulation is sufficient in entirely statically typed languages, it proves to be too weak for languages enriched with forms of dynamic typing: in the presence of operations performing type analysis, the abstraction barrier erected by the static typing rules for existential types is no longer impassable, because parametricity is violated. We present a lightweight calculus for polymorphic languages with abstract types that addresses this shortcoming. It features a variation of existential types that retains most of the simplicity of standard existentials. It relies on modified scoping rules and explicit coercions between the quantified variable and its witness type.
Categorical Models for Local Names
 LISP AND SYMBOLIC COMPUTATION
, 1996
"... This paper describes the construction of categorical models for the nucalculus, a language that combines higherorder functions with dynamically created names. Names are created with local scope, they can be compared with each other and passed around through function application, but that is all. T ..."
Abstract

Cited by 46 (2 self)
 Add to MetaCart
This paper describes the construction of categorical models for the nucalculus, a language that combines higherorder functions with dynamically created names. Names are created with local scope, they can be compared with each other and passed around through function application, but that is all. The intent behind this language is to examine one aspect of the imperative character of Standard ML: the use of local state by dynamic creation of references. The nucalculus is equivalent to a certain fragment of ML, omitting side effects, exceptions, datatypes and recursion. Even without all these features, the interaction of name creation with higherorder functions can be complex and subtle; it is particularly difficult to characterise the observable behaviour of expressions. Categorical monads, in the style of Moggi, are used to build denotational models for the nucalculus. An intermediate stage is the use of a computational metalanguage, which distinguishes in the type system between values and computations. The general requirements for a categorical model are presented, and two specific examples described in detail. These provide a sound denotational semantics for the nucalculus, and can be used to reason about observable equivalence in the language. In particular a model using logical relations is fully abstract for firstorder expressions.
Compilation by Transformation in NonStrict Functional Languages
, 1995
"... In this thesis we present and analyse a set of automatic sourcetosource program transformations that are suitable for incorporation in optimising compilers for lazy functional languages. These transformations improve the quality of code in many different respects, such as execution time and memory ..."
Abstract

Cited by 42 (1 self)
 Add to MetaCart
In this thesis we present and analyse a set of automatic sourcetosource program transformations that are suitable for incorporation in optimising compilers for lazy functional languages. These transformations improve the quality of code in many different respects, such as execution time and memory usage. The transformations presented are divided in two sets: global transformations, which are performed once (or sometimes twice) during the compilation process; and a set of local transformations, which are performed before and after each of the global transformations, so that they can simplify the code before applying the global transformations and also take advantage of them afterwards. Many of the local transformations are simple, well known, and do not have major effects on their own. They become important as they interact with each other and with global transformations, sometimes in nonobvious ways. We present how and why they improve the code, and perform extensive experiments wit...
The definition of Extended ML: a gentle introduction
 THEORETICAL COMPUTER SCIENCE
, 1995
"... Extended ML (EML) is a framework for the formal development of modular Standard ML (SML) software systems. Development commences with a specification of the behaviour required and proceeds via a sequence of partial solutions until a complete solution, an executable SML program, is obtained. All s ..."
Abstract

Cited by 37 (11 self)
 Add to MetaCart
Extended ML (EML) is a framework for the formal development of modular Standard ML (SML) software systems. Development commences with a specification of the behaviour required and proceeds via a sequence of partial solutions until a complete solution, an executable SML program, is obtained. All stages in this development process are expressed in the EML language, an extension of SML with axioms for describing properties of module components. This is an overview of the formal definition of the EML language. To complement the full technical details presented elsewhere, it provides an informal explanation of the main ideas, gives the rationale for certain design decisions, and outlines some of the technical issues involved. EML is unusual in being built around a "real" programming language having a formallydefined syntax and semantics. Interesting and complex problems arise both from the nature of this relationship and from interactions between the features of the language.
A Functional Theory of Local Names
, 1994
"... ## is an extension of the #calculus with a binding construct for local names. The extension has properties analogous to classical #calculus and preserves all observational equivalences of #. It is useful as a basis for modeling widespectrum languages that build on a functional core. 1 Introducti ..."
Abstract

Cited by 35 (2 self)
 Add to MetaCart
## is an extension of the #calculus with a binding construct for local names. The extension has properties analogous to classical #calculus and preserves all observational equivalences of #. It is useful as a basis for modeling widespectrum languages that build on a functional core. 1 Introduction Recentyears have given us a good deal of theoretical research on the interaction of imperative programming #exempli#ed byvariable assignment# and functional programming #exempli#ed by higher order functions# #3,6,19,21, 24#. The common method of all these works is to propose a #calculus extended with imperative features and to carry out an exploration of the operational semantics of the new calculus. Based on our own experience in devising such an extended # calculus #13#, the presentwork singles out the name, whose only observational property is its identity, as an essential componentofany such extension. We present a simple extension of the pure #calculus with names; we showby ex...
Imperative selfadjusting computation
 In POPL ’08: Proceedings of the 35th annual ACM SIGPLANSIGACT symposium on Principles of programming languages
, 2008
"... Recent work on selfadjusting computation showed how to systematically write programs that respond efficiently to incremental changes in their inputs. The idea is to represent changeable data using modifiable references, i.e., a special data structure that keeps track of dependencies between read an ..."
Abstract

Cited by 35 (17 self)
 Add to MetaCart
(Show Context)
Recent work on selfadjusting computation showed how to systematically write programs that respond efficiently to incremental changes in their inputs. The idea is to represent changeable data using modifiable references, i.e., a special data structure that keeps track of dependencies between read and writeoperations, and to let computations construct traces that later, after changes have occurred, can drive a change propagation algorithm. The approach has been shown to be effective for a variety of algorithmic problems, including some for which adhoc solutions had previously remained elusive. All previous work on selfadjusting computation, however, relied on a purely functional programming model. In this paper, we show that it is possible to remove this limitation and support modifiable references that can be written multiple times. We formalize this using a language AIL for which we define evaluation and changepropagation semantics. AIL closely resembles a traditional higherorder imperative programming language. For AIL we state and prove consistency, i.e., the property that although the semantics is inherently nondeterministic, different evaluation paths will still give observationally equivalent results. In the imperative setting where pointer graphs in the store can form cycles, our previous proof techniques do not apply. Instead, we make use of a novel form of a stepindexed logical relation that handles modifiable references. We show that AIL can be realized efficiently by describing implementation strategies whose overhead is provably constanttime per primitive. When the number of reads and writes per modifiable is bounded by a constant, we can show that change propagation becomes as efficient as it was in the pure case. The general case incurs a slowdown that is logarithmic in the maximum number of such operations. We use DFS and related algorithms on graphs as our running examples and prove that they respond to insertions and deletions of edges efficiently. 1.
Reasoning about local variables with operationallybased logical relations
 In LICS
, 1996
"... A parametric logical relation between the phrases of an Algollike language is presented. Its definition involves the structural operational semantics of the language, but was inspired by recent denotationallybased work of O’Hearn and Reynolds on translating Algol into a predicatively polymorphic l ..."
Abstract

Cited by 34 (3 self)
 Add to MetaCart
(Show Context)
A parametric logical relation between the phrases of an Algollike language is presented. Its definition involves the structural operational semantics of the language, but was inspired by recent denotationallybased work of O’Hearn and Reynolds on translating Algol into a predicatively polymorphic linear lambda calculus. The logical relation yields an applicative characterisation of contextual equivalence for the language and provides a useful (and complete) method for proving equivalences. Its utility is illustrated by giving simple and direct proofs of some contextual equivalences, including an interesting equivalence due to O’Hearn which hinges upon the undefinability of ‘snapback ’ operations (and which goes beyond the standard suite of ‘MeyerSieber ’ examples). Whilst some of the mathematical intricacies of denotational semantics are avoided, the hard work in this operational approach lies in establishing the ‘fundamental property’ for the logical relation—the proof of which makes use of a compactness property of fixpoint recursion with respect to evaluation of phrases. But once this property has been established, the logical relation provides a verification method with an attractively low mathematical overhead. 1.