## Proving the correctness of reactive systems using sized types (1996)

### Cached

### Download Links

- [www.cs.cmu.edu]
- [www-2.cs.cmu.edu]
- [www.cs.indiana.edu]
- [www.math.chalmers.se]
- [www.cs.chalmers.se]
- DBLP

### Other Repositories/Bibliography

Citations: | 121 - 2 self |

### BibTeX

@INPROCEEDINGS{Hughes96provingthe,

author = {John Hughes and Lars Pareto and Amr Sabry},

title = {Proving the correctness of reactive systems using sized types},

booktitle = {},

year = {1996},

pages = {410--423},

publisher = {ACM Press}

}

### Years of Citing Articles

### OpenURL

### Abstract

{ rjmh, pareto, sabry We have designed and implemented a type-based analysis for proving some baaic properties of reactive systems. The analysis manipulates rich type expressions that contain in-formation about the sizes of recursively defined data struc-tures. Sized types are useful for detecting deadlocks, non-termination, and other errors in embedded programs. To establish the soundness of the analysis we have developed an appropriate semantic model of sized types. 1 Embedded Functional Programs In a reactive system, the control software must continu-ously react to inputs from the environment. We distin-guish a class of systems where the embedded programs can be naturally expressed as functional programs manipulat-ing streams. This class of programs appears to be large enough for many purposes [2] and is the core of more ex-pressive formalisms that accommodate asynchronous events, non-determinism, etc. The fundamental criterion for the correctness of pro-grams embedded in reactive systems is Jwene.ss. Indeed, before considering the properties of the output, we must en-sure that there is some output in the first place: the program must continuous] y react to the input streams by producing elements on the output streams. This latter property may fail in various ways: e the computation of a stream element may depend on itself creating a “black hole, ” or e the computation of one of the output streams may demand elements from some input stream at different rates, which requires unbounded buffering, or o the computation of a stream element may exhaust the physical resources of the machine or even diverge.

### Citations

1065 | Introduction to Lattices and Order - Davey, Priestley - 2002 |

448 | The omega test: a fast and practical integer programming algorithm for dependence analysis
- Pugh
- 1993
(Show Context)
Citation Context ...ve the corresponding constraint systems. Our work does not address the problem of constraint solving. Instead, we exploit recent developments in constraint solving technology via the omega calculator =-=[9, 13]-=-. The formulation of our constraint systems is to a large extent determined by the capabilities of the omega calculator. The reason for implementing a type checker rather than a type inference algorit... |

225 | Report on programming language Haskel a non-strict, purely functional language version 1.2
- Hudak, Jones, et al.
- 1992
(Show Context)
Citation Context ...type is List0a ! List l+1 a ! List l a for which the bottom check holds as the domain type is empty. 7 Using the Implementation The concrete syntax of our language is similar to the syntax of Haskell =-=[7]-=-. To express our richer set of type expressions, we use $ to refer to ! and # to index both data and codata declaration names. 7.1 Modularity As with all type-based analyses, our analysis need not man... |

216 | Type inclusion constraints and type inference
- AIKEN, WIMMERS
- 1993
(Show Context)
Citation Context ...is a good thing as constraint manipulation is costly. Although many polymorphic subtype systems have expression forms for bounded quantification, for example oe where C where C is a constraint system =-=[1]-=-, our type system does not. As a consequence, simplification must eliminate all constraints, otherwise we can not express the type. 11 The (Letrec) rule for the implementation has a slightly different... |

210 |
Data types as lattices
- SCOTT
- 1976
(Show Context)
Citation Context ...niverse of types. The functionals are easily derivable from the declarations using a function D whose definition is omitted. D Nat = Fn D St = Fs D Sp T 1 T 2 = Fp 4 Semantic models based on retracts =-=[16]-=- are not appropriate for another reason; they do not support the form of implicit polymorphism common in the programming languages that we are using. where: Fn(T ) = fZerog + (fSuccg \Theta T ) Fs(T )... |

126 |
An ideal model for recursive polymorphic types
- MacQueen, Plotkin, et al.
- 1986
(Show Context)
Citation Context ...man3 In the definition, we omit the clause for case-expressions as well as the explicit isomorphisms mapping elements of the summands into the universe and vice-versa. 3 tics of types based on ideals =-=[11, 12]-=-, or intervals [3]. 4 In contrast to these systems, we define the universe of types U T to be the collection of all upward-closed subsets of U. A set T is upward-closed if whenever x 2 T then for ever... |

104 | The design of distributed systems - An introduction to FOCUS
- Broy, Dederich, et al.
- 1992
(Show Context)
Citation Context ... distinguish a class of systems where the embedded programs can be naturally expressed as functional programs manipulating streams. This class of programs appears to be large enough for many purposes =-=[2]-=- and is the core of more expressive formalisms that accommodate asynchronous events, non-determinism, etc. The fundamental criterion for the correctness of programs embedded in reactive systems is liv... |

58 |
Formal Development of Reactive Systems: Case Study “Production Cell”, LNCS-891
- Lewerentz, Lindner
- 1995
(Show Context)
Citation Context ...ructs appears to be straightforward. Our system is also related to several approaches for the formal development of reactive systems using synchronous languages, temporal logics, process calculi, etc =-=[10]-=-. Our system is distinguished by two major properties: productivity and modularity. Indeed in a recent comparison of 18 formal methods for the development of a simple production cell [10], only 6 or 7... |

32 | Formal Development of Reactive Systems - Lewerentz, Lindner - 1995 |

25 |
Programming with fudgets
- Hallgren, Carlsson
- 1995
(Show Context)
Citation Context ... Mk Nat St data Sp t1 t2 = Null + Put t2 (Sp t1 t2 ) + Get (t1 ! (Sp t1 t2 )) The first two datatypes should be familiar. The datatype Sp is the datatype of stream processors from the Fudgets library =-=[6]-=-. This datatype describes three kinds of stream processors: 1. the Null processor, 2. the processor (Put t2 (Sp t1 t2 )) that can output an element of type t2 and then becomes a new stream processor, ... |

24 |
On the productivity of recursive list definitions
- Sijtsma
- 1989
(Show Context)
Citation Context ... computes an infinite stream of 1's. In other words, for any natural number i, a request for the first i elements of the stream is guaranteed to be processed in finite time: the program is productive =-=[5, 17]-=-. A slight modification of the program to: letrec ones' = Mk 1 (tail ones' ) in ones' is not productive; it cannot compute the first i elements of the stream for any i ? 1. To understand the problem, ... |

20 |
Subrecursive Programming Systems: Complexity and Succinctness
- Royer, Case
- 1994
(Show Context)
Citation Context ...he program and not for the actual executable code. On the mathematical side, our approximations to sizes of recursive data structures are apparently related to some hierarchies of recursive functions =-=[15]-=- though the connection is not evident at this point. 9 Conclusion We have designed and implemented an analysis that guarantees termination and liveness of embedded functional programs. Moreover our an... |

14 | Using the run-time sizes of data structures to guide parallel-thread creation
- Huelsbergen, Larus, et al.
- 1994
(Show Context)
Citation Context ...proving the productivity of recursive 13 definitions of streams but no automatic analysis. The closest analyses to ours are two recent ones for the estimation of execution times in parallel languages =-=[8, 14]-=-. Both our system and Reistad and Gifford's [14] include similar notions of size and subtyping but nevertheless differ significantly regarding our two main technical contributions. First, our system i... |

12 |
A semantic model of types for applicative languages
- MacQueen, Sethi
- 1982
(Show Context)
Citation Context ...man3 In the definition, we omit the clause for case-expressions as well as the explicit isomorphisms mapping elements of the summands into the universe and vice-versa. 3 tics of types based on ideals =-=[11, 12]-=-, or intervals [3]. 4 In contrast to these systems, we define the universe of types U T to be the collection of all upward-closed subsets of U. A set T is upward-closed if whenever x 2 T then for ever... |

6 |
Types as intervals
- Cartwright
- 1985
(Show Context)
Citation Context ... we omit the clause for case-expressions as well as the explicit isomorphisms mapping elements of the summands into the universe and vice-versa. 3 tics of types based on ideals [11, 12], or intervals =-=[3]-=-. 4 In contrast to these systems, we define the universe of types U T to be the collection of all upward-closed subsets of U. A set T is upward-closed if whenever x 2 T then for every y w x, we have y... |

3 |
The Omega Library (version 0.91) Interface Guide
- Kelly, Maslov, et al.
- 1995
(Show Context)
Citation Context ...ve the corresponding constraint systems. Our work does not address the problem of constraint solving. Instead, we exploit recent developments in constraint solving technology via the omega calculator =-=[9, 13]-=-. The formulation of our constraint systems is to a large extent determined by the capabilities of the omega calculator. The reason for implementing a type checker rather than a type inference algorit... |

2 |
On the productivity of recursive definitions. Personal note EWD
- Dijkstra
- 1980
(Show Context)
Citation Context ... computes an infinite stream of 1's. In other words, for any natural number i, a request for the first i elements of the stream is guaranteed to be processed in finite time: the program is productive =-=[5, 17]-=-. A slight modification of the program to: letrec ones' = Mk 1 (tail ones' ) in ones' is not productive; it cannot compute the first i elements of the stream for any i ? 1. To understand the problem, ... |

2 |
Static Dependent Costs for Estimating Execution Time
- Reistag, Gifford
- 1994
(Show Context)
Citation Context ...proving the productivity of recursive 13 definitions of streams but no automatic analysis. The closest analyses to ours are two recent ones for the estimation of execution times in parallel languages =-=[8, 14]-=-. Both our system and Reistad and Gifford's [14] include similar notions of size and subtyping but nevertheless differ significantly regarding our two main technical contributions. First, our system i... |

1 |
A new H for real-time programming
- Truv', S
- 1995
(Show Context)
Citation Context ...our analysis can sometimes detect space leaks. Our immediate goal is to use the analysis to reason about realistic reactive systems written in realistic functional languages for real-time programming =-=[2, 18]-=-. The analysis is based on a new notion of sized types and its associated semantic model which we expect to be applicable in other contexts such as array bounds checking. We believe the same theory an... |

1 | Types as intervals - CARTWRICT - 1984 |

1 | A semantic model of types for applicative languages - QUEEN, D, et al. - 1982 |