## State-dependent representation independence (2009)

### Cached

### Download Links

Venue: | In Proceedings of the 36th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages |

Citations: | 64 - 19 self |

### BibTeX

@INPROCEEDINGS{Ahmed09state-dependentrepresentation,

author = {Amal Ahmed and Derek Dreyer and Andreas Rossberg},

title = {State-dependent representation independence},

booktitle = {In Proceedings of the 36th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages},

year = {2009}

}

### OpenURL

### Abstract

Mitchell’s notion of representation independence is a particularly useful application of Reynolds ’ relational parametricity — two different implementations of an abstract data type can be shown contextually equivalent so long as there exists a relation between their type representations that is preserved by their operations. There have been a number of methods proposed for proving representation independence in various pure extensions of System F (where data abstraction is achieved through existential typing), as well as in Algol- or Java-like languages (where data abstraction is achieved through the use of local mutable state). However, none of these approaches addresses the interaction of existential type abstraction and local state. In particular, none allows one to prove representation independence results for generative ADTs — i.e., ADTs that both maintain some local state and define abstract types whose internal

### Citations

772 | Separation logic: a logic for shared mutable data structures
- Reynolds
(Show Context)
Citation Context ...unclear, and we plan to explore the connection further in future work. Separation Logic To reason about imperative programs in a localized manner, O’Hearn, Reynolds et al. introduced separation logic =-=[24]-=- as an extension to Hoare logic. Separation logic has been enormously influential in the last few years, but it has not to our knowledge been used to reason about higher-order typed functional languag... |

383 |
Types, abstraction, and parametric polymorphism
- Reynolds
- 1983
(Show Context)
Citation Context ...978-1-60558-379-2/09/01. . . $5.00 Reprinted from POPL’09,, [Unknown Proceedings], January 18–24, 2009, Savannah, Georgia, USA., pp. 1–??. 1. Introduction Reynolds’ notion of relational parametricity =-=[23]-=- is the essence of type abstraction — clients of an abstract type behave uniformly across all relational interpretations of that type and thus cannot depend in any way on how the type is represented. ... |

136 | An indexed model of recursive types for foundational proof-carrying code
- Appel, McAllester
(Show Context)
Citation Context ...ns, which are now parameterized by worlds. To break this circularity, we employ step-indexed logical relations. 4 2008/7/153.5 Step-Indexed Logical Relations and Possible Worlds Appel and McAllester =-=[5]-=- introduced the step-indexed model as a way to express semantic type soundness proofs for languages with general recursive and polymorphic types. Although its original motivation was tied to foundatio... |

116 | Operational reasoning for functions with local state
- Pitts, Stark
- 1998
(Show Context)
Citation Context ...al state — most of the recent previous work we know of employs possible-worlds models of the sort we discussed in Section 3.2, so we refer the reader to that earlier section for a thorough comparison =-=[21, 22, 7, 10]-=-. However, there are two recent pieces of work that are worth discussing in further detail. Perhaps the closest related work to ours is Nina Bohr’s PhD thesis [9], which extends her work with Lars Bir... |

105 | Applicative Functors and Fully Transparent Higher-Order Modules
- Stone, LEROY, et al.
- 1995
(Show Context)
Citation Context ...ze andalso !size = length(!table) then List.nth (!table, !size - n) else "Hell freezes over" 1 This is the case, for example, in OCaml, which only supports applicative (i.e., non-generative) functors =-=[15]-=-. In other words, there is no observable difference between the original Symbol functor and one that dynamically checks the various invariants we claim to “know.” Hence, the checks are unnecessary. Th... |

86 | A type system for higherorder modules
- Dreyer, Crary, et al.
- 2003
(Show Context)
Citation Context ...ty is sometimes necessary to achieve the proper degree of data abstraction. As a simple motivating example, consider the SML module code in Figure 1, which is adapted from an example of Dreyer et al. =-=[12]-=-. (Later in the paper, we will develop a similar example using existential types.) Here, the signature SYMBOL describes a module implementing a mutable symbol table, which maps “symbols” to strings. T... |

69 | 2006b) Step-indexed syntactic logical relations for recursive and quantified types
- Ahmed
- 2006
(Show Context)
Citation Context ...F, but over the past two decades there has been a great deal of work on extending them to the setting of more realistic languages, such as those with recursive functions [20], general recursive types =-=[16, 1, 11]-=-, selective strictness [29], etc. In these functional languages, data abstraction is achieved through the use of existential types. Others have considered representation independence in the setting of... |

67 | Ownership Confinement Ensures Representation Independence for Object-Oriented Programs
- Banerjee, Naumann
- 2004
(Show Context)
Citation Context ...ndependence in the setting of imperative languages, such as Algol and Java, where data abstraction is achieved instead through the use of local mutable state (e.g., local variables or private fields) =-=[21, 5, 14]-=-. Of course, most modern languages (such as ML) are neither purely functional nor imperative, but rather freely mix the paradigms. However, none of the existing work on representation independence has... |

60 | Relational reasoning in a nominal semantics for storage
- Benton, Leperchey
- 2005
(Show Context)
Citation Context ...relational interpretation, how can we characterize the “current state of the heap?” As a starting point, we review the general approach taken by a number of prior works on reasoning about local state =-=[21, 22, 7, 10]-=-. This approach, which utilizes a possible worlds model, has influenced us greatly, and constitutes the foundation of our method. However, the form it has taken in prior work is insufficient for our p... |

60 | Behavioral equivalence in the polymorphic pi-calculus
- PIERCE, SANGIORGI
(Show Context)
Citation Context ...xtual equivalences (involving either type abstraction or local state), one of the most successful alternatives to logical relations is the coinductive technique of bisimulations. Pierce and Sangiorgi =-=[19]-=- define a bisimulation for reasoning about polymorphic π-calculus, and they demonstrate its effectiveness on an example that is similar to our symbol table example. Due to the low-level, imperative na... |

49 |
Small bisimulations for reasoning about higherorder imperative programs
- Koutavas, Wand
- 2006
(Show Context)
Citation Context ... W [p + 1].V directly imply that the arguments must be from disjoint sets. 5.4 Cell Class The next example is a more richly-typed variation of the higherorder cell object example of Koutavas and Wand =-=[13]-=-: e =Λα. pack ref α, 〈λx : α. ref x, λr : ref α. !r, λ〈r, x〉 : ref α × α. (r := x)〉 as σ where σ = ∃β. (α → β) × (β → α) × (β × α → unit). We use pattern matching notation here merely for clarity and ... |

48 | A bisimulation for type abstraction and recursion
- Sumii, Pierce
- 2005
(Show Context)
Citation Context ...ally provable quite easily by a transitive combination of logical relations proofs (www.mpi-sws.org/~dreyer/pitts.txt). Dreyer has suggested a harder example, mentioned on page 25 of Sumii and Pierce =-=[28]-=-, for which there is not even any known “brute-force” proof. 4 The published conference version of her paper claims full completeness, but the proof contains a technical flaw uncovered by the second a... |

44 | A bisimulation for dynamic sealing
- Sumii, Pierce
- 2004
(Show Context)
Citation Context ...s, but the basic idea of their technique (described below) has been quite influential on subsequent work. Sumii and Pierce define bisimulations for an untyped language with a dynamic sealing operator =-=[27]-=-, as well as an extension of System F with general recursive types [28]. Koutavas and Wand [13] adapt the Sumii-Pierce technique to handle an untyped higher-order language with general references; in ... |

37 | Typed operational reasoning
- Pitts
- 2005
(Show Context)
Citation Context ...ntext of (variants of) System F, but over the past two decades there has been a great deal of work on extending them to the setting of more realistic languages, such as those with recursive functions =-=[20]-=-, general recursive types [16, 1, 11], selective strictness [29], etc. In these functional languages, data abstraction is achieved through the use of existential types. Others have considered represen... |

31 |
Representation independence and data abstraction
- Mitchell
- 1986
(Show Context)
Citation Context ...an abstract type behave uniformly across all relational interpretations of that type and thus cannot depend in any way on how the type is represented. Mitchell’s notion of representation independence =-=[17]-=- is a particularly useful application of relational parametricity — two different implementations of an abstract data type can be shown contextually equivalent so long as there exists a relation betwe... |

29 | State based ownership, reentrance, and encapsulation
- Banerjee, Naumann
- 2005
(Show Context)
Citation Context ... Lock The proofs for the examples presented so far do not use step indices in an interesting way. The last of our examples, which is inspired by the reentrant callback example of Banerjee and Naumann =-=[6]-=-, demonstrates an unexpected case where the steps come in handy. Relying as it does on subtle stepwise reasoning, our proof for this example is rather involved (some might say ugly), but like a dog wa... |

29 | Imperative self-adjusting computation
- Acar, Ahmed, et al.
- 2008
(Show Context)
Citation Context ...possible-worlds models of the sort we discussed in Section 3.2, so we refer the reader to that earlier section for a detailed comparison with previous approaches [18, 19, 8, 9]. Recently, Acar et al. =-=[1]-=- gave an untyped relational step-indexed model for reasoning about the consistency of imperative selfadjusting computation. The model employs a simple notion of possible worlds for reasoning about acc... |

27 | Relational reasoning for recursive types and references
- Bohr, Birkedal
- 2006
(Show Context)
Citation Context ...relational interpretation, how can we characterize the “current state of the heap?” As a starting point, we review the general approach taken by a number of prior works on reasoning about local state =-=[21, 22, 7, 10]-=-. This approach, which utilizes a possible worlds model, has influenced us greatly, and constitutes the foundation of our method. However, the form it has taken in prior work is insufficient for our p... |

26 |
Syntactic logical relations for polymorphic and recursive types
- Crary, Harper
- 2007
(Show Context)
Citation Context ...F, but over the past two decades there has been a great deal of work on extending them to the setting of more realistic languages, such as those with recursive functions [20], general recursive types =-=[16, 1, 11]-=-, selective strictness [29], etc. In these functional languages, data abstraction is achieved through the use of existential types. Others have considered representation independence in the setting of... |

24 |
Hoare type theory, polymorphism and separation
- Nanevski, Morrisett, et al.
- 2008
(Show Context)
Citation Context ...nal languages with type abstraction and higher-order store. Notably, however, the desire to scale separation logic to reason about a functional programming language has led to Hoare Type Theory (HTT) =-=[18]-=-. HTT is a dependently typed system where computations are assigned a monadic type in the style of a Hoare triple. Under this approach, programs generally have to pass around explicit proof objects to... |

17 | Typed closure conversion preserves observational equivalence
- Ahmed, Blume
- 2008
(Show Context)
Citation Context ...tended version of her paper corrects the error [1]. textual equivalence, it is still useful for proving representation independence results, which is our primary focus. Recent work by Ahmed and Blume =-=[2]-=- involves a variant of [1] that is complete with respect to contextual equivalence, where completeness is obtained by essentially Church-encoding the logical interpretation of existentials (this is ro... |

17 | Non-Dependent Types for Standard ML Modules
- Russo
- 1999
(Show Context)
Citation Context ...d ML’s generative functors, which generate fresh abstract types at each application, and indeed the semantics of SML-style functors may be understood as a stylized use of existential type abstraction =-=[25]-=-. The clearest motivation for type generativity is in the definition of ADTs that encapsulate some local state. In such instances, generativity is sometimes necessary to achieve the proper degree of d... |

12 | Relational parametricity for references and recursive types
- Birkedal, Støvring, et al.
- 2009
(Show Context)
Citation Context ... we believe her technique can handle at least one, if not both, of the examples in Section 5.7 and 5.8, which we cannot. In a paper conceived concurrently with ours, Birkedal, Støvring, and Thamsborg =-=[8]-=- present a relationally parametric denotational model of a language with general recursive types, polymorphism, and references of arbitrary type. Their model improves on Bohr’s in the flexibility of i... |

12 | Reasoning about class behavior
- Koutavas, Wand
- 2007
(Show Context)
Citation Context ...ndependence in the setting of imperative languages, such as Algol and Java, where data abstraction is achieved instead through the use of local mutable state (e.g., local variables or private fields) =-=[21, 5, 14]-=-. Of course, most modern languages (such as ML) are neither purely functional nor imperative, but rather freely mix the paradigms. However, none of the existing work on representation independence has... |

12 |
Selective strictness and parametricity in structural operational semantics, inequationally
- Voigtländer, Johann
(Show Context)
Citation Context ...here has been a great deal of work on extending them to the setting of more realistic languages, such as those with recursive functions [20], general recursive types [16, 1, 11], selective strictness =-=[29]-=-, etc. In these functional languages, data abstraction is achieved through the use of existential types. Others have considered representation independence in the setting of imperative languages, such... |

5 |
Eijiro Sumii. Environmental bisimulations for higher-order languages
- Sangiorgi, Kobayashi
- 2007
(Show Context)
Citation Context ...ons. Interestingly, the Koutavas-Wand technique involves the use of inductive stepwise reasoning when showing that two functions are in the bisimulation. Subsequently, Sangiorgi, Kobayashi, and Sumii =-=[26]-=- propose environmental bisimulations, which generalize Sumii and Pierce’s previous work to an untyped framework subsuming that of KoutavasWand’s, but in a way that does not appear to require any stepw... |

4 |
Advances in Reasoning Principles for Contextual Equivalence and Termination
- Bohr
- 2007
(Show Context)
Citation Context ...for a thorough comparison [21, 22, 7, 10]. However, there are two recent pieces of work that are worth discussing in further detail. Perhaps the closest related work to ours is Nina Bohr’s PhD thesis =-=[9]-=-, which extends her work with Lars Birkedal [10] in two directions. First, she gives a denotational possible-worlds model for a language with general recursive types, polymorphism, and higher-order re... |

1 |
State-dependent representation independence (technical appendix), 2008. Available at: http://ttic.uchicago.edu/~amal/papers/sdri
- Ahmed, Dreyer, et al.
(Show Context)
Citation Context ...) to denote the set of type variables that appear free in type τ. The typing rules are entirely standard, so we show only a few rules in Figure 2. We refer the reader to the online technical appendix =-=[3]-=- for full details of F µ! . 2.1 Contextual Equivalence A context C is an expression with a single hole [·] in it. Typing judgments for contexts have the form ⊢ C : (∆; Γ; Σ ⊢ τ) ⇒ (∆ ′ ;Γ ′ ;Σ ′ ⊢ τ ′... |