Syntactic soundness proof of a type-and-capability system with hidden state

Abstract

This paper presents a formal definition and machine-checked soundness proof for a very expressive type-and-capability system, that is, a low-level type system that keeps precise track of ownership and side effects.The programming language has first-class functions and references. The type system's features include: universal, existential, and recursive types; subtyping; a distinction between affine and unrestricted data; support for strong updates; support for naming values and heap fragments, via singleton and group regions; a distinction between ordinary values (which exist at runtime) and capabilities (which don't); support for dynamic re-organizations of the ownership hierarchy, by dis-assembling and re-assembling capabilities; support for temporarily or permanently hiding a capability, via frame and anti-frame rules.One contribution of the paper is the definition of the type-and-capability system itself. We present the system as modularly as possible. In particular, at the core of the system, the treatment of affinity, in the style of dual intuitionistic linear logic, is formulated in terms of an arbitrary monotonic separation algebra, a novel axiomatization of resources, ownership, and the manner in which they evolve with time. Only the peripheral layers of the system are aware that we are dealing with a specific monotonic separation algebra, whose resources are references and regions. This semiabstract organization should facilitate further extensions of the system with new forms of resources.The other main contribution is a machine-checked proof of type soundness. The proof is carried out in Wright and Felleisen's syntactic style. This offers evidence that this relatively simple-minded proof technique can scale up to systems of this complexity, and constitutes a viable alternative to more sophisticated semantic proof techniques. We do not claim that the syntactic technique is superior: we simply illustrate how it is used and highlight its strengths and shortcomings.

Superficially substructural types

“…Soundness proofs of the anti-frame rule have been given in both semantic [34] and (significantly more complex) syntactic [32] forms. Based on this experience, we chose to use a semantic model in our work, and have been very satisfied with its simplicity.…”

Integrating Linear and Dependent Types

“…Similarly, the calculus of capabilities of Pottier [37] represents another approach towards integrating linear capabilities with a programming language. As with ATS, capabilities are linear and irrelevant, and this system also includes support for advanced features such as the anti-frame rule.…”

Type Soundness and Race Freedom for Mezzo

“…The rule allows strong update: the type of x changes to ref X T , where T is the type of v . All three operations are harmless: there is no adverse interaction between polymorphism and uniquely-owned references [4,11].…”

“…Although the formalization of Mezzo was carried out independently, and in part grew out of earlier work by the second author [11], it is in several ways closely related to the Views framework [7]. In both cases, an abstract calculus is equipped with a notion of machine state; a commutative semigroup of views, or resources; and a projection, or correspondence, between the two levels.…”