The type discipline of behavioral separation

Caires, Luís; Seco, João Costa

doi:10.1145/2429069.2429103

Cited by 14 publications

(19 citation statements)

References 39 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Therefore, by (5), (3) and (4) (1) by hypothesis. Γ | ∆ 0 , A 0 e : A 2 ∆ 1 (2) Γ | ∆ 0 , A 1 e : A 2 ∆ 1 (3) by inversion on (t:Alternative-Left) with (1).…”

Section: Case (T:subsumption) -We Havementioning

confidence: 77%

“…Although there are other interesting works [1,2,4,5,7,30] in the area, they limit sharing to an invariant. In Chalice [19], programmer-supplied permissions and predicates are used to show that a program is free of data races and deadlocks.…”

Section: Related Workmentioning

confidence: 99%

“…Γ{ρ/t} | ∆ 0 {ρ/t} e{ρ/t} : A{ρ/t} ∆ 1 {ρ/t} (4) by induction hypothesis with (2) and (3). Γ, t : loc ∆ 0 − ∆ 2 (5) by typing on (1). Γ{ρ/t} (∆ 0 {ρ/t}) − (∆ 2 {ρ/t}) (6) by (Well-Formed Type Substitution -Delta) on (5) and (2) and by (ls:4.*).…”

Section: Case (T:function) -We Havementioning

confidence: 99%

“…Γ{ρ/t}, x : A{ρ/t} wf (5) by (ls:3.2) on (4) Γ{ρ/t}, x : A{ρ/t} | · x : !A{ρ/t} · (6) by (t:Pure-Read) with (5). Γ{ρ/t}, x : A{ρ/t} | · {ρ/t} x{ρ/t} : (!A){ρ/t} ·{ρ/t} (7) by (ls:3.1), (ls:2.4), (ls:1.2) on (6) Thus, we conclude.…”

Section: Case (T:subsumption) -We Havementioning

confidence: 99%

See 3 more Smart Citations

Rely-Guarantee Protocols

Militão¹,

Aldrich²,

Caires³

2014

View full text Add to dashboard Cite

Public reporting burden for the collection of information is estimated to average 1 hour per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden, to Washington Headquarters Services, Directorate for Information Operations and Reports, 1215 Jefferson Davis Highway, Suite 1204, Arlington VA 22202-4302. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to a penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number. The use of shared mutable state, commonly seen in object-oriented systems, is often problematic due to the potential conflicting interactions between aliases to the same state. We present a substructural type system outfitted with a novel lightweight interference control mechanism, relyguarantee protocols, that enables controlled aliasing of shared resources. By assigning each alias separate roles, encoded in a novel protocol abstraction in the spirit of rely-guarantee reasoning our type system ensures that challenging uses of shared state will never interfere in an unsafe fashion. In particular, rely-guarantee protocols ensure that each alias will never observe an unexpected value, or type, when inspecting shared memory regardless of how the changes to that shared state (originating from potentially unknown program contexts) are interleaved at run-time. Keywords: aliasing, interference control, rely-guarantee, typestates AbstractThe use of shared mutable state, commonly seen in object-oriented systems, is often problematic due to the potential conflicting interactions between aliases to the same state. We present a substructural type system outfitted with a novel lightweight interference control mechanism, relyguarantee protocols, that enables controlled aliasing of shared resources. By assigning each alias separate roles, encoded in a novel protocol abstraction in the spirit of rely-guarantee reasoning, our type system ensures that challenging uses of shared state will never interfere in an unsafe fashion. In particular, rely-guarantee protocols ensure that each alias will never observe an unexpected value, or type, when inspecting shared memory regardless of how the changes to that shared state (originating from potentially unknown program contexts) are interleaved at run-time.

show abstract

“…Therefore, by (5), (3) and (4) (1) by hypothesis. Γ | ∆ 0 , A 0 e : A 2 ∆ 1 (2) Γ | ∆ 0 , A 1 e : A 2 ∆ 1 (3) by inversion on (t:Alternative-Left) with (1).…”

Section: Case (T:subsumption) -We Havementioning

confidence: 77%

Section: Related Workmentioning

confidence: 99%

Section: Case (T:function) -We Havementioning

confidence: 99%

Section: Case (T:subsumption) -We Havementioning

confidence: 99%

See 2 more Smart Citations

Rely-Guarantee Protocols

Militão¹,

Aldrich²,

Caires³

2014

View full text Add to dashboard Cite

show abstract

“…Approaches limited to tree-shaped object structures for unique references include [15,16,51,57,64,65]. In contrast, LACASA provides external uniqueness [18], which allows internallyaliased object graphs.…”

Section: Other Related Workmentioning

confidence: 99%

LaCasa: lightweight affinity and object capabilities in Scala

Haller

Loiko²

2016

Proceedings of the 2016 ACM SIGPLAN International Conference on Object-Oriented Programming, Systems, Languages, and Applicatio

View full text Add to dashboard Cite

Aliasing is a known source of challenges in the context of imperative object-oriented languages, which have led to important advances in type systems for aliasing control. However, their large-scale adoption has turned out to be a surprisingly difficult challenge. While new language designs show promise, they do not address the need of aliasing control in existing languages.This paper presents a new approach to isolation and uniqueness in an existing, widely-used language, Scala. The approach is unique in the way it addresses some of the most important obstacles to the adoption of type system extensions for aliasing control. First, adaptation of existing code requires only a minimal set of annotations. Only a single bit of information is required per class. Surprisingly, the paper shows that this information can be provided by the object-capability discipline, widely-used in program security. We formalize our approach as a type system and prove key soundness theorems. The type system is implemented for the full Scala language, providing, for the first time, a sound integration with Scala's local type inference. Finally, we empirically evaluate the conformity of existing Scala open-source code on a corpus of over 75,000 LOC.

show abstract

Automated Modular Verification for Relaxed Communication Protocols

Costea

Chin

Qin

et al. 2018

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Ensuring software correctness and safety for communicationcentric programs is important but challenging. In this paper we introduce a solution for writing communication protocols, for checking protocol conformance and for verifying implementation safety. This work draws on ideas from both multiparty session types, which provide a concise way to express communication protocols, as well as from separationstyle logics for shared-memory concurrency, which provide strong safety guarantees for resource sharing. On the one hand, our proposal improves the expressiveness and precision of session types, without sacrificing their conciseness. On the other hand, it increases the applicability of software verification as well as its precision, by making it protocol aware. We also show how to perform the verification of such programs in a modular and automatic fashion. one of the communicating entities requires the re-validation of the entire system. Since validation might be expensive, or difficult to achieve if the source code of certain components is not available, it is desirable for the developer to be able to only validate her changes locally, rather than at the global level. Over the last decades, behavioral types [35,26] have been studied as specifications of the interactions in communicating systems. In particular, multiparty session types [23], or MPSTs, provide a user-friendly syntax for writing choreographic specifications of distributed systems, and a lightweight mechanism for enforcing communication safety. Communication is considered correct when the system's constituent processes are statically type-checked against the end-point projections of the MPST. This formalism and its numerous extensions are attractive in checking if the implementation follows the intended communication pattern, but it lacks the strong safety and correctness guarantees normally provided by the resource-aware verification systems. Specifically, the MPST approach checks if a transmission's exchanged type is the expected one. However, in their most common form, MPSTs are unable to assert something about the message's numerical properties, and even less so about its carried resources in the case of tightly coupled systems. All these, while numerical properties and resource sharing constitute the pièce de résistance for separation logic [38], a logic for reasoning about resource sharing. In this work, we attach a communication logic in the user-friendly style of MPST, to a separation logic for program verification. Even though we draw on ideas from MPST, the proposed logic differs from MPST in a number of features which yield a more expressive communication specification-without compromising its friendly syntax. The current proposal ultimately leads to stronger guarantees w.r.t. the safety and correctness of distributed system. We shall next highlight these differences. Writing Multiparty Communication Protocols. The language we propose for writing communication protocols is described in Fig. 1a. Similar to MPST, the language contains the te...

show abstract

The type discipline of behavioral separation

Cited by 14 publications

References 39 publications

Rely-Guarantee Protocols

Rely-Guarantee Protocols

LaCasa: lightweight affinity and object capabilities in Scala

Automated Modular Verification for Relaxed Communication Protocols

Contact Info

Product

Resources

About