Filesystems are an essential component of most computer systems. Work on the verification of filesystem functionality has been focused on constructing new filesystems in a manner which simplifies the process of verifying them against specifications. This leaves open the question of whether filesystems already in use are correct at the binary level. This paper introduces LoFAT, a model of the FAT32 filesystem which efficiently implements a subset of the POSIX filesystem operations, and HiFAT, a more abstract model of FAT32 which is simpler to reason about. LoFAT is proved to be correct in terms of refinement of HiFAT, and made executable by enabling the state of the model to be written to and read from FAT32 disk images. EqFAT, an equivalence relation for disk images, considers whether two disk images contain the same directory tree modulo reordering of files and implementation-level details regarding cluster allocation. A suite of co-simulation tests uses EqFAT to compare the operation of existing FAT32 implementations to LoFAT and check the correctness of existing implementations of FAT32 such as the mtools suite of programs and the Linux FAT32 implementation. All models and proofs are formalized and mechanically verified in ACL2.

This paper addresses the problem of verifying equivalence between a pair of programs that operate over databases with different schemas. This problem is particularly important in the context of web applications, which typically undergo database refactoring either for performance or maintainability reasons. While web applications should have the same externally observable behavior before and after schema migration, there are no existing tools for proving equivalence of such programs. This paper takes a first step towards solving this problem by formalizing the equivalence and refinement checking problems for database-driven applications. We also propose a proof methodology based on the notion of bisimulation invariants over relational algebra with updates and describe a technique for synthesizing such bisimulation invariants. We have implemented the proposed technique in a tool called Mediator for verifying equivalence between database-driven applications written in our intermediate language and evaluate our tool on 21 benchmarks extracted from textbooks and real-world web applications. Our results show that the proposed methodology can successfully verify 20 of these benchmarks.

The majority of modern programming languages provide concurrency and object-orientation in some form. However, object-oriented concurrency remains cumbersome in many situations. We introduce the language OrcO, Orc with concurrent Objects, which enables a flexible style of concurrent object-oriented programming. OrcO extends the Orc programming language by adding abstractions for programming-in-the-large; namely objects, classes, and inheritance. OrcO objects are designed to be orthogonal to concurrency, allowing the concurrent structure and object structure of a program to evolve independently. This paper describes OrcO's goals and design and provides examples of how OrcO can be used to deftly handle events, object management, and object composition.

This paper presents a new functional programming model for graph structures called structured graphs. Structured graphs extend conventional algebraic datatypes with explicit definition and manipulation of cycles and/or sharing, and offer a practical and convenient way to program graphs in functional programming languages like Haskell. The representation of sharing and cycles (edges) employs recursive binders and uses an encoding inspired by parametric higher-order abstract syntax. Unlike traditional approaches based on mutable references or node/edge lists, well-formedness of the graph structure is ensured statically and reasoning can be done with standard functional programming techniques. Since the binding structure is generic, we can define many useful generic combinators for manipulating structured graphs. We give applications and show how to reason about structured graphs.

Abstract Incremental Programming (IP) is a programming style in which new program components are defined as increments of other components. Examples of IP mechanisms include Object-oriented programming inheritance, aspect-oriented programming advice, and feature-oriented programming . A characteristic of IP mechanisms is that, while individual components can be independently defined, the composition of components makes those components become tightly coupled, sharing both control and data flows. This makes reasoning about IP mechanisms a notoriously hard problem: modular reasoning about a component becomes very difficult; and it is very hard to tell if two tightly coupled components interfere with each other's control and data flows. This paper presents modular reasoning about interference (MRI), a purely functional model of IP embedded in Haskell. MRI models inheritance with mixins and side effects with monads. It comes with a range of powerful reasoning techniques: equational reasoning, parametricity, and reasoning with algebraic laws about effectful operations. These techniques enable MRI in the presence of side effects. MRI formally captures harmlessness , a hard-to-formalize notion in the interference literature, in two theorems. We prove these theorems with a non-trivial combination of all three reasoning techniques.

Mechanized proof assistants are powerful verification tools, but proof development can be difficult and time-consuming. When verifying a family of related programs, the effort can be reduced by proof reuse. In this paper, we show how to engineer product lines with theorems and proofs built from feature modules. Each module contains proof fragments which are composed together to build a complete proof of correctness for each product. We consider a product line of programming languages, where each variant includes metatheory proofs verifying the correctness of its semantic definitions. This approach has been realized in the Coq proof assistant, with the proofs of each feature independently certifiable by Coq. These proofs are composed for each language variant, with Coq mechanically verifying that the composite proofs are correct. As validation, we formalize a core calculus for Java in Coq which can be extended with any combination of casts, interfaces, or generics.

Hybrid partial evaluation (HPE) is a pragmatic approach to partial evaluation that borrows ideas from both online and offline partial evaluation. HPE performs offline-style specialization using an online approach without static binding time analysis. The goal of HPE is to provide a practical and predictable level of optimization for programmers, with an implementation strategy that fits well within existing compilers or interpreters. HPE requires the programmer to specify where partial evaluation should be applied. It provides no termination guarantee and reports errors in situations that violate simple binding time rules, or have incorrect use of side effects in compile-time code. We formalize HPE for a small imperative object-oriented language and describe Civet, a straightforward implementation of HPE as a relatively simple extension of a Java compiler. Code optimized by Civet performs as well as the output of a state-of-the-art offline partial evaluator.

It is well-known that a naive algorithm can often be turned into an efficient program by applying appropriate semantics-preserving transformations. This technique has been used to derive programs to solve a variety of maximum-sum programs. One problem with this approach is that each problem variation requires a new set of transformations to be derived. An alternative approach to generation combines problem specifications with flexible algorithm theories to derive efficient algorithms. We show how this approach can be implemented in Haskell and applied to solve constraint satisfaction problems. We illustrate this technique by deriving programs for three varieties of maximum-weightsum problem. The derivations of the different programs are similar, and the resulting programs are asymptotically faster in practice than the programs created by transformation.

Although distributed object systems, including RMI and CORBA, enable object-oriented programs to be easily distributed across a network, achieving acceptable performance usually requires client-specific optimization of server interfaces, making such systems difficult to maintain and evolve. Automatic optimization techniques, including Batched Futures and Communication Restructuring, do not work as well as hand optimization. This paper presents Batched Remote Method Invocation (BRMI), a language-level technique for clients to specify explicit batches of operations on remote objects. We have implemented BRMI for Java as an extension of RMI, with support for batches with array cursors, custom exception handling, conditionals and loops. BRMI allows common design patterns, including Data Transfer Objects and Remote Object Facade, to be constructed on the fly by clients. The performance benefits of batching operations are well known; our evaluation focuses on the usability of explicit batches, but we also confirm that BRMI outperforms RMI and scales significantly better when clients make multiple remote calls. The applicability of BRMI is demonstrated by rewriting third-party RMI client applications to use BRMI.

In 1985 Luca Cardelli and Peter Wegner, my advisor, published an ACM Computing Surveys paper called "On understanding types, data abstraction, and polymorphism". Their work kicked off a flood of research on semantics and type theory for object-oriented programming, which continues to this day. Despite 25 years of research, there is still widespread confusion about the two forms of data abstraction, abstract data types and objects. This essay attempts to explain the differences and also why the differences matter.

Programs of a software product line can be synthesized by composing features which implement a unit of program functionality. In most product lines, only some combination of features are meaningful; feature models express the high-level domain constraints that govern feature compatibility. Product line developers also face the problem of safe composition - whether every product allowed by a feature model is type-safe when compiled and run. To study the problem of safe composition, we present Lightweight Feature Java (LFJ), an extension of Lightweight Java with support for features. We define a constraint-based type system for LFJ and prove its soundness using a full formalization of LFJ in Coq. In LFJ, soundness means that any composition of features that satisfies the typing constraints will generate a well-formed LJ program. If the constraints of a feature model imply these typing constraints then all programs allowed by the feature model are type-safe.

Transparent persistence promises to integrate programming languages and databases by allowing programs to access persistent data with the same ease as non-persistent data. In this work we demonstrate the feasibility of optimizing transparently persistent programs by extracting queries to efficiently prefetch required data. A static analysis derives query structure and conditions across methods that access persistent data. Using the static analysis, our system transforms the program to execute explicit queries. The transformed program composes queries across methods to handle method calls that return persistent data. We extend an existing Java compiler to implement the static analysis and program transformation, handling recursion and parameterized queries. We evaluate the effectiveness of query extraction on the OO7 and TORPEDO benchmarks. This work is focused on programs written in the current version of Java, without languages changes. However, the techniques developed here may also be of value in conjunction with object-oriented languages extended with high-level query syntax.

Programs of a software product line can be synthesized by composing modules that implement features. Besides high-level domain constraints that govern the compatibility of features, there are also low-level implementation constraints: a feature module can reference elements that are defined in other feature modules. Safe composition is the guarantee that all programs in a product line are type safe: i.e., absent of references to undefined elements (such as classes, methods, and variables). We show how safe composition properties can be verified for AHEAD product lines using feature models and SAT solvers.

Transparent persistence promises to integrate programming languages and databases by allowing procedural programs to access persistent data with the same ease as non-persistent data. When the data is stored in a relational database, however, transparent persistence does not naturally leverage the performance benefits of relational query optimization. We present a program analysis that combines the benefits of both approaches by extracting database queries from programs with transparent access to persistent data. The analysis uses a sound abstract interpretation of the original program to approximate the data traversal paths in the program and the conditions under which the paths are used. The resulting paths are then converted into a query, and the program is simplified by removing redundant tests. We study an imperative kernel language with read-only access to persistent data and identify the conditions under which the transformations can be applied. This analysis approach promises to combine the software engineering benefits of transparent data persistence with the performance benefits of database query optimization.

Web services are promoted as a new model for distributed systems, yet many skeptics see them as simply a poor implementation of traditional remote procedure calls (RPC) or distributed objects. Previous comparisons support the skeptics: Web services are shown to be significantly slower than RPC, and they lack features like automatic proxies. However, these studies are biased because they are based on an RPC communication style. Web services support a document-oriented style of communication that performs well even in the face of the high latency found in Internet or business transactions. We investigate these issues by comparing the design and implementation of a small file server application implemented using RMI and Web services. For this application, using the most straightforward implementation in both technologies, Web services outperform RMI when accessing multiple/deeply nested files, especially over high-latency channels. However, the default Web services interfaces are awkward to use, so we develop a technique for wrapping the Web service to make it as easy to use as the distributed object implementation. The same wrappers are then used to implement the document-oriented communication style in RMI, which improves performance but significantly complicates the design. This case study provides a more detailed comparison of the relationship between Web services and distributed objects

Virtual classes are class-valued attributes of objects. Like virtual methods, virtual classes are defined in an object's class and may be redefined within subclasses. They resemble inner classes, which are also defined within a class, but virtual classes are accessed through object instances, not as static components of a class. When used as types, virtual classes depend upon object identity -- each object instance introduces a new family of virtual class types. Virtual classes support large-scale program composition techniques, including higher-order hierarchies and family polymorphism. The original definition of virtual classes in BETA left open the question of static type safety, since some type errors were not caught until runtime. Later the languages Caesar and gbeta have used a more strict static analysis in order to ensure static type safety. However, the existence of a sound, statically typed model for virtual classes has been a long-standing open question. This paper presents a virtual class calculus, VC, that captures the essence of virtual classes in these full-fledged programming languages. The key contributions of the paper are a formalization of the dynamic and static semantics of VC and a proof of the soundness of VC.

Developers of data-intensive applications are increasingly using persistence frameworks such as EJB, Hibernate and JDO to access relational data. These frameworks support both transparent persistence for individual objects and explicit queries to efficiently search large collections of objects. While transparent persistence is statically typed, explicit queries do not support static checking of types or syntax because queries are manipulated as strings and interpreted at runtime. This paper presents Safe Query Objects, a technique for representing queries as statically typed objects while still supporting remote execution by a database server. Safe query objects use object-relational mapping and reflective metaprogramming to translate query classes into traditional database queries. The model supports complex queries with joins, parameters, existentials, and dynamic criteria. A prototype implementation for JDO provides a type-safe interface to the full query functionality in the JDO 1.0 standard.

Article How to get a paper accepted at OOPSLA (panel) Share on Authors: Ralph E. Johnson View Profile , Kent Beck View Profile , Grady Booch View Profile , William Cook View Profile , Richard Gabriel View Profile , Rebecca Wirfs-Brock View Profile Authors Info & Claims OOPSLA '93: Proceedings of the eighth annual conference on Object-oriented programming systems, languages, and applicationsOctober 1993 Pages 429–436https://doi.org/10.1145/165854.165934Online:01 October 1993Publication History 5citation1,315DownloadsMetricsTotal Citations5Total Downloads1,315Last 12 Months35Last 6 weeks8 Get Citation AlertsNew Citation Alert added!This alert has been successfully added and will be sent to:You will be notified whenever a record that you have chosen has been cited.To manage your alert preferences, click on the button below.Manage my AlertsNew Citation Alert!Please log in to your account Save to BinderSave to BinderCreate a New BinderNameCancelCreateExport CitationPublisher SiteGet Access

article Free Access Share on Is multiple inheritance essential to OOP? (panel) Authors: Yen-Ping Shan View Profile , Tom Cargill View Profile , Brad Cox View Profile , William Cook View Profile , Mary Loomis View Profile , Alan Snyder View Profile Authors Info & Claims ACM SIGPLAN NoticesVolume 28Issue 10Oct. 1, 1993 pp 360–363https://doi.org/10.1145/167962.165923Published:01 October 1993Publication History 3citation781DownloadsMetricsTotal Citations3Total Downloads781Last 12 Months30Last 6 weeks2 Get Citation AlertsNew Citation Alert added!This alert has been successfully added and will be sent to:You will be notified whenever a record that you have chosen has been cited.To manage your alert preferences, click on the button below.Manage my AlertsNew Citation Alert!Please log in to your account Save to BinderSave to BinderCreate a New BinderNameCancelCreateExport CitationPublisher SiteeReaderPDF

The hierarchy of interfaces implicit in the Smalltalk-collection class library is computed and analyzed.The interface hierarchy is independent of the inheritance hierarchy because methods are frequently deleted by subclasses, and because unrelated classes sometimes implement the same messages.Specifications of the interfaces are developed, revealing subtle relationships among messages and their methods.The specifications help identify several kinds of problems in the library: inherited methods that violate the subclass invariant; methods that have the same name but unrelated behaviors; methods that have the same (or related) behavior but different names.This exercise demonstrates the utility of interfaces and specilications, and suggests improvements to the collection class library structure.

In typed object-oriented languages the subtype relation is typically based on the inheritance hierarchy. This approach, however, leads either to insecure type-systems or to restrictions on inheritance that make it less flexible than untyped Smalltalk inheritance. We present a new typed model of inheritance that allows more of the flexibility of Smalltalk inheritance within a statically-typed system. Significant features of our analysis are the introduction of polymorphism into the typing of inheritance and the uniform application of inheritance to objects, classes and types. The resulting notion of type inheritance allows us to show that the type of an inherited object is an inherited type but not always a subtype.

This paper develops a system of explicit interfaces for object-oriented programming. The system provides the benefits of module interfaces found in languages like Ada and Modula-2 while preserving the expressiveness that gives untyped object-oriented languages like Smalltalk their flexibility. Interfaces are interpreted as polymorphic types to make the system sufficiently powerful. We use interfaces to analyze the properties of inheritance, and identify three distinct kinds of inheritance in object-oriented programming, corresponding to objects, classes, and interfaces, respectively. Object interfaces clarify the distinction between interface containment and inheritance and give insight into limitations caused by equating the notions of type and class in many typed object-oriented programming languages. Interfaces also have practical consequences for design, specification, and maintenance of object-oriented systems.

This paper presents a denotational model of inheritance. The model is based on an intuitive motivation of the purpose of inheritance. The correctness of the model is demonstrated by proving it equivalent to an operational semantics of inheritance based upon the method-lookup algorithm of object-oriented languages. Although it was originally developed to explain inheritance in object-oriented languages, the model shows that inheritance is a general mechanism that may be applied to any form of recursive definition.