António Ravara | Universidade Nova de Lisboa (original) (raw)

Papers by António Ravara

Concurrent objects can offer services non-uniformly, according to synchronisation constraints, th... more Concurrent objects can offer services non-uniformly, according to synchronisation constraints, that is, the availability of a service depends on the internal state of the object. Interfaces as types is an approach not suitable to model non uniform service availability, and the message not understood communication error is very restrictive. Hence, we propose a looser definition of communication error by demanding only that messages requesting a method not enabled, but that may be accepted at some time in the future, do not cause errors. This new notion detects messages that are never accepted, either because the requested method does not exists at all, or because the object is blocked and cannot change its state to accept the request. We formalise non uniform concurrent objects in T y Co, a name passing object calculus, and we ensure program safety (i.e. the absence some dynamic aspects of the behaviour of objects, thus, the approach is centred on behaviours as types. The type system...

are stored in PDF, with the report number as filename. Alternatively, reports are available by po... more are stored in PDF, with the report number as filename. Alternatively, reports are available by post from the above address.

Tom Chothia, Dominic Duggan, and Jan Vitek ii Weak Secrets and Computational Soundness . . . . . ... more Tom Chothia, Dominic Duggan, and Jan Vitek ii Weak Secrets and Computational Soundness . . . . . . . . . . . . . . . . . . . . . . . . . . . 243 Mart n Abadi Workshop on Logical Foundations of an Adaptive Preface to WOLFASI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249

Science of Computer Programming, 2014

Foreword : Special issue on the 10th International Workshop on the Foundations of Coordination La... more Foreword : Special issue on the 10th International Workshop on the Foundations of Coordination Languages and Software Architectures (FOCLASA 2011)

Electronic Proceedings in Theoretical Computer Science, 2010

2015 23rd Euromicro International Conference on Parallel, Distributed, and Network-Based Processing, 2015

We present a new soundness proof of Concurrent Separation Logic (CSL) based on a structural opera... more We present a new soundness proof of Concurrent Separation Logic (CSL) based on a structural operational semantics (SOS). We build on two previous proofs and develop new auxiliary notions to achieve the goal. One uses a denotational semantics (based on traces). The other is based on SOS, but was obtained only for a fragment of the logic - the Disjoint CSL - which disallows modifying shared variables between concurrent threads. In this work, we lift such restriction, proving the soundness of full CSL with respect to a SOS. Thus contributing to the development of tools able of ensuring the correctness of realistic concurrent programs. Moreover, given that we used SOS, such tools can be well-integrated in programming environments and even incorporated in compilers.

ftp-sop.inria.fr

In this deliverable, we make a review of the work done by the MIKADO partners which is relevant t... more In this deliverable, we make a review of the work done by the MIKADO partners which is relevant to the WP1, Programming Model. We organize the presentation into three sections. The first one is devoted to the work on models based on the π-calculus, or using a computing style close to this calculus. There are five relevant papers here, of which four are included as part of this deliverable. The second section reports on work dealing with Ambient-like models, with two papers included in this deliverable. This section also ...

Formal Languages and Automata Theory are important foundational topics in Computer Science. Their... more Formal Languages and Automata Theory are important foundational topics in Computer Science. Their rigorous and formal characteristics make their learning them demanding. An important support for the assimilation of concepts is the possibility of interactively visualizing concrete examples of these computational models, facilitating understanding them. The tools available are neither complete nor fully support the interactive aspect. This project aims at the development of an interactive web tool in Portuguese to help in an assisted and intuitive way to understand the concepts and algorithms in question, seeing them work step-by-step, through typical examples preloaded or built by the user (an original aspect of our platform). The tool should therefore enable the creation and edition of an automata, as well as execute the relevant classical algorithms such as word acceptance, model conversions, etc. It is also intended to visualize not only the process of construction of the automato...

We present an abstract machine specification for non-uniform TyCO. It is, up to our knowledge, th... more We present an abstract machine specification for non-uniform TyCO. It is, up to our knowledge, the rfist proposal of an abstract machine to compile a process calculus of nonuniform objects. TyCO is a name-passing calculus of concurrent objects. Since concurrent objects do not always offer the same methods due to synchronisation constraints, we advocate nonuniform interfaces, i.e., interfaces with only enabled methods. From the programming point of view the use of non-uniform interfaces for representing objects, as opposed to the uniform record interfaces, allows a more intuitive and expressive definition of objects and in general object-based data structures. This is a result of the far richer behaviours allowed by the non-uniformity. From an implementation point of view, frequently the code is much shorter, both in the source programs as well as in the final byte code or other executable format; even in cases where the difference in code size is not significant, the use of a singl...

We present an undecidability proof of the notion of communication errors in the polyadic #-calcul... more We present an undecidability proof of the notion of communication errors in the polyadic #-calculus. The demonstration follows a general pattern of undecidability proofs---reducing a well-known undecidable problem to the problem in question. We make use of an encoding of the #-calculus into the #-calculus to show that the decidability of communication errors would solve the problem of deciding whether a lambda term has a normal form. Introduction. The detection of communication errors in process calculi is crucial to ensure the safety of concurrent programs, i.e., the absence of run-time errors. The usual approach is to develop a type system, which is sound with respect to the notion of error, but, in general, not complete. The notions of communication errors are usually undecidable, and this makes the type approach relevant. For the polyadic #-calculus [8] this is also the case. Herein we show that the notion of communication errors in the polyadic #-calculus is undecidable. The pr...

Abstract. This paper describes a proposal for typing the behavior of objects in component models.... more Abstract. This paper describes a proposal for typing the behavior of objects in component models. Most component models, CORBA in particular, do not offer any support for expressing behavior al properties of objects beyond the “static ” information provided by IDLs. We build on the works by Honda et al. [6] and Gay and Hole [5] to show how session types can be effectively used for describing protocols, extending the information currently provided by object interfaces. We show how session types not only allow high level specifications of complex object interactions, but also allow the definition of powerful interoperability tests at the protocol level, namely compatibility and substitutability of objects 1.

OCaml is particularly well-fitted for formal verification. On one hand, it is a multiparadigm lan... more OCaml is particularly well-fitted for formal verification. On one hand, it is a multiparadigm language with a well-defined semantics, allowing one to write clean, concise, type-safe, and efficient code. On the other hand, it is a language of choice for the implementation of sensible software, e.g., industrial compilers, proof assistants, and automated solvers. Yet, with the notable exception of some interactive tools, formal verification has been seldom applied to OCaml-written programs. In this paper, we present the ongoing project Cameleer, aiming for the development of a deductive verification tool for OCaml, with a clear focus on proof automation. We leverage on the recently proposed GOSPEL, Generic OCaml SPEcification Language, to attach rigorous, yet readable, behavioral specification to OCaml code. The formally-specified program is fed to our toolchain, which translates it into an equivalent program in WhyML, the programming and specification language of the Why3 verification...

arXiv: Programming Languages, 2016

We present here in a thorough analysis of the Mool language, covering not only its implementation... more We present here in a thorough analysis of the Mool language, covering not only its implementation but also the formalisation (syntax, operational semantics, and type system). The objective is to detect glitches in both the implementation and in the formal definitions, proposing as well new features and added expressiveness. To test our proposals we implemented the revision developed in the Racket platform.

Abstract. We define a small class-based object-oriented language in which the availability of met... more Abstract. We define a small class-based object-oriented language in which the availability of methods depends on an object’s state: objects’ interfaces are dynamic. We define a static type system in which the typing of a method specifies pre- and post-conditions for its object’s state, and each class has a session type which provides a global specification of the availability of methods in each state. The state of an object may also depend on the result of a method whose return type is an enumeration. Linear typing guarantees unique ownership of objects. We prove a type safety theorem, and a theorem about consistency between a class’s session type and the typings of its methods. We then consider inheritance and the associated subtyping relation on dynamic interfaces. A subtyping relation on session types, related to that found in previous literature, characterizes the relationship between method availability in a subclass and in its superclass. We illustrate the language and its typ...

This paper presents a type system to control the migration of code between sites in a concurrent ... more This paper presents a type system to control the migration of code between sites in a concurrent distributed framework. The type system constitutes a decidable mechanism to ensure specific security policies, which control remote communication, process migration, and channel creation. The approach is as follows: each network administrator specifies sites privileges, and a type system checks that the processes running at those sites, as well as the composition of the sites, respect these policies. At runtime, well-typed networks do not violate the security policies declared for each site.

Concurrent objects can offer services non-uniformly, according to synchronisation constraints, th... more Concurrent objects can offer services non-uniformly, according to synchronisation constraints, that is, the availability of a service depends on the internal state of the object. Interfaces as types is an approach not suitable to model non uniform service availability, and the message not understood communication error is very restrictive. Hence, we propose a looser definition of communication error by demanding only that messages requesting a method not enabled, but that may be accepted at some time in the future, do not cause errors. This new notion detects messages that are never accepted, either because the requested method does not exists at all, or because the object is blocked and cannot change its state to accept the request. We formalise non uniform concurrent objects in T y Co, a name passing object calculus, and we ensure program safety (i.e. the absence some dynamic aspects of the behaviour of objects, thus, the approach is centred on behaviours as types. The type system...

are stored in PDF, with the report number as filename. Alternatively, reports are available by po... more are stored in PDF, with the report number as filename. Alternatively, reports are available by post from the above address.

Tom Chothia, Dominic Duggan, and Jan Vitek ii Weak Secrets and Computational Soundness . . . . . ... more Tom Chothia, Dominic Duggan, and Jan Vitek ii Weak Secrets and Computational Soundness . . . . . . . . . . . . . . . . . . . . . . . . . . . 243 Mart n Abadi Workshop on Logical Foundations of an Adaptive Preface to WOLFASI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249

Science of Computer Programming, 2014

Foreword : Special issue on the 10th International Workshop on the Foundations of Coordination La... more Foreword : Special issue on the 10th International Workshop on the Foundations of Coordination Languages and Software Architectures (FOCLASA 2011)

Electronic Proceedings in Theoretical Computer Science, 2010

2015 23rd Euromicro International Conference on Parallel, Distributed, and Network-Based Processing, 2015

We present a new soundness proof of Concurrent Separation Logic (CSL) based on a structural opera... more We present a new soundness proof of Concurrent Separation Logic (CSL) based on a structural operational semantics (SOS). We build on two previous proofs and develop new auxiliary notions to achieve the goal. One uses a denotational semantics (based on traces). The other is based on SOS, but was obtained only for a fragment of the logic - the Disjoint CSL - which disallows modifying shared variables between concurrent threads. In this work, we lift such restriction, proving the soundness of full CSL with respect to a SOS. Thus contributing to the development of tools able of ensuring the correctness of realistic concurrent programs. Moreover, given that we used SOS, such tools can be well-integrated in programming environments and even incorporated in compilers.

ftp-sop.inria.fr

In this deliverable, we make a review of the work done by the MIKADO partners which is relevant t... more In this deliverable, we make a review of the work done by the MIKADO partners which is relevant to the WP1, Programming Model. We organize the presentation into three sections. The first one is devoted to the work on models based on the π-calculus, or using a computing style close to this calculus. There are five relevant papers here, of which four are included as part of this deliverable. The second section reports on work dealing with Ambient-like models, with two papers included in this deliverable. This section also ...

Formal Languages and Automata Theory are important foundational topics in Computer Science. Their... more Formal Languages and Automata Theory are important foundational topics in Computer Science. Their rigorous and formal characteristics make their learning them demanding. An important support for the assimilation of concepts is the possibility of interactively visualizing concrete examples of these computational models, facilitating understanding them. The tools available are neither complete nor fully support the interactive aspect. This project aims at the development of an interactive web tool in Portuguese to help in an assisted and intuitive way to understand the concepts and algorithms in question, seeing them work step-by-step, through typical examples preloaded or built by the user (an original aspect of our platform). The tool should therefore enable the creation and edition of an automata, as well as execute the relevant classical algorithms such as word acceptance, model conversions, etc. It is also intended to visualize not only the process of construction of the automato...

We present an abstract machine specification for non-uniform TyCO. It is, up to our knowledge, th... more We present an abstract machine specification for non-uniform TyCO. It is, up to our knowledge, the rfist proposal of an abstract machine to compile a process calculus of nonuniform objects. TyCO is a name-passing calculus of concurrent objects. Since concurrent objects do not always offer the same methods due to synchronisation constraints, we advocate nonuniform interfaces, i.e., interfaces with only enabled methods. From the programming point of view the use of non-uniform interfaces for representing objects, as opposed to the uniform record interfaces, allows a more intuitive and expressive definition of objects and in general object-based data structures. This is a result of the far richer behaviours allowed by the non-uniformity. From an implementation point of view, frequently the code is much shorter, both in the source programs as well as in the final byte code or other executable format; even in cases where the difference in code size is not significant, the use of a singl...

We present an undecidability proof of the notion of communication errors in the polyadic #-calcul... more We present an undecidability proof of the notion of communication errors in the polyadic #-calculus. The demonstration follows a general pattern of undecidability proofs---reducing a well-known undecidable problem to the problem in question. We make use of an encoding of the #-calculus into the #-calculus to show that the decidability of communication errors would solve the problem of deciding whether a lambda term has a normal form. Introduction. The detection of communication errors in process calculi is crucial to ensure the safety of concurrent programs, i.e., the absence of run-time errors. The usual approach is to develop a type system, which is sound with respect to the notion of error, but, in general, not complete. The notions of communication errors are usually undecidable, and this makes the type approach relevant. For the polyadic #-calculus [8] this is also the case. Herein we show that the notion of communication errors in the polyadic #-calculus is undecidable. The pr...

Abstract. This paper describes a proposal for typing the behavior of objects in component models.... more Abstract. This paper describes a proposal for typing the behavior of objects in component models. Most component models, CORBA in particular, do not offer any support for expressing behavior al properties of objects beyond the “static ” information provided by IDLs. We build on the works by Honda et al. [6] and Gay and Hole [5] to show how session types can be effectively used for describing protocols, extending the information currently provided by object interfaces. We show how session types not only allow high level specifications of complex object interactions, but also allow the definition of powerful interoperability tests at the protocol level, namely compatibility and substitutability of objects 1.

OCaml is particularly well-fitted for formal verification. On one hand, it is a multiparadigm lan... more OCaml is particularly well-fitted for formal verification. On one hand, it is a multiparadigm language with a well-defined semantics, allowing one to write clean, concise, type-safe, and efficient code. On the other hand, it is a language of choice for the implementation of sensible software, e.g., industrial compilers, proof assistants, and automated solvers. Yet, with the notable exception of some interactive tools, formal verification has been seldom applied to OCaml-written programs. In this paper, we present the ongoing project Cameleer, aiming for the development of a deductive verification tool for OCaml, with a clear focus on proof automation. We leverage on the recently proposed GOSPEL, Generic OCaml SPEcification Language, to attach rigorous, yet readable, behavioral specification to OCaml code. The formally-specified program is fed to our toolchain, which translates it into an equivalent program in WhyML, the programming and specification language of the Why3 verification...

arXiv: Programming Languages, 2016

We present here in a thorough analysis of the Mool language, covering not only its implementation... more We present here in a thorough analysis of the Mool language, covering not only its implementation but also the formalisation (syntax, operational semantics, and type system). The objective is to detect glitches in both the implementation and in the formal definitions, proposing as well new features and added expressiveness. To test our proposals we implemented the revision developed in the Racket platform.

Abstract. We define a small class-based object-oriented language in which the availability of met... more Abstract. We define a small class-based object-oriented language in which the availability of methods depends on an object’s state: objects’ interfaces are dynamic. We define a static type system in which the typing of a method specifies pre- and post-conditions for its object’s state, and each class has a session type which provides a global specification of the availability of methods in each state. The state of an object may also depend on the result of a method whose return type is an enumeration. Linear typing guarantees unique ownership of objects. We prove a type safety theorem, and a theorem about consistency between a class’s session type and the typings of its methods. We then consider inheritance and the associated subtyping relation on dynamic interfaces. A subtyping relation on session types, related to that found in previous literature, characterizes the relationship between method availability in a subclass and in its superclass. We illustrate the language and its typ...

This paper presents a type system to control the migration of code between sites in a concurrent ... more This paper presents a type system to control the migration of code between sites in a concurrent distributed framework. The type system constitutes a decidable mechanism to ensure specific security policies, which control remote communication, process migration, and channel creation. The approach is as follows: each network administrator specifies sites privileges, and a type system checks that the processes running at those sites, as well as the composition of the sites, respect these policies. At runtime, well-typed networks do not violate the security policies declared for each site.