Gary Lindstrom

Modularity meets inheritance

Several roles of classes in existing languages are unbundled by providing a suite of operators independently controlling such effects as combination, modification, encapsulation, name resolution, and sharing, all on the single notion of a module. It is pointed out that all module operators are forms of inheritance: thus, inheritance not only is not in conflict with modularity in the present system, but is its foundation. This allows a previously unobtainable spectrum of features to be combined in a cohesive manner, including multiple inheritance, mixings, encapsulation, and strong typing. The proposed approach is demonstrated in a language called Jigsaw. The language is modular in two senses: it manipulates modules and it is highly modular in its own conception, permitting various module combinators to be included, omitted, or newly constructed in various realizations.<<ETX>>

Nemos: a framework for axiomatic and executable specifications of memory consistency models

Summary form only given. Conforming to the underlying memory consistency rules is a fundamental requirement for implementing shared memory systems and developing multiprocessor programs. In order to promote understanding and enable automated verification, it is highly desirable that a memory model specification be both declarative and executable. We present a specification framework called Nemos (Nonoperational yet Executable Memory Ordering Specifications), which supports precise specification and automatic execution in the same framework. We employ a uniform notation based on predicate logic to define shared memory semantics in an axiomatic as well as compositional style. We also apply constraint logic programming and SAT solving to make the axiomatic specifications executable for memory model analysis. To illustrate our approach, we formalize a collection of classical memory models, including sequential consistency, coherence, PRAM, causal consistency, and processor consistency.

Functional programing and the logical variable

Logic programming offers a variety of computational effects which go beyond those customarily found in functional programming languages. Among these effects is the notion of the “logical variable.” i.e. a value determined by the intersection of constraints, rather than by direct binding. We argue that this concept is “separable” from logic programming, and can sensibly be incorporated into existing functional languages. Moreover, this extension appears to significantly widen the range of problems which can efficiently be addressed in function form, albeit at some loss of conceptual purity. In particular, a form of side-effects arises under this extension, since a function invocation can exert constraints on variables shared with other function invocations. Nevertheless, we demonstrate that determinacy can be retained, even under parallel execution. The graph reduction language FGL is used for this demonstration, by being extended to a language FGL+LV permitting formal parameter expressions, with variables occurring therein bound by unification. The determinacy argument is based on a novel dataflow-like rendering of unification. In addition the complete partial order employed in this proof is unusual in its explicit representation of demand, a necessity given the “benign” side-effects that arise. An implementation technique is suggested, suitable for reduction architectures.

UMM: an operational memory model specification framework with integrated model checking capability

Given the complicated nature of modern shared memory systems, it is vital to have a systematic approach to specifying and analyzing memory consistency requirements. In this paper, we present the UMM specification framework, which integrates two key features to support memory model verification: (i) it employs a simple and generic memory abstraction that can capture a large collection of memory models as guarded commands with a uniform notation, and (ii) it provides built‐in model checking capability to enable formal reasoning about thread behaviors. Using this framework, memory models can be specified in a parameterized style—designers can simply redefine a few bypassing rules and visibility ordering rules to obtain an executable specification of another memory model. We formalize several classical memory models, including Sequential Consistency, Coherence, and PRAM, to illustrate the general techniques of applying this framework. We then provide an alternative specification of the Java memory model, based on a proposal from Manson and Pugh, and demonstrate how to analyze Java thread semantics using model checking. We also compare our operational specification style with axiomatic specification styles and explore a mechanism that converts a memory model definition from one style to the other. Copyright

Analyzing the Intel Itanium Memory Ordering Rules Using Logic Programming and SAT

We present a non-operational approach to specifying and analyzing shared memory consistency models. The method uses higher order logic to capture a complete set of ordering constraints on execution traces, in an axiomatic style. A direct encoding of the semantics with a constraint logic programming language provides an interactive and incremental framework for exercising and verifying finite test programs. The framework has also been adapted to generate equivalent boolean satisfiability (SAT) problems. These techniques make a memory model specification executable, a powerful feature lacked in most non-operational methods. As an example, we provide a concise formalization of the Intel Itanium memory model and show how constraint solving and SAT solving can be effectively applied for computer aided analysis. Encouraging initial results demonstrate the scalability for complex industrial designs.

Model checking real time java using java pathfinder

The Real Time Specification for Java (RTSJ) is an augmentation of Java for real time applications of various degrees of hardness. The central features of RTSJ are real time threads; user defined schedulers; asynchronous events, handlers, and control transfers; a priority inheritance based default scheduler; non-heap memory areas such as immortal and scoped, and non-heap real time threads whose execution is not impeded by garbage collection. The Robust Software Systems group at NASA Ames Research Center has Java PathFinder(JPF) under development, a Java model checker. JPF at its core is a state exploring JVM which can examine alternative paths in a Java program (e.g., via backtracking) by trying all nondeterministic choices, including thread scheduling order. This paper describes our implementation of an RTSJ profile (subset) in JPF, including requirements, design decisions, and current implementation status. Two examples are analyzed: jobs on a multiprogramming operating system, and a complex resource contention example involving autonomous vehicles crossing an intersection. The utility of JPF in finding logic and timing errors is illustrated, and the remaining challenges in supporting all of RTSJ are assessed.

Memory-Model-Sensitive Data Race Analysis

We present a “memory-model-sensitive” approach to validating correctness properties for multithreaded programs. Our key insight is that by specifying both the inter-thread memory consistency model and the intra-thread program semantics as constraints, a program verification task can be reduced to an equivalent constraint solving problem, thus allowing an exhaustive examination of all thread interleavings precisely allowed by a given memory model. To demonstrate, this paper formalizes race conditions according to the new Java memory model, for a simplified but non-trivial source language. We then describe the implementation of a memory-model-sensitive race detector using constraint logic programming (CLP). In comparison with conventional program analysis, our approach does not offer the same kind of performance and scalability due to the complexity involved in exact formal reasoning. However, we show that a formal semantics can serve more than documentation purposes — it can be applied as a sound basis for rigorous property checking, upon which more scalable methods can be derived.

Specifying Java thread semantics using a uniform memory model

Standardized language level support for threads is one of the most important features of Java. However, defining the Java Memory Model (JMM) has turned out to be a major challenge. Several models produced to date are not as easily comprehensible and comparable as first thought. Given the growing interest in multithreaded Java programming, it is essential to have a sound framework that would allow formal specification and reasoning about the JMM.This paper presents the Uniform Memory Model (UMM), a generic memory model specification framework. Based on guarded commands, UMM can be easily integrated with a model checking utility, providing strong built-in support for formal verification and program analysis. With a flexible and simple architecture, UMM is configurable to capture different memory consistency requirements for both architectural and language level memory models. An alternative formal specification of the JMM, primarily based on the semantics proposed by Manson and Pugh, is implemented in UMM. Systematic analysis has revealed interesting properties of the proposed semantics. Inconsistencies from the original specification have also been uncovered.

An Application Framework For Module Composition Tools

This paper shows that class inheritance, viewed as a mechanism for composing self-referential namespaces, is a broadly applicable concept. We show that several kinds of software artifacts can be modeled as self-referential namespaces, and software tools based on a model of composition of namespaces can effectively manage these artifacts. We describe four such tools: an interpreter for compositionally modular Scheme, a compositional linker for object files, a compositional interface definition language, and a compositional document processing tool. We show that these tools benefit significantly from incorporating inheritance-based reuse. Furthermore, the implementation of these tools share much in common since they are based on the same underlying model. We describe a reusable OO framework for efficiently constructing such tools. Three of the above tools were built by directly reusing the application framework, and the fourth evolved in parallel with it. We provide reuse statistics and experiences with the development of our framework and its completions.

An implementation of portable standard LISP on the BBN butterfly

An implementation of the Portable Standard Lisp (PSL) on the BBN Butterfly is described. Butterfly PSL is identical, syntactically and semantically, to implementations of PSL currently available on the VAX, Gould, and many 68000-based machines, except for the differences discussed in this paper. The differences include the addition of the future and touch constructs for explicit parallelism and an extension of the fluid binding mechanism to support the multiple environments required by concurrent tasks. As with all other PSL implementations, full compilation to machine code of the basic system and application source code is the normal mode, in contrast to the previous byte-code interpreter efforts. Also discussed are other required changes to the PSL system not visible in the syntax or semantics, e.g., compiler support for the future construct. Finally, the underlying hardware is described, and timings for basic operations and speedup results for two examples are given.