James Hook

A software engineering experiment in software component generation

The paper presents results of a software engineering experiment in which a new technology for constructing program generators from domain-specific specification languages has been compared with a reuse technology that employs sets of reusable Ada program templates. Both technologies were applied to a common problem domain, constructing message translation and validation modules for military command, control, communications and information systems (C/sup 3/I). The experiment employed four subjects to conduct trials of use of the two technologies on a common set of test examples. The experiment was conducted with personnel supplied and supervised by an independent contractor. Test cases consisted of message specifications taken from Air Force C/sup 3/I systems. The main results are that greater productivity was achieved and fewer error were introduced when subjects used the program generator than when they used Ada templates to implement software modules from sets of specifications. The differences in the average performance of the subjects are statistically significant at confidence levels exceeding 99 percent.

Type-driven defunctionalization

In 1972, Reynolds outlined a general method for eliminating functional arguments known as defunctionalization. The idea underlying defunctionalization is encoding a functional value as first-order data, and then realizing the applications of the encoded function via an apply function. Although this process is simple enough, problems arise when defunctionalization is used in a polymorphic language. In such a language, a functional argument of a higher-order function can take different type instances in different applications. As a consequence, its associated apply function can be untypable in the source language. In the paper we present a defunctionalization transformation which preserves typability. Moreover, the transformation imposes no restriction on functional arguments of recursive functions, and it handles functions as results as well as functions encapsulated in constructors. The key to this success is the use of type information in the defunctionalization transformation. Run-time characteristics are preserved by defunctionalization; hence, there is no performance improvement coming from the transformation itself. However closures need not be implemented to compile the transformed program.

Software design for reliability and reuse: a proof-of-concept demonstration

The Pacific Software Research Center is developing a new method to support reuse and introduce reliability into software. The method is based on design capture in domain specific design languages and automatic program generation using a reusable suite of program transformation tools. The transformation tools, and a domain specific component generator incorporating them, are being implemented as part of a major project underway at the Oregon Graduate Institute of Science and Technology. The processes used in tool development and application of the method are being captured. Once completed, an experiment will be performed on the generator to assess its usability and flexibility. This paper describes the Software Design for Reliability and Reuse method and illustrates its application to the Message Translation and Validation domain, a problem identified by our sponsors so that our method can be compared directly to a previously existing state-of-the-art solution based on code templates produced by the Software Engineering Institute (SEI) [14].

Substitution: a formal methods case study using monads and transformations

Abstract The specification and derivation of substitution for the de Bruijn representation of λ-terms is used to illustrate programming with a function-sequence monad. The resulting program is improved by interactive program transformation methods into an efficient implementation that uses primitive machine arithmetic. These transformations illustrate new techniques that assist the discovery of the arithmetic structure of the solution.

Achieving information flow security through precise control of effects

This paper advocates a novel approach to the construction of secure software: controlling information flow and maintaining integrity via monadic encapsulation of effects. This approach is constructive, relying on properties of monads and monad transformers to build, verify, and extend secure software systems. We illustrate this approach by construction of abstract operating systems called separation kernels. Starting from a mathematical model of shared-state concurrency based on monads of resumptions and state, we outline the development by stepwise refinements of separation kernels supporting Unix-like system calls, interdomain communication, and a formally verified security policy (domain separation). Because monads may be easily and safely represented within any pure, higher-order, typed functional language, the resulting system models may be directly realized within a language such as Haskell.

Fine Control of Demand in Haskell

Functional languages have the ?-calculus at their core, but then depart from this firm foundation by including features that alter their default evaluation order. The resulting mixed evaluation--partly lazy and partly strict--complicates the formal semantics of these languages. The functional language Haskell is such a language, with features such as pattern-matching, case expressions with guards, etc., in troducing a modicum of strictness into the otherwise lazy language. But just how does Haskell differ from the lazy ?-calculus? We answer this question by introducing a calculational semantics for Haskell that exposes the interaction of its strict features with its default laziness.

Calculating Software Generators from Solution Specifications

We have successfully demonstrated an automated transformation system that compiles practical software modules from the semantic specification of a domain-specific application design language. The integrated suite of transformation and translation tools represents a new level of design automation for software. Although there is much more that can be done to further improve the performance of generated code, the prototype system demonstrates the feasibility of this approach.

Certifying Temporal Properties for Compiled C Programs

We investigate the certification of temporal properties of untrusted code. This kind of certification has many potential applications, including high confidence extension of operating system kernels. The size of a traditional, proof-based certificate tends to expand drastically because of the state explosion problem. Abstraction-carrying Code (ACC) obtains smaller certificates at the expense of an increased verification time. In addition, a single ACC certificate may be used to certify multiple properties. ACC uses an abstract interpretation of the mobile program as a certificate. A client receiving the code and the certificate will first validate the abstraction and then run a model checker to verify the temporal property.

Experience with Abstraction-carrying Code

Abstract Abstraction-carrying Code (ACC) certifies a general temporal property for a mobile program using an abstract interpretation of the mobile program. A client receiving the code and the certificate will first validate the abstraction and then run a model checker to verify the temporal property. In this paper, we report our experience in designing the ACC Evaluation Prototype Toolkit (ACCEPT) and the application of ACCEPT to simple concurrent programs and Linux device drivers. The toolkit is distinguished by an abstraction preserving compilation scheme that generates a Boolean program for an intermediate program compiled from the source program. Some common compiler optimizations are still possible. We report several applications of ACCEPT, including the reachability properties of industrial strength C programs. Preliminary results show that the size of a typical certificate is significantly smaller than the size of the intermediate program. Compared with traditional proof-based certification method, using ACC verification a client spends more time to verify the desired property. Our experience shows this penalty is often tolerable in practice.

Monads, Indexes and Transformations

The specification and derivation of substitution for the de Bruijn representation of λ-terms is used to illustrate programming with a functionsequence monad. The resulting program is improved by interactive program transformation methods into an efficient implementation that uses primitive machine arithmetic. These transformations illustrate new techniques that assist the discovery of the arithmetic structure of the solution.