Mehdi Bagherzadeh

Translucid contracts: expressive specification and modular verification for aspect-oriented interfaces

As aspect-oriented (AO) programming techniques become more widely used, their use in critical systems such as aircraft and telephone networks, will become more widespread. However, careful reasoning about AO code seems difficult because: (1) advice may apply in too many places, and (2) standard specification techniques do not limit the control effects of advice. Commonly used black box specification techniques cannot easily specify control effects, such as advice that does not proceed to the advised code. In this work we avoid the first problem by using Ptolemy, a language with explicit event announcement. To solve the second problem we give a simple and understandable specification technique, translucid contracts, that not only allows programmers to write modular specifications for advice and advised code, but also allows them to reason about the codes control effects. We show that translucid contracts support sound modular verification of typical interaction patterns used in AO code. We also show that translucid contracts allow interesting control effects to be specified and enforced.

Panini: a concurrent programming model for solving pervasive and oblivious interference

Modular reasoning about concurrent programs is complicated by the possibility of interferences happening between any two instructions of a task (pervasive interference), and these interferences not giving out any information about the behaviors of potentially interfering concurrent tasks (oblivious interference). Reasoning about a concurrent program would be easier if a programmer modularly and statically (1) knows precisely the program points at which interferences may happen (sparse interference), and (2) has some insights into behaviors of potentially interfering tasks at these points (cognizant interference). In this work we present Panini, a core concurrent calculus which guarantees sparse interference, by controlling sharing among concurrent tasks, and cognizant interference, by controlling dynamic name bindings and accessibility of states of tasks. Panini promotes capsule-oriented programming whose concurrently running capsules own their states, communicate by asynchronous invocations of their procedures and dynamically transfer ownership. Panini limits sharing among two capsules to other capsules and futures, limits accessibility of a capsule states to only through its procedures and dispatches a procedure invocation on the static type of its receiver capsule. We formalize Panini, present its semantics and illustrate how its interference model, using behavioral contracts, enables Hoare-style modular reasoning about concurrent programs with interference.

On exceptions, events and observer chains

Modular understanding of behaviors and flows of exceptions may help in their better use and handling. Such reasoning tasks about exceptions face unique challenges in event-based implicit invocation (II) languages that allow subjects to implicitly invoke observers, and run the observers in a chain. In this work, we illustrate these challenge in Ptolemy and propose Ptolemy-X that enables modular reasoning about behaviors and flows of exceptions for event announcement and handling. Ptolemy-Xs exception-aware specification expressions and boundary exceptions limit the set of (un)checked exceptions of subjects and observers of an event. Exceptional postconditions specify the behaviors of these exceptions. Greybox specifications specify the flows of these exceptions among the observers in the chain. Ptolemy-Xs type system and refinement rules enforce these specifications and thus enable its modular reasoning. We evaluate the utility of Ptolemy-Xs exception flow reasoning by applying it to understand a set of aspect-oriented (AO) bug patterns. We also present Ptolemy-Xs semantics including its sound static semantics.

AspectJML: modular specification and runtime checking for crosscutting contracts

Aspect-oriented programming (AOP) is a popular technique for modularizing crosscutting concerns. In this context, researchers have found that the realization of design by contract (DbC) is crosscutting and fares better when modularized by AOP. However, previous efforts aimed at supporting crosscutting contract modularity might actually compromise the main DbC principles. For example, in AspectJ-style, reasoning about the correctness of a method call may require a whole-program analysis to determine what advice applies and what that advice does relative to DbC implementation and checking. Also, when contracts are separated from classes a programmer may not know about them and may break them inadvertently. In this paper we solve these problems with AspectJML, a new specification language that supports crosscutting contracts for Java code. We also show how AspectJML supports the main DbC principles of modular reasoning and contracts as documentation.

On ordering problems in message passing software

The need for concurrency in modern software is increasingly fulfilled by utilizing the message passing paradigm because of its modularity and scalability. In the message passing paradigm, concurrently running processes communicate by sending and receiving messages. Asynchronous messaging introduces the possibility of message ordering problems: two messages with a specific order in the program text could take effect in the opposite order in the program execution and lead to bugs that are hard to find and debug. We believe that the engineering of message passing software could be easier if more is known about the characteristics of message ordering problems in practice. In this work, we present an analysis to study and quantify the relation between ordering problems and semantics variations of their underlying message passing paradigm in over 30 applications. Some of our findings are as follows: (1) semantic variations of the message passing paradigm can cause ordering problems exhibited by applications in different programming patterns to vary greatly; (2) some semantic features such as in-order messaging are critical for reducing ordering problems; (3) modular enforcement of aliasing in terms of data isolation allows small test configurations to trigger the majority of ordering problems.

Modular reasoning in the presence of event subtyping

Separating crosscutting concerns while preserving modular reasoning is challenging. Type-based interfaces (event types) separate modularized crosscutting concerns (observers) and traditional object-oriented concerns (subjects). Event types paired with event specifications were shown to be effective in enabling modular reasoning about subjects and observers. Similar to class subtyping, organizing event types into subtyping hierarchies is beneficial. However, unrelated behaviors of observers and their arbitrary execution orders could cause unique, somewhat counterintuitive, reasoning challenges in the presence of event subtyping. These challenges threaten both tractability of reasoning and reuse of event types. This work makes three contributions. First, we pose and explain these challenges. Second, we propose an event-based calculus to show how these challenges can be overcome. Finally, we present modular reasoning rules of our technique and show its applicability to other event-based techniques.

Modularizing crosscutting contracts with AspectJML

It is claimed in the literature that the contracts of a system present crosscutting structure during its realization. In this context, there has been attempts to improve separation of crosscutting contracts, e.g. by aspect-oriented programming and design by contract languages, but none give programmers textual separation of contracts/specifications and modular reasoning at the same time. In this demonstration we show how our language, AspectJML, a simple and practical aspect-oriented extension to JML, allows the separation of crosscutting contracts while maintaining the key benefits of a design by contract language, like documentation and modular reasoning. AspectJMLs quantified statements, written in terms of AspectJ pointcut language, allow one to select join points in which the contracts are written in a modular and convenient way. Also, all the crosscutting contracts are well documented in the class they apply to, thus allowing the reasoning about crosscutting contracts in a modular fashion. This demonstration will proceed by discussing several examples that highlights the main features of the AspectJML language and show the use of AspectJMLs compiler, ajmlc. We will conclude with a discussion of ongoing work on design, implementation and runtime checking of both Java and AspectJ programs with AspectJML/ajmlc.

Applying translucid contracts for modular reasoning about aspect and object oriented events

The Implicit Invocation (II) architectural style improves modularity and is promoted by aspect-oriented (AO) languages and design patterns like Observer. However, it makes modular reasoning difficult, especially when reasoning about control effects of the advised code (subject). Our language Ptolemy, which was inspired by II languages, uses translucid contracts for modular reasoning about the control effects; however, this reasoning relies on Ptolemys event model, which has explicit event announcement and declared event types. In this paper we investigate how to apply translucid contracts to reasoning about events in other AO languages and even non-AO languages like C#

Translucid contracts for modular reasoning about aspect-oriented programs

Several proposals have advocated notion of aspect-oriented (AO) interfaces to solve modular reasoning problems, but have not shown how to specify these interfaces to facilitate modular reasoning. Our work on translucid contracts shows how to specify AO interfaces which allow modular understanding and enforcement of control flow interactions.

Modularizing crosscutting concerns with Ptolemy

This tutorial will provide an introduction to Ptolemy. Ptolemy is a programming language whose goals are to improve a software engineers ability to separate conceptual concerns, while preserving encapsulation of object-oriented code and the ability of programmers to modularly reason about their code. In particular, Ptolemys features are useful towards modularization of cross-cutting concerns. A cross-cutting concern is a requirement whose implementation is spread across and mixed with the code of other requirements. There has been attempts to improve separation of cross-cutting concerns, e.g. by aspect oriented and implicit-invocation languages, but none give software developers textual separation of concerns and modular reasoning at the same time. Ptolemy has both these properties important for scalable software engineering. Ptolemys event types provide a well-defined interface between object-oriented code and cross-cutting code. This in turn enables separate type-checking and compilation. Ptolemy also provides a novel and practical specification mechanism that we call translucid contracts. A translucid contracts allows developers to reason about the control effects of the object-oriented code and cross-cutting code modularly. This tutorial will proceed by discussing the goals of the Ptolemy programming language. We will then discuss Ptolemys programming features and its specification features by way of several hands-on exercises. We will conclude with pointers to ongoing work on design, implementation and verification of Ptolemy programs.