Hermes: A Tutorial and Reference Manual - Researcher - IBM
Hermes: A Tutorial and Reference Manual - Researcher - IBM
Hermes: A Tutorial and Reference Manual - Researcher - IBM
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
Clothes",calleduponlanguagedesignerstoenforcewhathecalledsecurity 3Type<strong>and</strong>TypestateChecking C.A.R.Hoare,inhis1981TuringAwardLecture,\TheEmperor'sOld inprogramminglanguages,<strong>and</strong>criticizedtherecentlyadoptedAdadesign fornotmeetingthisrequirement.Bysecurity,Hoaremeant\[t]heprinciple piler<strong>and</strong>thateverysyntacticallycorrectprogramshouldgivearesultor thateverysyntacticallyincorrectprogramshouldberejectedbythecom-<br />
anerrormessagethatwaspredictable<strong>and</strong>comprehensibleintermsofthe sourcelanguageprogramitself."Inasecurelanguage,abuginmoduleX shouldshowupasbadoutputfrommoduleX,notasacrash,orar<strong>and</strong>om<br />
guagerules.(We'rethatthelanguagehassomeconceptofmodularityin <strong>and</strong>theymustkeeponrunningthegoodprogramseventhoughsomebad programshavebeenallowedtoexecute. multipleusers,theymaydynamicallyloadarbitraryuntestedprograms, mes.Programsarelong-livedsystems,theyincludemoduleswrittenby implementation-dependentperturbationtoapossiblyinnocentmoduleY.<br />
whichitisillegalforonemoduletoaccesstheprivatedataofanother.) erroneousexecutions.Erroneousexecutionsareuncheckedviolationsoflan-<br />
Let'sadoptAda'sterminology<strong>and</strong>callexecutionswhichviolatesecurity SecurityinHoare'ssenseisextremelyimportantforalanguagelikeHer-<br />
Inpractice,erroneousexecutionsaretheresultof:(1)accessingundened values,or(2)accessingdataofthewrongtype. afteranotherhasalreadycheckeditsdiscriminant.Since<strong>Hermes</strong>hasno formedvalueoftheappropriatetype.Oroneprocessmodiesavariant dataofthewrongtype.Theremainingsecurityproblemsinlanguageslike sharing<strong>and</strong>noaliasing,thesepathologicalcasescannotarise. Adaaretheresultofaliasing<strong>and</strong>shareddata.Forexample,twoprocesses simultaneouslywriteintoasinglevariable,<strong>and</strong>theresultisapossibly interleavedsuccessionofbytesfrombothvalues,whichmaynotbeawell-<br />
Conventionaltypecheckingavoidsmostoftheproblemsofaccessing<br />
fromthedeclaration.Everyoperationhasclassrules,whichlimitwhich familiesoftypestheoper<strong>and</strong>smayhave|forexample,+mayonlybeused atypewhichisxedthroughoutitsscope,<strong>and</strong>whichisdirectlyderived withintegerorrealtypes.Everyoperationhastypeinferencerules,which determinethetypeofoneoper<strong>and</strong>asafunctionofthetypeofanother|for insertCintoS,CmustbeoftypeChar.Thedeclaredtypesofvariables exampleifSisaCharstring,denedasorderedtableofChar,thenin <strong>and</strong>theinferredtypesofexpressionsmust(1)determineauniquetypefor The<strong>Hermes</strong>typesystemisstraightforward.Everyvariablenamehas
Change language