User-Centered Design of Principled Programming Languages Michael J. Coblenz CMU-CS-20-127 August 2020 Computer Science Department School of Computer Science Carnegie Mellon University Pittsburgh, PA 15213 Thesis Committee: Jonathan Aldrich (Co-Chair) Brad A. Myers (Co-Chair) Frank Pfenning Joshua Sunshine Gail C. Murphy (University of British Columbia) Submitted in partial fulfillment of the requirements for the degree of Doctor of Philosophy. Copyright © 2020 Michael J. Coblenz This research was sponsored by the National Security Agency Department of Defense award H9823018D0008; by the National Science Foundation awards CNS1423054 and CCF1901033; by the United States Air Force Office of Scientific Research award FA8702-15-D-0002; by two IBM PhD Fellowship awards; and by Ripple. The views and conclusions contained in this document are those of the author and should not be interpreted as representing the official policies, either expressed or implied, of any sponsoring institution, the U.S. government or any other entity. Keywords: user-centered programming language design, usability of programming languages, smart contract languages, immutability, blockchain, empirical studies of programmers I dedicate this dissertation to my wife, Lauren, who has supported me and encouraged me to pursue this work. I also dedicate this dissertation to my children, Rebecca and Hannah. I hope that the work I do will make the world a better place in which they can live, and I am thankful for their support as I conducted this research. iv Abstract Programming languages exist to enable people to create and maintain software as effectively as possible. They are subject to two very different sets of requirements: first, the need to provide strong safety guarantees to protect against bugs; and sec- ond, the need for users to effectively and efficiently write software that meets their functional and quality requirements. This thesis argues that fusing formal methods for reasoning about programming languages with user-centered design methods is a practical approach to designing languages that make programmers more effective. By doing so, designers can create safer languages that are more effective for programmers than existing languages. The thesis is substantiated by the introduction of PLIERS: Programming Language Iterative Evaluation and Refinement System. PLIERS is a process for designing programming languages that integrates formal methods with user-centered design. The hypothesis that PLIERS is beneficial is supported by two language design projects. In these projects, I show how PLIERS benefits the programming language design process. Glacier is an extension to Java that enforces transitive class im- mutability, which is a much stronger property than that provided by languages that are in use today. Although there are hundreds of possible ways of restricting changes to state in programming languages, Glacier occupies a point in the design space that was justified by interview studies with professional software engineers. I evaluated Glacier in case studies, showing that it is expressive enough for some real-world applications. I also evaluated Glacier in lab studies and compared it to Java’s final keyword, finding both that Glacier is more effective at expressing immutability than final and that Glacier detects bugs that users are likely to insert in code. Blockchains are a distributed computing platform that aim to enable safe compu- tation among users who do not necessarily trust each other. To improve safety relative to existing languages, in which programmers have repeatedly deployed software with serious bugs, I designed Obsidian, a new programming language for blockchain application development. From observations about typical blockchain applications, I derived two features that motivated the design of Obsidian. First, blockchain ap- plications typically implement state machines, which support different operations in different states. Obsidian uses typestate, which lifts dynamic state into static types, to provide static guarantees regarding object state. Second, blockchain applications frequently manipulate resources, such as virtual currency. Obsidian provides a notion of ownership, which distinguishes one reference from all others. Obsidian supports resources via linear types, which ensure that owning references to resources are not accidentally lost. The combination of resources and typestate results in a novel set of design problems for the type system; although each idea has been explored individually, combining them requires unifying different perspectives on linearity. Furthermore, no language with either one of these features has been designed in a user-centered way or evaluated with users. Typical typestate systems have a complex set of permissions that provides safety properties, but these systems focused on expressiveness rather than on usability. Obsidian integrates typestate and resources in a novel way, resulting in a new type system design with a focus on simplicity and usability while retaining the desired safety properties. Obsidian is based on a core calculus I designed, Silica, for which I proved type soundness. In order to make Obsidian as usable as possible, I based its design on the results of formative studies with programmers. I evaluated Obsidian with two case studies, showing that Obsidian can be used to implement relevant programs. I also conducted a randomized controlled trial comparing Obsidian to Solidity, a popular language for writing smart contracts. I found that most of the Obsidian participants learned Obsidian and completed programming tasks after only a short training period; further, in one task, 70% of the participants who used Solidity accidentally inserted bugs that Obsidian’s compiler would have detected. Finally, Obsidian participants completed significantly more tasks correctly than did Solidity participants. vi Acknowledgments First, I thank my advisors, Jonathan Aldrich and Brad Myers, and my unofficial advisor, Joshua Sunshine, who have nurtured my research career and consistently supported me in achieving my research goals. I am grateful for their technical guidance, their counsel in choosing research directions, and their mentorship. Next, I am grateful for the amazing community at Carnegie Mellon, which has helped me flourish as a researcher and an educator. I have had wonderful conversations with Karl Crary, Andrew Faulring, Matt Fredrikson, Anna Gommerstadt, Claire Le Goues, Mor Harchol-Balter, Michael Hilton, Jan Hoffman, Eliezer Kanal, Christian Kastner,¨ Amy Ko, Stefan Muller, Cyrus Omar, Bryan Parno, Andre Platzer, Frank Pfenning, Michael Sullivan, Mary Shaw. I am particularly grateful for Jenna Wise’s help with the Obsidian formative studies. I also appreciate feedback from and discussions with James Noble and Alex Potanin. Thank you to Gail Murphy for helpful advice as a member of my thesis committee and as part of the ICSE Doctoral Symposium in 2017, and to Frank Pfenning for being part of my thesis committee. I appreciate assistance from Werner Dietl, Michael Ernst, and Suzanne Millstein in understanding the details of IGJ. I also appreciate the help of the team at ZKoss. I am grateful for the help of my numerous experiment participants, who will remain anonymous. Thanks go to Rick Hull, Jim Laredo, Petr Novotny, and Yunhui Zheng at IBM, who provided useful technical and real-world insight during the Obsidian project. Thank you also to David Gould and Georgi Panterov at the World Bank, with whom I worked on the insurance case study. Undergraduate and masters students made significant contributions to this work, and I enjoyed working with them immensely: Gauri Agarwal, Ishan Bhargava, Yan- nick Bloem, Suzz Glennon, Sachi Sharma, and Bobby Zhang. I am particularly grateful for students who spent an entire summer working with me through the Research Experience for Undergraduates in Software Engineering program: Miles Baker, Celeste Barnaby, Tyler Etzel, Gauri Kambhatla, Paulette Koronkevich, Whit- ney Nelson, and Reed Oei. I have learned much working with all of these students. I am grateful to all of my colleagues in the iWork group at Apple, who taught me so much about how to write great software. Finally, special thanks to my wife, Lauren, and my daughters Hannah and Rebecca, for the constant encouragement and support, as well as for facilitating all of the travel that is required to participate in the international research community. Likewise to my parents, Deborah and Robert, who nurtured my fascination with computers since I was a young child; to my brother, Joshua, for his support; and to my aunt Norma, who introduced me to computing at a young age at a time when very few people had personal computers (1985). viii Contents 1 Introduction 1 1.1 Thesis Statement . .3 1.2 Glacier . .3 1.3 Obsidian . .4 1.4 Technical contributions . .5 1.4.1 Immutability . .5 1.4.2 Glacier . .5 1.4.3 Obsidian . .6 1.5 Methodological Contributions . .7 1.6 Thesis Outline . .9 2 Related Work 11 2.1 Human-centered programming language design . 11 2.2 Design Methods . 14 2.2.1 Methods for Requirements and Creation . 14 2.2.2 Methods for Evaluation . 17 2.3 Immutability Systems . 19 2.4 Blockchain Programming Languages . 20 2.4.1 Smart contract languages . 20 2.5 Aliasing, Permissions, and Linearity . 21 2.6 Typestate . 22 3 PLIERS: A User-Centered Process for Programming Language Design 23 3.1 Introduction . 23 3.2 PLIERS . 27 3.2.1 Evaluating PLIERS . 31 4 Exploring Immutability Features 33 4.1 Introduction . 33 4.2 Overview of Concepts . 34 4.2.1 Type of Restriction . 34 4.2.2 Scope . 35 4.2.3 Transitivity . 35 4.2.4 Initialization . 36 ix 4.2.5 Abstract vs. Concrete State . 36 4.2.6 Backward Compatibility . 36 4.2.7 Enforcement . 37 4.2.8 Polymorphism . 37 4.3 A Survey of Existing Systems . 37 4.3.1 Historical and Research Systems . 39 4.3.2 Popular Languages and Libraries . 41 4.3.3 Empirical Evaluations . 42 4.4 Usability of Features . 43 4.5 Interviews with Developers . 45 4.5.1 Methodology . 45 4.5.2 Results . 47 4.5.3 Implications on language design .