Reactive Contracts

Chapter V: Reactive Contracts

5.3 Reactive Contracts

haveE_C =2^𝐴andM_C =2^𝐴⇒𝐺. Therefore, ifC ≤ C₁,C₂, then by Definition 5.2.3, M_C ⊆ M_C1∩ M_C2 = 2^{𝐴1⇒𝐺1} ∩2^{𝐴2⇒𝐺2} = 2^{(𝐴1⇒𝐺1)∧(𝐴2⇒𝐺2)} and 2^{𝐴1∨𝐴2} =2^𝐴1 ∪ 2^𝐴2 =E_C1∪ E_C2 ⊆ E_C (since the intersection/union of powersets of two sets is the powerset of their intersection/union). By the fact that (𝐴₁ ⇒𝐺₁) ∧ (𝐴₂⇒ 𝐺₂) is saturated, we haveC₁∧ C₂= (𝐴₁∨ 𝐴₂,(𝐴₁⇒ 𝐺₁) ∧ (𝐴₂ ⇒𝐺₂)). By induction, we can conclude the following:

Proposition 10. If for𝑖=1,2, . . . , 𝑛,𝐶_𝑖are assume-guarantee contracts, then

∧^𝑛_𝑖=1C𝑖 =(∨^𝑛_𝑖=1𝐴_𝑖,∧^𝑛_𝑖=1𝐴_𝑖 ⇒ 𝐺_𝑖). (5.5) Note that we can apply an analogous argument to the disjunction of contracts (defined as their join) to conclude that the set of all saturated contracts forms a complete lattice. Equation (5.5) shows that the “parametric contract” formalism given in (Kim, Arcak, and Seshia, 2017) is exactly the result of applying the conjunction operation to the constituent contracts. That is, if 𝑀 is an implementation of the conjunction∧𝑖C𝑖containing𝜎 such that𝜎 ∈𝐸 where𝐸 is an environment of∧𝑖C𝑖, then there exists at least a 𝑘 ∈ {1,2, . . . , 𝑛} such that 𝜎 ∈ 𝐴_𝑘 and for all such 𝑘, 𝜎 ∈ 𝐺_𝑘. In other words, for any behavior 𝜎 in which the environment satisfies any assumption 𝐴_𝑘 in {𝐴₁, 𝐴₂, . . . , 𝐴_𝑛}, the system must react by providing the corresponding guarantee 𝐺_𝑘. Thus in contract conjunctions, 1) the reactions are defined by pairing each 𝐴_𝑘 with the corresponding𝐺_𝑘, and 2) 𝐴_𝑘 ⇒𝐺_𝑘 must hold over the sequence𝜎in its entirety. The second restriction is partially relaxed in the

“dynamic contract” formalism, used for instance in (Kim, Sadraddini, et al., 2017), where assumptions are allowed to change over fixed time intervals. Our reactive contract framework will 1) remove the one-to-one restriction to allow for a more flexible assumption-guarantee pairing process, 2) enforces immediate guarantee reactions to assumption changes directly on each element 𝜎 ∈ B, and 3) enables automated synthesis.

5.3 Reactive Contracts

sequence concatenationoperator mapping from(Pref(B)×Pref(B))∪(Pref(B)×B) to Pref(B) ∪ B.

Definition 5.3.1(Witness). Let𝜎 ∈ B, 𝐴⊆ B and𝑖, 𝑗 ∈N0∪ {∞} :𝑖 < 𝑗. We say that𝜎is awitnessfor𝐴from𝑖up until 𝑗and write𝜎 |=𝑖→𝑗 𝐴if𝜎_𝑖→𝑗 ∈Pref(𝐴) ∪𝐴. If 𝑗 ≠ ∞, we consider the witness relation as beingstrict and write 𝜎 |=_𝑖^𝑠_→𝑗 𝐴 if 𝜎 |=𝑖→𝑗 𝐴, but𝜎 6|=𝑖→𝑗+1 𝐴. If 𝑗 =∞, the witness relation is always strict.

To describe and keep track of assumption changes, we appeal to the notion of assigningsignatures(or labels) to each behavior that undergoes those changes.

Definition 5.3.2 (Signature). Given a set of assertions A ⊆ 2^B, an A-signature is any nonempty assertion sequence 𝛼 = h𝛼_𝑘i^𝑚

𝑘=0 ∈ A^∞ where 𝑚 ∈ N∪ {∞}. If 𝑚 < ∞, we say𝜎 ∈ B is a witness for𝛼and put𝜎 |=𝛼if there exists a partitioning sequenceh𝑖_𝑘i^𝑚

𝑘=0inN0satisfying 0=𝑖₀ < 𝑖₁ < . . . < 𝑖_𝑚 such that with𝑖_𝑚+1 B ∞, we have

∀𝑘 ∈ {0,1, . . . , 𝑚}.𝜎 |=𝑖𝑘→𝑖𝑘+1 𝛼_𝑘. (5.6) We say that𝜎 is a strict witness for the signature𝛼and write𝜎 |=^𝑠 𝛼if the witness relation in equation (5.6) is strict. Analogously, if 𝑚 = ∞, then 𝜎 |= 𝛼 if there exists a (strictly monotone) partitioning sequenceh𝑖_𝑘i^∞

𝑘=0inN0satisfying𝑖₀ =0 and equation (5.6) with{0,1, . . . , 𝑚}replaced byN0.

In general, a given 𝜎 ∈ B may be a strict witness for more than one signature in A^∞. For example, if A = {𝐴₁, 𝐴₂} where 𝐴₁ ∩ 𝐴₂ ≠ ∅, then any behavior 𝜎 ∈ 𝐴₁∩ 𝐴₂ satisfies 𝜎 |=^𝑠 h𝐴_𝑗i for 𝑗 ∈ {1,2}. This may still be the case even when 𝐴₁∩ 𝐴₂ =∅. ForV = {𝑥 , 𝑦}, 𝐴₁ = {h{𝑥}i^∞

𝑖=0} and 𝐴₂ = {h{𝑦}i^∞

𝑖=0} ∪ {𝜎} where𝜎satisfies𝜎_𝑘 ={𝑥}for𝑘 =0 and𝜎_𝑘 ={𝑦}, otherwise. Then𝜎 |=^𝑠 h𝐴₁, 𝐴₂i and 𝜎 |=^𝑠 h𝐴₂i. This non-uniqueness makes it unclear as to which assumption change sequence should be considered and how/when to properly react to it. Being able to restrict the set of assumptions so that this does not happen is necessary because in order to react at all, the system must be able to consistently detect which assumption to operate under next. The following proposition gives a necessary and sufficient condition.

Proposition 11. LetAbe a collection of assertions, then

∀𝛼, 𝛽∈ A^∞.∀𝜎 ∈ B.(𝜎 |=^𝑠 𝛼∧𝜎 |=^𝑠 𝛽) ⇒𝛼= 𝛽, (5.7)

if and only if

∀𝐴₁, 𝐴₂∈ A. 𝐴₁≠ 𝐴₂⇒Pref₁(𝐴₁) ∩Pref₁(𝐴₂) =∅. (5.8) Proof. First, assume thatAdoes not satisfy Formula (5.8). Let 𝐴₁, 𝐴₂be such that 𝐴₁ ≠ 𝐴₂and Pref₁(𝐴₁) ∩Pref₁(𝐴₂) ≠∅. Observe that for any𝑘 ∈N0and𝜎 ∈ B, if 𝜎_0→𝑘+1 ∈Pref𝑘+1(𝐴₁) ∩Pref𝑘+1(𝐴₂) then𝜎_0→𝑘 ∈ Pref𝑘(𝐴₁) ∩Pref𝑘(𝐴₂). Hence, either𝐴₁∩𝐴₂≠∅, in which case (5.7) clearly does not hold, or there exists a𝑘⁰≥ 1 such that Pref𝑘⁰(𝐴₁)∩Pref𝑘⁰(𝐴₂) ≠ ∅and Pref𝑘⁰+1(𝐴₁)∩Pref𝑘⁰+1(𝐴₂) =∅. Let𝜎⁰∈ Pref𝑘⁰(𝐴₁) ∩Pref𝑘⁰(𝐴₂)and𝜎₁ ∈ 𝐴₁,𝜎₂∈ 𝐴₂be such that 𝜎_10→𝑘0 =𝜎_20→𝑘0 =𝜎⁰. If for all 0 < 𝑖 < 𝑘⁰, we have𝜎⁰

𝑖 = 𝜎⁰

0, then h𝜎⁰

0i^∞

𝑖=0 |=^𝑠 h𝐴₁ior h𝜎⁰

0i^∞

𝑖=0 |=^𝑠 h𝐴₁i^∞

𝑖=0

while h𝜎⁰

0i^∞

𝑖=0 |=^𝑠 h𝐴₂i or h𝜎⁰

0i^∞

𝑖=0 |=^𝑠 h𝐴₂i^∞

𝑖=0. On the other hand, if there is an 0 < 𝑘 < 𝑘⁰ such that 𝜎⁰

𝑘 ≠ 𝜎⁰

0, then for 𝜎⁰⁰ B 𝜎⁰

0→𝑘+1 · 𝜎⁰

0→𝑘+1 · . . ., we have 𝜎⁰⁰ |=^𝑠 h𝐴₁i^∞

𝑖=0and𝜎⁰⁰ |=^𝑠 h𝐴₁i^∞

𝑖=0. Both of these cases contradict Formula (5.7).

For the other direction, assume thatAsatisfies (5.8). Let𝛼, 𝛽∈ A^∞and𝜎 ∈ Bbe such that𝜎 |=^𝑠 𝛼and𝜎 |=^𝑠 𝛽. Let𝑚 ∈ N∪ {∞}be the length of𝛼. By the fact that𝜎₀ ∈Pref₁(𝛼₀) ∩Pref₁(𝛽₀)and∀𝐴 ∈ A. 𝐴≠ 𝛼₀ ⇒Pref₁(𝐴) ∩Pref₁(𝛼₀)=∅, we conclude that 𝛼₀ = 𝛽₀. Suppose that up to𝑛 < 𝑚, 𝛼_𝑘 = 𝛽_𝑘 for all 𝑘 satisfying 0 ≤ 𝑘 ≤ 𝑛. We will show that𝛼_𝑛+1and 𝛽_𝑛+1are defined and equal to one another.

Indeed, since 𝑛 < 𝑚, the (𝑛 + 1)^th term of 𝛼, 𝛼_𝑛+1, exists. Let h𝑖_𝑘i^𝑚

𝑘=0 be a partitioning sequence for𝜎 |=^𝑠 𝛼 given by Definition 5.3.2. By strictness and the induction hypothesis, we have 𝜎_𝑖

𝑛→(𝑖_𝑛+1+1) 6|= 𝛼_𝑛 = 𝛽_𝑛. Since 𝜎 |=^𝑠 𝛽, it follows that 𝛽_𝑛+1 exists as well. From 𝜎 |=^𝑠 𝛼, if𝑛+2 ≤ 𝑚, we have 𝜎 |=_𝑖^𝑠

𝑛+1→𝑖𝑛+2

𝛼_𝑛+1 and, in particular,𝜎_𝑖

𝑛+1 ∈Pref₁(𝛼_𝑛+1) ∩Pref₁(𝛽_𝑛+1), which by Formula (5.8) yields 𝛼_𝑛+1= 𝛽_𝑛+1. If𝑛+2> 𝑚, then𝜎 |=^𝑠

𝑖𝑛+1→∞𝛼_𝑛+1, arguing similarly, we arrive at the additional conclusion that 𝛽also has length𝑚. This implies Formula (5.7).

AnyAthat satisfies (5.8) is calledinitially disjoint. Hence, Proposition 11 says that Ais a set of assertions that are initially disjoint if and only if any behavior is a strict witness for at most oneA-signature. LetB_A B {𝜎 ∈ B | ∃𝛼∈ A^∞.𝜎 |=^𝑠 𝛼}, the set of behaviors that haveA-signatures. IfAis initially disjoint, then the function U_A : B_A → A^∞ mapping each 𝜎 ∈ B_A to the unique signature U_A(𝜎) ∈ A^∞ for which it is a witness is well-defined. Lastly, for any 𝑀 ⊆ B_A, we denote by U_A(𝑀) the set of signatures generated by𝑀, namely,{U_A(𝜎) | 𝜎 ∈ 𝑀}.

Contracts

Definition 5.3.3(Reactive contracts). A reactive assume-guarantee contractCis a 4-tuple(A,G,Δ, 𝑅) where

1. A,G ⊆ 2^B are called theassumptionandguarantee sets, respectively. A is required to be initially disjoint.

2. Δ ⊆ A^∞ is called the contingency set, consisting of assumption change scenarios that may happen.

3. 𝑅 ⊆ (A × G)^∞ is called thereaction set.

Observe thatAandGare not necessarily of the same cardinality and that from each 𝑟 ∈ 𝑅, we can obtain a uniqueA-signature by “projecting away theGdimension.”

We denote the projection function byΠ_A : 𝑅 → A^∞ so thatΠ_A(h𝐴_𝑘, 𝐺_𝑘i^𝑚

𝑘=0) B h𝐴_𝑘i^𝑚

𝑘=0for any h𝐴_𝑘, 𝐺_𝑘i^𝑚

𝑘=0 ∈ 𝑅.

Definition 5.3.4(Environment). Anenvironment forC = (A,G,Δ, 𝑅) is any 𝐸 ⊆ B_A such that U_A(𝐸) ⊆ Δ, namely each 𝜎 ∈ 𝐸 is a strict witness for some A- signature inΔ.

Thus, for a reactive contract, assumptions about its environment’s behaviors are allowed to change according to the contingency specified inΔ. As these assumptions change, the system should provide the corresponding guarantees as specified by the reaction set𝑅. We characterize𝑅via the following definitions.

Definition 5.3.5 (Reactive satisfaction). Let 𝜎 ∈ B, 𝑟 = h(𝐴_𝑘, 𝐺_𝑘)i^𝑚

𝑘=0 ∈ 𝑅. We say that𝜎 reactively satisfies𝑟 and write𝜎 |=^𝜌𝑟 if the following hold

1. 𝜎 |=^𝑠 ΠA(𝑟) with the partitioning sequenceh𝑖_𝑘i^𝑚

𝑘=0. 2. a) If𝑚 < ∞, then∀𝑘 ∈ {0,1, . . . , 𝑚}.𝜎_𝑖

𝑘→𝑖_𝑘+1 |=𝐺_𝑘 with𝑖_𝑚+1B ∞;

b) otherwise,∀𝑘 ∈N0.𝜎_𝑖

𝑘→𝑖_𝑘+1 |=𝐺_𝑘.

Definition 5.3.6(Implementation). An implementation of a reactive contract C = (A,G,Δ, 𝑅) is any𝑀 ⊆ Bsuch that for any environment𝐸 ofC, we have

∀𝜎 ∈ (𝑀∩𝐸).∃𝑟 ∈𝑅 .𝜎 |=^𝜌 𝑟∧Π_A(𝑟) =U_A(𝜎).

Intuitively, an implementation consists of all behaviors 𝜎 in which either the as- sumptions do not change according to Δ, i.e., U_A(𝜎) ∉ Δ, or the system reacts according to instructions specified by the set𝑅, namely there exists a reaction𝑟 ∈ 𝑅, such that𝜎reactively satisfies𝑟, in which the system must satisfy the guarantee cor- responding to the current assumption for as long as the latter holds and is required to immediately adapt to any new assumption by committing itself to the corresponding new obligation. Let us compare this formalism to “standard” assume-guarantee contracts. First, we mention that the following holds.

Proposition 12. Corresponding to each standard assume-guarantee contract C = (𝐴, 𝐺) is a reactive assume-guarantee contract C𝑟 = (A,G,Δ, 𝑅) with A = {𝐴},G = {𝐺},Δ = {h𝐴i}, and 𝑅 = {h(𝐴, 𝐺)i} such that C = C𝑟 in the sense that they have same sets of environments and implementations.

Recall that any parametric assume-guarantee contract is a standard assume-guarantee contract obtained by taking the conjunction of a set of standard assume-guarantee contracts. Therefore, by Proposition 12, each parametric assume-guarantee contract has a reactive version. In particular, when all assumptions are initially disjoint, we have the following generalization of Proposition 12.

Proposition 13. If 𝑛 ≥ 1, {𝐴₁, 𝐴₂, . . . , 𝐴_𝑛} is a set of initially disjoint assertions and for𝑖 ∈ {1,2, . . . , 𝑛}, C𝑖 = (𝐴_𝑖, 𝐺_𝑖) are assume-guarantee contracts, then there exists a reactive assume-guarantee contractC𝑟 such that∧^𝑛

𝑖=1C= C𝑟. Proof. LetC𝑟 =(A,G,Δ, 𝑅) be defined with

• A B {𝐴₁, 𝐴₂, . . . , 𝐴_𝑛},

• G B {𝐺₁, 𝐺₂, . . . , 𝐺_𝑛},

• ΔB {h𝐴₁i,h𝐴₂i, . . . ,h𝐴_𝑛i},

• 𝑅 B {h(𝐴₁, 𝐺₁)i,h(𝐴₂, 𝐺₂)i, . . . ,h(𝐴_𝑛, 𝐺_𝑛)i}. Then,𝐸 ∈ E_C if and only if

∀𝜎 ∈𝐸 .𝜎 ∈ ∨_𝑖^𝑛₌₁𝐴_𝑖

⇔ ∀𝜎 ∈𝐸 .∃𝑖 ∈ {1,2, . . . , 𝑛}.𝜎 ∈ 𝐴_𝑖

⇔ ∀𝜎 ∈ 𝐸 .∃𝑖 ∈ {1,2, . . . , 𝑛}.U_A(𝜎) =h𝐴_𝑖i ⊆Δ

which holds if and only if𝐸 ∈ E_C𝑟. Also, 𝑀 ∈ M_C ⇔ ∀𝜎 ∈ 𝑀 .𝜎 ∈ ∧^𝑛

𝑖=1(𝐴_𝑖 ⇒ 𝐺_𝑖). Since the 𝐴_𝑖’s are initially disjoint, and therefore disjoint, there are two cases: either𝜎 ∈ ∧^𝑛

𝑖=1¬𝐴_𝑖, in which caseU_A(𝜎) ∉ Δ, or there is an 𝐴_𝑖 such that 𝜎 ∈ 𝐴_𝑖∧𝐺_𝑖, in which case,𝜎 |=^𝜌 h(𝐴_𝑖, 𝐺_𝑖)iandU_A(𝜎) = Π_A(h(𝐴_𝑖, 𝐺_𝑖)i) = h𝐴_𝑖i.

This implies 𝑀 ∈ M_C𝑟. On the other hand, 𝑀 ∈ M_C𝑟 implies ∀𝜎 ∈ 𝑀, either 𝜎 |=^𝜌 h(𝐴_𝑖, 𝐺_𝑖)i for some𝑖 ∈ {1,2, . . . , 𝑛}, which by Definition 5.3.5, shows that 𝜎 ∈ 𝐴_𝑖∧𝐺_𝑖, orU_A(𝜎) ∉ Δ, which implies that𝜎 ∈ ∧^𝑛

𝑖=1¬𝐴_𝑖.

The following example shows the greater flexibility offered by reactive contracts over parametric ones.

Example 5.3.1. Let 𝐴₁, 𝐴₂ be initially disjoint and C = (𝐴₁∨ 𝐴₂,(𝐴₁ ⇒ 𝐺₁) ∧ (𝐴₂ ⇒ 𝐺₂)) and ˜C𝑟 = (A˜,G˜,Δ˜,𝑅˜) where ˜A = {𝐴₁, 𝐴₂}, ˜G = {𝐺₁, 𝐺₂}, ˜Δ = {h𝐴₁i,h𝐴₂i,h𝐴₁, 𝐴₂i}, ˜𝑅 = {h(𝐴₁, 𝐺₁)i,h(𝐴₂, 𝐺₂)i,h(𝐴₁, 𝐺₁),(𝐴₂, 𝐺₂)i}. We can verify that ˜C𝑟 Cusing the fact that by Proposition 13,C=C𝑟 = (A,G,Δ, 𝑅) where 𝐴 =A˜, 𝐺 = G˜, Δ ={h𝐴₁i,h𝐴₂i}, and 𝑅 ={h(𝐴₁, 𝐺₁)i,h(𝐴₂, 𝐺₂)i}. With the inclusion of h(𝐴₁, 𝐺₁),(𝐴₂, 𝐺₂)i in ˜𝑅, ˜C𝑟 is receptive to environments whose behaviors exhibit a change in assumptions from 𝐴₁to𝐴₂and requires implementa- tions to adapt accordingly by changing their guarantee from𝐺₁to𝐺₂. On the other hand, C𝑟 only specifies the set of implementations to be those behaviors in which either neither 𝐴₁or 𝐴₂is satisfied or at least a pair (𝐴_𝑖, 𝐺_𝑖)is always satisfied.

Algebra

Let A be a set of initially disjoint assumptions andG be a set of guarantees. We can construct an algebra on the set ℭ_(A,G) of all reactive contracts obtained from A and G as follows. Let ℜ B (A × G)^∞, the set of all (A × G)-signatures and Δ⇒ 𝑅 B {𝑟 |𝑟 ∈ℜ∧Π_A(𝑟) ∉ Δ} ∪𝑅, the set of all (A × G)-signatures that are either a reaction in 𝑅 or have an assumption change sequence not specified in the contingency Δ. Also, let 𝑅_↓Δ = {𝑟 ∈ 𝑅 | ΠA(𝑟) ∈ Δ} and Δ_\R = {𝛿 ∈ Δ | ∀𝑟 ∈ 𝑅 .ΠA(𝑟) ∉ Δ}. From these definitions, we have:

Proposition 14.IfC= (A,G,Δ, 𝑅)is a reactive contract, thenC^★B (A,G,Δ,Δ⇒ 𝑅) satisfiesC^★=C.

Proof. First, by Definition 5.3.4, it is clear that E_C = E_C^★. Also, 𝑀 ∈ M_C is

equivalent to

∀𝐸 ∈ E_C.∀𝜎 ∈ (𝑀∩𝐸).∃𝑟 ∈ 𝑅 .𝜎 |=^𝜌 𝑟∧Π_A(𝑟)=U_A(𝜎)

⇔ ∀𝐸 ∈ E_C^★.∀𝜎 ∈ (𝑀∩𝐸).∃𝑟 ∈ 𝑅 .𝜎 |=^𝜌 𝑟∧ΠA(𝑟)=U_A(𝜎)

⇔ ∀𝐸 ∈ E_C^★.∀𝜎 ∈ (𝑀 ∩𝐸).∃𝑟 ∈Δ⇒ 𝑅 .𝜎 |=^𝜌 𝑟∧Π_A(𝑟)=U_A(𝜎) which is equivalent to 𝑀 ∈ M_C^★. Note that the forward direction of the last “⇔” follows from the fact that 𝑅 ⊆ Δ⇒ 𝑅. The reverse direction holds because for any 𝜎 ∈ 𝑀∩𝐸 where𝐸 ∈ E_C^★ =E_C, we haveU_A(𝜎) ∈Δ, which implies that for any 𝑟⁰ ∈ {𝑟 | 𝑟 ∈ ℜ∧Π_A(𝑟) ∉ Δ}, we obtain 𝜎 6|=^𝑠 Π_A(𝑟⁰) by the initial disjointness ofA. By the first condition of Definition 5.3.5, we have𝜎 6|=^𝜌 𝑟⁰. Therefore, the𝑟

that satisfiesΔ⇒ 𝑅must satisfy𝑟 ∈ 𝑅.

In light of this, we will say that a reactive contractC= (A,G,Δ, 𝑅)is incanonical form if𝑅 = Δ⇒ 𝑅. We will also denote by𝐸_C,maxthe set{𝑒 ∈ B | ∃𝛿 ∈Δ. 𝑒 |=^𝑠 𝛿}. Observe thatM_C B {𝑚 ∈ B | 𝑚 ∉ 𝐸_C,max∨ (𝑚 ∈ 𝐸_C,max∧ ∃𝑟 ∈ 𝑅 .𝑚 |=^𝜌 𝑟}) = B − {𝑚 ∈ B | 𝑚 ∈ 𝐸_C,max∧ ¬(∃𝑟 ∈ 𝑅 .𝑚 |=^𝜌 𝑟)} = B − {𝑚 ∈ 𝐸_C,max | ¬(∃𝑟 ∈ 𝑅 .𝑚 |=^𝜌 𝑟)}. In the following, for𝑖 ∈ {1,2}, let C𝑖 = (A,G,Δ𝑖, 𝑅_𝑖) be canonical reactive contracts. The next lemma follows from the fact thatAis initially disjoint:

Lemma 1. Δ₂ ⊆Δ₁⇔𝐸_C

2,max ⊆ 𝐸_C

1,max. Proof. Assume that𝐸_C

2,max ⊆ 𝐸_C

1,max. For any 𝛿 ∈ Δ₂, choose a𝜎 ∈ B such that 𝜎 |=^𝑠 𝛿. By Definition 5.3.4, 𝜎 ∈ 𝐸_C

2,max and therefore 𝜎 ∈ 𝐸_C

1,max. Since A is initially disjoint, by Proposition 5.8, any 𝛿⁰ ∈ Δ₁ such that 𝜎 |=^𝑠 𝛿⁰ must satisfy 𝛿 =𝛿⁰. Thus,𝛿 ∈Δ₁. The other direction follows directly from the definition of the 𝐸_C

𝑖,max’s.

Proposition 15. (Δ₂ ⊆ Δ₁∧𝑅₁ ⊆ 𝑅₂) ⇒ C₁ C₂. Proof. We have𝐸 ∈ E_C2 ⇔𝐸 ⊆ 𝐸_C

2,max

𝐿 𝑒𝑚 𝑚 𝑎1

⇒ 𝐸 ⊆ 𝐸_C

1,max ⇔𝐸 ∈ E_C1. On the other hand, 𝑀 ∈ M_C1 ⇔ 𝑀 ∈ B − {𝑚 ∈ 𝐸_C

1,max | ¬(∃𝑟 ∈ 𝑅₁.𝑚 |=^𝜌 𝑟)} ^{𝐿 𝑒𝑚 𝑚 𝑎}⇒ ¹ 𝑀 ∈ B − {𝑚 ∈ 𝐸_C

2,max | ¬(∃𝑟 ∈ 𝑅₁.𝑚 |=^𝜌 𝑟)} ^𝑅1⇒^⊆𝑅2 𝑀 ∈ B − {𝑚 ∈ 𝐸_C

2,max |

¬(∃𝑟 ∈ 𝑅₂.𝑚 |=^𝜌 𝑟)} ⇔𝑀 ∈ M_C2.

Lemma 2. C₁ C₂⇒ ∃C⁰

2 ∈ℭ_(𝐴,𝐺).E_C⁰

2 =E_C2∧M_C⁰

2 =M_C2∧Δ⁰

2 ⊆ Δ₁∧𝑅₁ ⊆ 𝑅⁰

2. Proof. We claim that C⁰

2 can be obtained by lettingΔ⁰₂ B Δ₂ and 𝑅⁰

2 B 𝑅₁∪𝑅₂. Then, clearly, E_C⁰

2 = E_C2, 𝑅₁ ⊆ 𝑅⁰

2. Since C₁ C₂, we have E_C2 ⊆ E_C1, and in

particular, 𝐸_C

2,max ∈ E_C1. This implies that 𝐸_C

2,max ⊆ 𝐸_C

1,max as∀𝐸 ∈ E_C1. 𝐸 ⊆ 𝐸_C

1,max. HenceΔ⁰₂ = Δ₂ ⊆ Δ₁. Now since M_C1 ⊆ M_C2, we have {𝑚 ∈ 𝐸_C

2,max |

¬(∃𝑟 ∈ 𝑅₂.𝑚 |=^𝜌 𝑟)} ⊆ {𝑚 ∈ 𝐸_C

1,max | ¬(∃𝑟 ∈ 𝑅₁.𝑚 |=^𝜌 𝑟)}. In particular, because𝐸_C

2,max ⊆ 𝐸_C

1,max,∀𝑚 ∈𝐸_C

2,max.¬(∃𝑟 ∈ 𝑅₂.𝑚 |=^𝜌𝑟) ⇒ ¬(∃𝑟 ∈ 𝑅₁.𝑚 |=^𝜌 𝑟). Therefore∀𝑚 ∈ 𝐸_C

2,max.¬(∃𝑟 ∈ 𝑅₂.𝑚 |=^𝜌 𝑟) ⇔ ¬(∃𝑟 ∈ 𝑅₁∪𝑅₂.𝑚 |=^𝜌 𝑟).

Therefore,M_C⁰

2 =M_C2.

A reaction setR is said to beunambiguousfor a contingency setΔif for each𝛿 ∈Δ, there is at most one𝑟 ∈ 𝑅withΠ_A(𝑟) =𝛿.

Proposition 16. If 𝑅_1↓Δ

1 ∪𝑅_2↓Δ

2is unambiguous forΔ₁∪Δ₂, thenC =C₁∧ C₂ B (A,G,Δ₁∪Δ₂, 𝑅₁∩𝑅₂)is the infimum for C₁andC₂inℭ_(A,G).

Proof. It is not hard to see that C is a canonical reactive contract in ℭ_(𝐴,𝐺). The main thing to check here is that if𝑟 ∈ℜandΠ_A(𝑟) ∉ Δ₁∪Δ₂, then𝑟 ∈ 𝑅₁∩𝑅₂. Indeed, sinceΠ_A(𝑟)∉ Δ₁∧Π_A(𝑟) ∉ Δ₂, we have𝑟 ∈ 𝑅₁∧𝑟 ∈ 𝑅₂sinceC₁andC₂ are canonical. By Proposition 15, we haveC C₁andC C₂. Next, we will show that, if 𝜎 is a behavior such that {𝜎} ∈ M_C1 ∩ M_C2, then {𝜎} ∈ M_C. Because any subset of an implementation is also an implementation, this will imply that M_C1∩ M_C2 ⊆ M_Cand henceM_C1∩ M_C2 =M_C. If𝜎 ∉B_A orU_A(𝜎) ∉ Δ₁∪Δ₂, then this is obvious. Suppose therefore that U_A(𝜎) ∈ Δ₁ ∪Δ₂. Consider the following cases:

1. Without loss of generality, suppose that 𝜎 ∈ Δ₁ and 𝜎 ∉ Δ₂. Then since {𝜎} ∈ M_C1, there is an𝑟 ∈ 𝑅₁ such that𝜎 |=^𝜌 𝑟. SinceΠA(𝑟) ∉ Δ₂ by the initial disjointness of A and 𝑅₂ is in canonical form, we have 𝑟 ∈ 𝑅₂ and therefore𝑟 ∈𝑅₁∩𝑅₂.

2. 𝜎 ∈Δ₁∩Δ₂, then there are𝑟₁ ∈𝑅₁and𝑟₂∈ 𝑅₂such that𝜎 |=^𝜌𝑟₁∧𝜎 |=^𝜌 𝑟₂. By the unambiguity assumption, we have𝑟₁=𝑟₂. Therefore,{𝜎} ∈ M_C. Let C⁰ = (A,G,Δ⁰, 𝑅⁰) be such that C⁰ C₁ and C⁰ C₂. This implies that M_C⁰ ⊆ M_C1∩ M_C2. By the initial disjointness ofA, we haveΔ₁∩Δ₂ ⊆ Δ⁰. Since CsatisfiesM_C =M_C1∩ M_C2andΔ₁∩Δ₂= ΔandE_C⁰ is monotone inΔ⁰, we have

C⁰ C.

Proposition 17. C =C₁∨ C₂ B (A,G,Δ₁∩Δ₂, 𝑅₁∪𝑅₂) is the supremum forC₁ andC₂inℭ_(A,G).

Proof. LetC⁰ = (A,G,Δ⁰, 𝑅⁰) be such that C₁ C⁰and C₂ C⁰. Applying (the proof of) Lemma 2 twice, we obtain the contract (A,G,Δ⁰, 𝑅⁰∪𝑅₁∪𝑅₁) that is equal to C. In addition, since E_C⁰ ⊆ E_C1 and E_C⁰ ⊆ E_C2, Δ⁰ ⊆ Δ₁ ∩Δ₂. By Proposition 15, we have C₁ C, C₂ C, and C C⁰. Since C⁰ is an arbitrary

upper bound, we are done.

Finally, for composing reactive contracts, we have the following proposition.

Proposition 18. If𝑅_1↓Δ

1∪𝑅_2↓Δ

2 is unambiguous forΔ₁∪Δ₂, thenC=C₁⊗ C₂ B (A,G,(Δ₁ ∩Δ₂) ∪ Δ_1\𝑅₁ ∪ Δ_2\𝑅₂), 𝑅₁ ∩ 𝑅₂) is the least contract that has the composition property, namely, for any 𝑀₁ ∈ M_C1, 𝑀₂ ∈ M_C2, and 𝐸 ∈ E_C, we have 𝑀₁⊕ 𝑀₂ ∈ M_C, 𝑀₁⊕ 𝐸 ∈ E_C2, and𝑀₂⊕𝐸 ∈ E_C1.

Proof. Let𝜎 ∈ 𝑀₁⊕𝑀₂and𝛿 ∈ (Δ₁∩Δ₂) ∪Δ_1\𝑅₁∪Δ_2\𝑅₂such that𝜎 |=^𝑠 𝛿. Then as𝜎 ∈ 𝑀₁and𝜎 ∈ 𝑀₂,𝛿 ∈Δ₁∩Δ₂, and there exist𝑟₁ ∈𝑅₁and𝑟₂ ∈ 𝑅₂such that 𝜎 |=^𝜌𝑟₁withΠ_A(𝑟₁)=𝛿and𝜎 |=^𝜌𝑟₂withΠ_A(𝑟₂)=𝛿. By the initial disjointness of A and the unambiguity assumption onC₁and C₂, we have𝑟₁ =𝑟₂ ∈ 𝑅₁∩𝑅₂. Therefore{𝜎} ∈ M_C. This implies 𝑀₁⊕ 𝑀₂ ∈ M_C. Now, let𝜎 ∈ 𝑀₁⊕𝐸. Then there exists𝛿 ∈ (Δ₁∩Δ₂) ∪Δ_2\𝑅2 such that 𝜎 |=^𝑠 𝛿. As (Δ₁∩Δ₂) ∪Δ_2\𝑅2 ⊆ Δ₂, clearly {𝜎} ∈ E_C2, which implies 𝑀₁⊕ 𝐸 ∈ E_C2. Arguing similarly, we also have 𝑀₂⊕ 𝐸 ∈ E_C1. This shows that Chas the composition property. Suppose that C⁰ also has the composition property, then Δ⁰ ⊆ Δ. Indeed, suppose that there is a 𝛿 ∈ Δ⁰ such that 𝛿 ∉ (Δ₁ ∩Δ₂) ∪Δ_1\𝑅₁ ∪Δ_2\𝑅₂. Let 𝜎 |=^𝑠 𝛿. If 𝛿 ∉ Δ₁∪Δ₂. Then clearly, {𝜎} ∈ M_C1 ∩ E_C⁰. However, 𝜎 ∉ E_C2. Suppose on the other hand that𝛿 ∈Δ₁∪Δ₂. Without loss of generality, assume that𝛿 ∈Δ₁. Then the fact that 𝛿 ∉ Δ₁∩Δ₂ implies𝛿 ∉ Δ₂ and {𝜎} ∉ E_C2. Furthermore, 𝜎 ∉ Δ_1\𝑅1 means that {𝜎} ∈ M_C1 ∩ E_C⁰, a contradiction. Next, we will show thatM_C ⊆ M_C⁰. Indeed, the requirement that for any 𝑀₁ ∈ M_C1and𝑀₂ ∈ M_C2, 𝑀₁⊕𝑀₂∈ M_C⁰ (implying M_C1∩ M_C2 ⊆ M_C⁰) will enforce this. It suffices to show that for any𝜎 ∈ Bsuch that{𝜎} ∈ M_C, we have{𝜎} ∈ M_C1∩ M_C2. We will prove the contrapositive. Let 𝜎 ∈ B be such that {𝜎} ∉M_C1 ∩ M_C2. Let us show{𝜎} ∉M_C. Without loss of generality, assume that {𝜎} ∉ M_C1. Then there is a 𝛿 ∈ Δ_1\𝑅₁ such that 𝜎 |=^𝑠 𝛿. But this implies that there exists no 𝑟 ∈ 𝑅₁∩ 𝑅₂ such that 𝜎 |=^𝜌 𝑟. Therefore, {𝜎} ∉ M_C. Thus,C⁰satisfiesM_C ⊆ M_C⁰ andΔ⁰ ⊆ Δ. SinceE_C⁰ is monotone in Δ⁰, Cis indeed the least contract with the composition property.

In the next section, we will show how this formalism can be applied to reactive synthesis.