Systems and Contracts

Chapter V: Reactive Contracts

5.2 Systems and Contracts

To keep things concise without losing generality, we will only cover assume- guarantee contracts defined over a common set of Boolean variables V called thealphabet. For any set 𝑋, let 𝑋^𝜔 be the set of infinite sequences generated from 𝑋, namely {h𝑥_𝑖i^∞

𝑖=0 = h𝑥₀, 𝑥₁, . . .i | 𝑥_𝑖 ∈ 𝑋}, 𝑋^∗ be the set of finite sequences, and

2^𝑋 be the powerset of 𝑋. Define 𝑋^∞ as 𝑋^∗∪ 𝑋^𝜔. Inimplementationsa contract.

accordance with the metatheory, we term any pair of collections of environments and implementations a contract. The theory of assume-guarantee contracts is a model of the metatheory and can be described as follows.

Definition 5.2.1(Behaviors and Assertions). A behavior 𝜎 is an element ofB B (2^V)^𝜔. An assertion𝐴is a subset ofB, namely,𝐴 ∈2^B.

We lift the set of all assertions 2^B to a Boolean algebra by defining a unary operator

¬and two binary operators∧,∨on it in the standard way: if𝐴, 𝐴₁, 𝐴₂are assertions, then¬𝐴 B B \ 𝐴, 𝐴₁∨ 𝐴₂ B 𝐴₁∪𝐴₂, 𝐴₁∧𝐴₂ B 𝐴₁∩𝐴₂. The induced partial ordering relation≤ on 2^B is simply the subset relation ⊆. Additionally, we define a secondary binary operator⇒in 𝐴₁⇒ 𝐴₂as a shorthand for¬𝐴₁∨𝐴₂.

Acomponent 𝑀 is an assertion designated as such. Via locality assumptions, the assertion characterizing a component is often restricted to a subset ofV (with no constraints on variables outside the set). If 𝑀₁ and 𝑀₂are components, theinter- connectionbinary operator⊕ is defined by 𝑀₁⊕ 𝑀₂ B 𝑀₁∧𝑀₂. That is, the set of behaviors of the interconnection consists only of those common to (or witnessed by) both implementations. We note that depending on how the variables and asser- tions making up the components being interconnected are defined, ⊕ can assume the meaning of either a parallel, series, coproduct, or feedback connection (Censi, 2015). In fact, contracts and the corresponding algebra can be used to constrain components satisfying them so that the meaning of their interconnection will be clear.

Definition 5.2.2 (Contracts). An assume-guarantee contract C is a pair of asser- tions (𝐴, 𝐺), called the assumption and the guarantee respectively. The set of environments ofC, denoted byE_C, captures all components𝐸 such that

𝐸 ≤ 𝐴. (5.1)

In other words,E_C =2^𝐴. The set of implementations ofC, denoted byM_C, consists of all components𝑀 such that

∀𝐸 ∈ E_C. 𝑀 ⊕𝐸 ≤ 𝐺 . (5.2)

Example 5.2.1. LetV ={𝑥 , 𝑦},C =(𝐴, 𝐺)where𝐴 B {𝜎 | 𝑥 ∈𝜎_𝑖 ⇔𝑖 mod 2= 0}, 𝐺 B {𝜎 | 𝑦 ∈ 𝜎_𝑖 ⇔ 𝑖 mod 2 ≠ 0}, 𝜎₁ B h{𝑥},{𝑦},{𝑥},∅,{𝑥},∅, . . .i and 𝜎₂ B h{𝑥},{𝑦},{𝑥},{𝑦}, . . .i. If𝐸 B {𝜎₁, 𝜎₂}, then𝐸 ∈ E_C because𝜎₁, 𝜎₂ ∈ 𝐴.

Let 𝑀₁ B {𝜎₁} and 𝑀₂ B {𝜎₂}. Then 𝑀₁ ∉M_C because 𝑀₁⊕ 𝐸 = {𝜎₁} ∉𝐺. However, one can check that 𝑀₂ ∈ M_C. Note that if 𝑀₃ B ∅, then𝑀₃ ∈ M_C as well. The interpretation here is that𝑀₃satisfies the assume-guarantee semantics of Cvacuously.

Since 2^B is a Boolean algebra, we infer from inequality (5.2) and the definition of

⊕ that 𝑀 is an implementation if ∀𝐸 ∈ E_C. 𝑀 ≤ ¬𝐸 ∨𝐺. Choosing 𝐸 = 𝐴 in inequality (5.1) gives 𝑀 ≤ ¬𝐴∨𝐺. Conversely, satisfying 𝑀 ≤ ¬𝐴∨𝐺 implies that 𝑀 is an implementation because¬𝐸 ∨𝐺 is antitone in𝐸. Thus, we have the following proposition.

Proposition 8. GivenC= (𝐴, 𝐺), a component𝑀 satisfies𝑀 ∈ M_Cif and only if

𝑀 ≤ 𝐴⇒ 𝐺 . (5.3)

Proposition 8 characterizes implementations 𝑀 of C as those components whose behaviors either do not conform to the behaviors specified in 𝐴 or are compatible with𝐺. Specifically, it says thatM_C =2^𝐴⇒𝐺. Furthermore, since

𝐴⇒ (𝐴⇒ 𝐺) =¬𝐴∨ (¬𝐴∨𝐺) =¬𝐴∨𝐺 = 𝐴 ⇒𝐺 , (5.4) inequalities (5.1) and (5.3) yield the following proposition.

Proposition 9. If C = (𝐴, 𝐺) and C^∗ = (𝐴, 𝐴 ⇒ 𝐺), then M_C = M_C^∗ and E_C =E_C^∗.

It may be seen from equation (5.4) why any assume-guarantee contract of the form C = (𝐴, 𝐴 ⇒ 𝐺) is called saturated. By the metatheory, we will consider contracts that have the same sets of environments and implementations to be equal, and so by Proposition 9, every contract C has a unique saturated canonicalform C^∗. This saturated form makes contract algebra more convenient and sheds light on the meaning of the conjunction operation, which motivates our development of

“reactive contracts.” To describe the conjunction, we will need the idea of contract refinement whose definition is repeated here for ease of reference.

Definition 5.2.3. We say contract C₁ = (𝐴₁, 𝐺₁) refines a contract C₂ = (𝐴₂, 𝐺₂) and writeC₁ C₂ifM_C1 ⊆ M𝐶₂ andE𝐶₂ ⊆ E𝐶₁.

Theconjunctionof two contractsC₁andC₂, denoted byC₁∧ C₂, is a contract that is their largest lower bound (or meet) with respect to . For any contract C, we

haveE_C =2^𝐴andM_C =2^𝐴⇒𝐺. Therefore, ifC ≤ C₁,C₂, then by Definition 5.2.3, M_C ⊆ M_C1∩ M_C2 = 2^{𝐴1⇒𝐺1} ∩2^{𝐴2⇒𝐺2} = 2^{(𝐴1⇒𝐺1)∧(𝐴2⇒𝐺2)} and 2^{𝐴1∨𝐴2} =2^𝐴1 ∪ 2^𝐴2 =E_C1∪ E_C2 ⊆ E_C (since the intersection/union of powersets of two sets is the powerset of their intersection/union). By the fact that (𝐴₁ ⇒𝐺₁) ∧ (𝐴₂⇒ 𝐺₂) is saturated, we haveC₁∧ C₂= (𝐴₁∨ 𝐴₂,(𝐴₁⇒ 𝐺₁) ∧ (𝐴₂ ⇒𝐺₂)). By induction, we can conclude the following:

Proposition 10. If for𝑖=1,2, . . . , 𝑛,𝐶_𝑖are assume-guarantee contracts, then

∧^𝑛_𝑖=1C𝑖 =(∨^𝑛_𝑖=1𝐴_𝑖,∧^𝑛_𝑖=1𝐴_𝑖 ⇒ 𝐺_𝑖). (5.5) Note that we can apply an analogous argument to the disjunction of contracts (defined as their join) to conclude that the set of all saturated contracts forms a complete lattice. Equation (5.5) shows that the “parametric contract” formalism given in (Kim, Arcak, and Seshia, 2017) is exactly the result of applying the conjunction operation to the constituent contracts. That is, if 𝑀 is an implementation of the conjunction∧𝑖C𝑖containing𝜎 such that𝜎 ∈𝐸 where𝐸 is an environment of∧𝑖C𝑖, then there exists at least a 𝑘 ∈ {1,2, . . . , 𝑛} such that 𝜎 ∈ 𝐴_𝑘 and for all such 𝑘, 𝜎 ∈ 𝐺_𝑘. In other words, for any behavior 𝜎 in which the environment satisfies any assumption 𝐴_𝑘 in {𝐴₁, 𝐴₂, . . . , 𝐴_𝑛}, the system must react by providing the corresponding guarantee 𝐺_𝑘. Thus in contract conjunctions, 1) the reactions are defined by pairing each 𝐴_𝑘 with the corresponding𝐺_𝑘, and 2) 𝐴_𝑘 ⇒𝐺_𝑘 must hold over the sequence𝜎in its entirety. The second restriction is partially relaxed in the

“dynamic contract” formalism, used for instance in (Kim, Sadraddini, et al., 2017), where assumptions are allowed to change over fixed time intervals. Our reactive contract framework will 1) remove the one-to-one restriction to allow for a more flexible assumption-guarantee pairing process, 2) enforces immediate guarantee reactions to assumption changes directly on each element 𝜎 ∈ B, and 3) enables automated synthesis.

5.3 Reactive Contracts