The interaction of contracts and laziness

Abstract

Contract monitoring for strict higher-order functional languages has an intuitive meaning, an established theoretical basis, and a standard implementation. For lazy functional languages, the situation is less clear-cut. There is no agreed-upon intended meaning or theory, and there are competing implementations with subtle semantic differences.

This paper proposes meaning preservation and completeness as formally defined properties for evaluating implementations of contract monitoring. Both properties have definitions that can be checked by straightforward inductive proof. A survey of existing suggestions for lazy contract systems reveals that some are meaning preserving, some are complete, and some have neither property. The main result is that contract monitoring for lazy functional languages cannot be complete and meaning preserving at the same time, although each property can be achieved in isolation.

Appendices

Appendix A: Pair-completeness of strict contract monitoring

Throughout the proofs we let === denote definitional equality and contextual equivalence. Recall that this Appendix A and the following Appendix B perform reasoning in a call-by-value calculus. We sometimes misuse notation by writing for a term e such that . Analogous misuse happens for ⇑ and .

Proof

To establish pair-completeness of strict contract monitoring, we have to show that

Thus, we have to check that, for all a, it holds that

If f⇓True then we obtain

If f⇓False then we obtain

Analogously for f⇑ and . □

Appendix B: Uniform monitoring of strict contract monitoring

The proof requires a lemma which states that c _t is the identity contract that does not affect its argument.

Lemma 18

For all t and e::t, assert c _t  e === e.

Proof

The result is trivial if e does not terminate or if e crashes. Hence, assume that e⇓v.

Induction on t.

Case t=().

assert c ₍₎  e⟶^∗

assert c ₍₎  ()===

assert pok ()===

if True then () else error===

() ok because e⇓()

Case t=( t ₁ , t ₂ ).

( v ₁ , v ₂ ) ok because e⇓( v ₁ , v ₂ )

Case t=t ₁→t ₂.

(induction applicable because we only pass values to this function)

(induction)

ok □

2.1 B.1 Uniform monitoring

Proof

To establish uniform monitoring for strict contract monitoring, we have to show that for each type t and for each j∈Addr _t :

• 1. G _t [assert c _t  F _t ]⇓()

• 2. ;

• 3. G _t [assert c _t [j↦pdiverge] F _t ]⇑; and

• 4. .

The first item follows by Lemma 18 and unwinding (Lemma 8).

The proof is by induction on t.

Case t=().

G ₍₎ [assert c ₍₎ [j↦pdiverge] F ₍₎ ]=assert pdiverge ()⇑

Case t=( t ₁ , t ₂ ).

===

{ two cases, depending on whether $j \in c_{t_{1}}$ or $j \in c_{t_{2}}$; suppose $j\in c_{t_{1}}$ }

by induction:

===

The case $j\in c_{t_{2}}$ is analogous.

G _t [assert c _t [j↦pdiverge] F _t ]⇑

Similar.

Similar.

Case t=t ₁→t ₂.

===

===

===

===

===

{assume $j\in c_{t_{2}}$}

===

{Lemma 18}

===

===

===

(by induction and because $G_{t_{2}}$ is an evaluation context)

(if $j\in c_{t_{1}}$ then by induction)

The cases for divergence and crashes are similar. □

Appendix C: Uniform monitoring of eager contract monitoring

First, a few lemmas are required. The first says that asserting the identity contract c _t to F _t is not observable for context G _t .

Lemma 19

For all t, it holds that G _t [assert c _t  F _t ] === ()

Proof

Additional induction hypothesis: For all t, it holds that such that .

Induction on t.

*** Case t=().

This outcome fulfills the claim.

*** Case t=( t ₁ , t ₂ ).

Fulfills the claim because if $G_{t_{1}}[F_{t_{1}}']$ and $G_{t_{2}}[F_{t_{2}}']$ both do, which can be assumed by induction.

*** Case t=t ₁→t ₂.

It remains to show that $G_{t_{1} \to t_{2}}$ of the second component reduces to ().

 □

Lemma 20

For all t, if asrt c _t [j↦pblame] F ₁⇓(False, F′), then .

Proof

Induction on t.

*** Case t=()

Clearly, .

*** Case t=( t ₁ , t ₂ ).

By assumption, b1 && True is False, hence b1 must be False and force x’ .

Clearly, force r === force (force F ′) .

The case where j=1.j′ is proved analogously.

Case t=t ₁→t ₂.

This case violates the assumption that the first component is False and thus fulfills the claim vacuously. □

3.1 C.2 Main theorem

Proof

To establish uniform monitoring for eager contract monitoring, we have to show that for each type t and for each j∈Addr _t :

• 1. G _t [assert c _t  F _t ]⇓();

• 2. ;

• 3. G _t [assert c _t [j↦pdiverge] F _t ]⇑; and

• 4. .

The first item is Lemma 19.

The proof is by induction on t. We only elaborate the case for pblame, the other cases are analogous.

We need to rephrase the statement to get a viable inductive hypothesis: For all t, it holds that . The original statement is immediate from this hypothesis.

Case t=().

Case t=( t ₁ , t ₂ ).

Applying G _t [snd[…]] yields

ALTERNATIVES: b1 could be False; in this case force x’ yields by Lemma 20. Also, b1 implies that the case expression . The reasoning for the remaining case b1⇓True is as follows.

The case j=1.j′ is established analogously.

Case t=t ₁→t ₂.

Applying G _t [snd[…]] yields

As $G_{t_{2}}$ is an evaluation context, there are the following cases for evaluation in the hole.

• 1. b is False. In this case, if not b then force x’ else ... === force x’ and Lemma 20 yields that force x’ .

• 2. b is . In this case, the conditional .

• 3. b is True. In this case, the reasoning continues as follows.

By induction so that the whole expression .

Assuming that j=1.j′ leads to a similar development, except that the last step reads

By Lemma 19:

which by induction. □

Appendix D: Pair-completeness of eager contract monitoring

Proof

(Pair-completeness of eager contract monitoring)

To establish pair-completeness of eager contract monitoring, we have to show that

Thus, we have to check that, for all a, it holds that

Suppose that f,g⇓True.

Suppose that f⇓True, g⇓False.

Suppose that f⇓False, g⇓True.

Alternatively:

Suppose that f,g⇓False.

 □