Table Of ContentLazy Functional State Threads
John Launchbury and Simon L Peyton Jones
University of Glasgow
Email: {simonpj,jl}@dcs.glasgow.ac.uk. Phone: +44-41-330-4500
March 10, 1994
Abstract the world state.
We use the term \stateful" to describe computations or
Some algorithms make critical internal use of updatable
algorithmsin which the programmerreally does want to
state, even though their external speci(cid:12)cation is purely
manipulate (updatable) state. What has been lacking
functional. Based on earlier work on monads,we present
until now is a clean way of describing such algorithms
a way of securely encapsulating stateful computations
in a functionallanguage| especially a non-strict one |
thatmanipulatemultiple,named,mutableobjects, inthe
withoutthrowingawaythemainvirtuesoffunctionallan-
context of a non-strict, purely-functional language.
guages: independence oforder ofevaluation(the Church-
The security of the encapsulation is assured by the type Rosser property), referential transparency, non-strict se-
system, using parametricity. Intriguingly, this para- mantics,and so on.
metricityrequirestheprovisionofa(single)constantwith
In this paper we describe a way to express stateful al-
a rank-2 polymorphictype.
gorithms in non-strict, purely-functional languages. The
A shorterversion ofthis paper appears inthe Proceedings approachisadevelopmentofourearlierworkonmonadic
of the ACM Conference on Programming Languages De- I/O and state encapsulation (Launchbury [1993]; Pey-
sign and Implementation (PLDI), Orlando, June 1994. ton Jones & Wadler[1993]),but withan importanttech-
nical innovation: we use parametric polymorphism to
achieve safe encapsulation ofstate. It turns out that this
1 Introduction allowsmutableobjectstobenamedwithoutlosingsafety,
anditalsoallowsinput/outputtobesmoothlyintegrated
Purelyfunctionalprogramminglanguagesallowmanyal- with other state mainpulation.
gorithms to be expressed very concisely, but there are a
The other important feature of this paper is that it de-
few algorithms in which in-place updatable state seems
scribes a complete system, and one that is implemented
to play a crucial role. For these algorithms, purely-
intheGlasgowHaskellcompilerandfreelyavailable. The
functionallanguages, which lack updatable state, appear
system has the followingproperties:
tobeinherentlyine(cid:14)cient(Ponder,McGeer&Ng[1988]).
Take, for example, algorithms based on the use of
(cid:15) Completereferential transparency ismaintained. At
incrementally-modi(cid:12)edhashtables,wherelookupsarein-
(cid:12)rst it is not clear what this statement means: how
terleaved with the insertion of new items. Similarly,the
canastatefulcomputationbesaidtobereferentially
union/(cid:12)nd algorithm relies for its e(cid:14)ciency on the set
transparent? To be more precise, a stateful compu-
representations being simpli(cid:12)ed each time the structure
tationisastate transformer,thatis,afunctionfrom
is examined. Likewise, many graph algorithms require a
an initial state to a (cid:12)nal state. It is like a \script",
dynamically changing structure in which sharing is ex-
detailing the actions to be performed on its input
plicit, so that changes are visible non-locally.
state. Like any other function, it is quite possible to
applyasinglestatefulcomputationtomorethanone
There is, furthermore, one absolutely unavoidable use of
input state.
state in every functional program: input/output. The
plainfact ofthe matteris that the whole purpose ofrun- So, a state transformer is a pure function. But, be-
ninga program,functionalor otherwise, is to makesome cause we guarantee thatthe state isused inasingle-
side e(cid:11)ect on the world | an update-in-place, if you threaded way, the (cid:12)nal state can be constructed by
please. In many programs these I/O e(cid:11)ects are rather modifyingthe inputstate in-place. Thise(cid:14)cient im-
complex, involving interleaved reads from and writes to plementation respects the purely-functional seman-
1
ticsofthestate-transformerfunction,soalltheusual 2.1 State transformers
techniques for reasoning about functional programs
A value of type (ST s a) is a computationwhich trans-
continue to work. Similarly, stateful programs can
forms a state indexed by type s, and delivers a value of
be exposed to the fullrange of programtransforma-
type a. You can think of it as a box, like this:
tions applied by a compiler,with no special cases or
side conditions. Result
(cid:15) Theprogrammerhascompletecontroloverwherein-
place updates are used and where they are not. For
example, there is no complex analysis to determine
State in State out
whenanarrayisusedinasingle-threadedway. Since
theviabilityoftheentireprogrammaybepredicated
Notice that this is a purely-functional account of state.
ontheuseofin-placeupdates,theprogrammermust
The\ST"standsfor\astatetransformer",whichwetake
be con(cid:12)dent in, and be able to reason about, the
to be synonymous with \a stateful computation": the
outcome.
computation is seen as transforming one state into an-
(cid:15) Mutable objects can be named. This ability sounds other. (Of course, it is our intention that the new state
innocuous enough,but once an object can be named will actually be constructed by modifyingthe old one in
its use cannot be controlled as readily. Yet naming place, amatterto which we return inSection 6.) A state
is important. For example, it gives us the ability to transformer is a (cid:12)rst-class value: it can be passed to a
manipulatemultiplemutableobjectssimultaneously. function,returned as a result, stored in a data structure,
duplicated freely, and so on.
(cid:15) Input/output takes its place as a specialised form
A state transformer can have other inputs besides the
of stateful computation. Indeed, the type of I/O-
state;ifso,itwillhaveafunctionaltype. Itcanalsohave
performingcomputationsisaninstance ofthe (more
manyresults, byreturning theminatuple. Forexample,
polymorphic) type of stateful computations. Along
astate transformer withtwo inputs oftype Int, andtwo
with I/O comes the abilityto call imperativeproce- results of type Int and Bool, would have the type:
dures written in other languages.
Int -> Int -> ST s (Int,Bool)
(cid:15) Itispossible toencapsulate statefulcomputationsso
Its picture mightlook like this:
that they appear to the rest of the program as pure
(stateless)functionswhichareguaranteedbythetype Inputs Results
system to have no interactions whatever with other
computations,whether stateful or otherwise (except
via the values of arguments and results, of course).
Complete safety is maintained by this encapsula- State in State out
tion. Aprogrammaycontainanarbitrarynumberof
stateful sub-computations, each simultaneously ac- Thesimpleststatetransformer,returnST,simplydelivers
tive,withoutconcern thatamutableobjectfromone a value without a(cid:11)ecting the state at all:
mightbe mutated by another.
returnST :: a -> ST s a
(cid:15) Stateful computations can even be performed lazily
The picture for returnST is like this:
without losing safety. For example, suppose that
stateful depth-(cid:12)rst search of a graph returns a list
of vertices in depth-(cid:12)rst order. If the consumer of
this list only evaluates the (cid:12)rst few elements of the
State in State out
list, then only enough of the stateful computationis
executed to produce those elements.
2.2 References
2 Overview
What, then, is a \state"? Part of every state is a (cid:12)nite
This section introduces the key ideas of our approach to mapping from references to values. (A state may also
stateful computation. We begin with the programmer's- have other components, as we will see in Section 4.) A
eye-view. reference canbethoughtofasthenameof(oraddressof)
2
a variable, an updatable location in the state capable of \threaded together" by a state passed from one to the
holding a value. The following primitive operations are next.
provided:
Putting together what we have so far, here is a \proce-
newVar :: a -> ST s (MutVar s a) dure" which swaps the contents of two variables:
readVar :: MutVar s a -> ST s a
writeVar :: MutVar s a -> a -> ST s () swap :: MutVar s a -> MutVar s a -> ST s ()
swap v w = readVar v `thenST` (\a ->
The function newVar takes an initial value, of type readVar w `thenST` (\b ->
a, say, and delivers a state transformer of type writeVar v b `thenST` (\_ ->
ST s (MutVar s a). When this is applied to a state, writeVar w a)))
it allocates a fresh reference | that is, one currently not
The syntaxneeds alittleexplanation. The form\\a->e"
used in the state. It augments the state with a mapping
is Haskell's syntax for a lambda abstraction. The body
fromthis reference tothe supplied value,andreturns the
of the lambda abstraction, e, extends as far to the right
reference along with the modi(cid:12)ed state.
aspossible. Sointhecodeforswap,thesecond argument
The type MutVar s a is the type of references allocated ofthe (cid:12)rst thenSTextends allthe wayfromthe\atothe
fromastoreoftypes,containingavalueoftypea. Notice endofthefunction. That'sjust asyouwouldexpect: the
that, unlike SML's Ref types, for example, MutVars are second argument of a thenST is meant to be a function.
parameterised over the type of the state as well as over The \_" in the second-last line is a wild-card pattern,
the type of the value to which the reference is mapped which matches any value. We use it here because the
by the state. (We use the name MutVar for the type of writeVardoes not return a value of interest.
references, ratherthanRef,speci(cid:12)callytoavoidconfusion
The parentheses can be omitted, since in(cid:12)x operations
with SML.)
bind less tightly than the lambda abstraction operator.
Furthermore,we providea special formof thenST,called
Given a reference v, readVar v is a state transformer
thenST_, with the followingtype signature:
which leaves the state unchanged, but uses the state to
mapthe reference to its value. thenST_ :: ST s () -> ST s b -> ST s b
The function writeVar transforms the state so that it Unlike thenST its second argument is not a function, so
mapsthe given reference to a new value. Notice that the the lambdaisn't required. So we can rewite swap as fol-
reference itself does not change; it is the state which is lows:
modi(cid:12)ed. writeVardelivers a result of the unit type (),
swap :: MutVar s a -> MutVar s a -> ST s ()
atypewhichonlyhasonevalue(apartfrombottom),also swap v w = readVar v `thenST` \a ->
written (). A statetransformeroftype ST s ()isuseful readVar w `thenST` \b ->
only for its e(cid:11)ect on the state. writeVar v b `thenST_`
writeVar w a
2.3 Composing state transformers When swap v w is executed in a state thread (that is,
when given a state), v is dereferenced, returning a value
State transformerscan be composedinsequence, toform
which is bound to a. Similarly the value of w is bound
a larger state transformer, using thenST, which has type
to b. New values are then written into the state at these
thenST :: ST s a -> (a -> ST s b) -> ST s b locations, these values being b and a respectively.
1
The picture for (s1 `thenST` s2) is like this : In addition to thenST and returnST, we have found it
useful to introduce one other \plumbing" combinator,
fixST. It has the type
s1 s2
State in State out fixST :: (a -> ST s a) -> ST s a
andtheusualknot-tyingsemantics,whichwedepictthus:
Notice that the twocomputationsmustmanipulatestate
indexed by the same type, s. Notice also that thenST is
inherently sequential, because the state consumed by the s
secondcomputationisthatproducedbythe(cid:12)rst. Indeed, State in State out
we often refer to a state transformer as a thread, invok-
ingthe picture ofa series ofprimitivestateful operations
This is the only point that relies on laziness. Everything
1BackquotesareHaskell'snotationforanin(cid:12)xoperator.
3
elseinthepaper isdirectlyapplicabletostrictlanguages. runST should be:
runST :: 8a. (8s. ST s a) -> a
2.4 Encapsulation
ThisisnotaHindley-Milnertype,because thequanti(cid:12)ers
So far we have been able to combine state transformers
to make larger state transformers, but how can we make are not all at the top level; it is an example of rank-2
a state transformer part of a larger program which does polymorphism(McCracken [1984]).
not manipulatestate at all? What we need is a function,
Why does this type prevent the \capture" of references
runST, with a type somethinglike the following:
from one thread into another? Consider our example
runST :: ST s a -> a again
The idea is that runST takes a state transformer as its let v = runST (newVar True)
in
argument,conjures up an initialemptystate, applies the
runST (readVar v)
state transformer to it, and returns the result while dis-
carding the (cid:12)nal state. The initial state is \empty" in In the last line a reference v is used in a stateful thread
the sense that no references have been allocated in it by (readVar v),eventhoughthelatterissupposedlyencap-
newVar; it is the empty mapping. sulated by runST. This is where the type checker comes
intoitsown. Duringtypechecking,thetypeofreadVar v
But there seems to be a terrible (cid:13)aw: what is to prevent
a reference from one thread being used in another? For will depend on the type of v so, for example, the type
example: derivation willcontain a judgement of the form:
let v = runST (newVar True) f:::;v:MutVar s Boolg`readVar v:ST s Bool
in
runST (readVar v) Now in order to apply runST we have to be able to gen-
eralise the type of readVar v with respect to s, but we
Here, thereference allocatedinthe (cid:12)rstrunST'sthreadis
cannot as s is free in the type environment: readVar v
used inside the second runST. Doingso would be a great
simplydoes not have type 8s.ST s Bool.
mistake, because reads in one thread are not sequenced
withrespect towritesintheother,andhencetheresultof What about the other way round? Let's check that the
the program would depend on the evaluation order used type of runST prevents the \escape" of references froma
toexecute it. Itseemsat(cid:12)rst thataruntimecheckmight thread. Consider the de(cid:12)nition of v above:
berequiredtoensurethatreferencesareonlydereferenced
v = runST (newVar True)
in the thread which allocated them. Unfortunately this
wouldbe expensive. Even worse, our experience suggests Here, v is a reference that is allocated within the thread,
thatitissurprisinglytrickytoimplementsuchacheck | but then released to the outside world. Again, con-
the obvious ideas fail as it then becomes possible to test sider what happens during typechecking. The expression
the identity ofa thread so losingreferential transparency (newVar True) has type ST s (MutVar s Bool), which
| and we still do not know a straightforward way to do will generalise nicely to 8s.ST s (MutVar s Bool).
so. However, this still does not match the type of runST. To
see this, consider the instance of runST with a instanti-
Thisproblembringsustothemaintechnicalcontribution
ated to MutVar s Bool:
ofthe paper: the di(cid:14)cultieswith runSTcan allbe solved
by giving it a more speci(cid:12)c type. The type given for runST :: (8s'. ST s' (MutVar s Bool))
runSTaboveisimplicitlyuniversallyquanti(cid:12)edoverboth -> MutVar s Bool
s and a. If we put in the quanti(cid:12)cation explicitly, the
Wehavehadtorenametheboundvariablesinthetypeof
type mightbe written:
runSTtoavoidit erroneously capturing the sin the type
runST :: 8s,a. (ST s a -> a) MutVar s Bool. The argument type now doesn't match
v's type. Indeed there is no instance of runST which can
Now, what we really want to say is that runST should be applied to v.
onlybe appliedto astate transformerwhichuses newVar
Just to demonstrate that the type of runST does allow
to create any references which are used in that thread.
some nice examples here is one that is (cid:12)ne:
To put it another way, the argument of runST should
not make any assumptions about what has already been f :: MutVar s a -> MutVar s a
allocated in the initialstate. That is, runST should work f v = runST (newVar v `thenST` \w->
regardless of what initial state it is given. So the type of readVar w)
4
where v is a reference from some arbitrary state thread. it is sometimespossible to avoidthe overhead of making
Becausevisnotaccessed,itsstatetypedoesnota(cid:11)ectthe the copy (see Section 6.2.3).
localstatetypeoftheshortthread(whichisinfacttotally
We give two examples of mutable arrays in action, but
polymorphic in v). Thus it is (cid:12)ne for an encapsulated
leave the larger one to the Appendix.
state thread to manipulatereferences fromother threads
so long as no attempt is made to dereference them.
3.1 Haskell Arrays
In short, by the expedient ofgivingrunSTarank-2 poly-
morphic type we can enforce the safe encapsulation of Using mutablearrays, we shall de(cid:12)ne the Haskell \prim-
state transformers. More details onthis are giveninSec- itive" accumArray, a high level array operation with the
3
type :
tion 5.2, where we show that runST's type can be ac-
commodatedwithonlya minorenhancement tothe type accumArray :: Ix i => (a->b->a) -> a -> (i,i)
checker. -> [(i,b)] -> Array i a
The result of a call (accumArray f x bnds ivs) is an
3 Array references arraywhosesizeisdeterminedbybnds,andwhosevalues
are de(cid:12)ned by separating all the values in the list ivs
So far we have introduced the idea of references (Sec-
according to their index, and then performing a left-fold
tion 2.2), which can be thought of as a single mutable
operation, using f, on each collection, starting with the
\box". Sometimes, though we want to update an array
value x.
which should be thought of as many \boxes", each in-
dependently mutable. For that we provide primitives to Typical uses of accumArray might be a histogram, for
allocate, read and write elements of arrays. They have example:
2
the followingtypes :
hist :: Ix i => (i,i) -> [i] -> Array i Int
newArr :: Ix i => (i,i) -> elt hist bnds is = accumArray (+) 0 bnds
-> ST s (MutArr s i elt) [(i,1)|i<-is, inRange bnds i]
readArr :: Ix i => MutArr s i elt -> i
-> ST s elt which counts the occurrences of each element of the list
writeArr :: Ix i => MutArr s i elt -> i -> elt is that falls within the range given by the bounds bnds.
-> ST s () Another example is bin sort:
freezeArr :: Ix i => MutArr s i elt
binSort :: Ix i => (i,i) -> (a->i)
-> ST s (Array i elt)
-> [a] -> Array i a
Like references, newArr allocates a new array whose binSort bnds key vs
= accumArray (flip(:)) [] bnds [(key v,v)|v<-vs]
bounds are given by its (cid:12)rst argument. The second ar-
gument is a value to which each location is initialised.
wherethevalueinvsareplacedinbinsaccordingtotheir
The state transformer returns a reference to the array,
key value as de(cid:12)ned by the function key (whose results
which we call an array reference. The functions readArr
are assumed to lie in the range speci(cid:12)ed by the bounds
and writeArr do what their names suggest. The result
bnds). Each bin | that is, each element of the array
is unde(cid:12)ned if the index is out of bounds.
| will contain a list of the values with the same key
value. Thelistsstart empty,andnew elementsare added
The interesting function is freezeArr which turns a
usingaversion ofcons inwhichtheorder ofargumentsis
MutArr into a standard Haskell array. The latter is an
reversed. In both examples,the array is built by a single
immutablevalue,which can certainly be returned froma
pass along the input list.
stateful thread, and hence lacks the parameterisation on
thestates. Operationallyspeaking,freezeArrtakesthe The implementationof accumArrayis as follows.
nameofanarrayasitsargument,looksitupinthestate,
accumArray bnds f z ivs = runST
and returns a copy of what it (cid:12)nds, along with the un-
(newArr bnds z `thenST` \a ->
altered state. The copy is required in case a subsequent
fill a f ivs `thenST_`
writeArrchanges the valueofthe arrayinthe state, but
freezeArr a)
2The\Ix i =>"partofthetypeisjustHaskell'swayofsaying
that the type a must be an index type; that is, there must be a fill a f [] = returnST ()
mappingofavalueoftypeatoano(cid:11)setinalineararray. Integers, fill a f ((i,v):ivs)
charactersand tuplesareautomaticallyin the Ix class, but array = readArr a i `thenST` \x ->
indexingisnotrestrictedtothese. Any typeforwhichamapping
writeArr a i (f x v) `thenST_`
toIntis provided(viaaninstancedeclarationfortheclassIxat
thattype)willdo. 3Technicallythe(i,b)shouldbeAssoc i b
5
fill a f ivs) 4 Input/output
OnevaluatingacalltoaccumArray,anewstatethreadis
generated. Withinthis thread an array isallocated, each Now that we have the state-transformer framework in
element of which is initialised to z. The reference to the place, we can give a new account of input/output. An
array is named a. This is passed to the fill procedure, I/O-performingcomputationisoftype ST RealWorld a;
that is, it is a state transformer transforming a state of
together with the accumulator function f, and the list of
type RealWorld, and delivering a value of type a. The
index/value pairs.
only thing which makesit special is the type of the state
Whenthislistisexhausted, fillsimplyreturns. Ifthere it transforms, an abstract type whose values represent
is at least one element in the list,it willbe a pair (i,v). the real world. It is convenient to use a type synonymto
express this specialisation:
The array a is accessed at location i, the value obtained
being bound to x, and a new value, namely (f x v), is type IO a = ST RealWorld a
written into the array, again at location i. Then fill is
SinceIO aisaninstanceofST s a,itfollowsthatallthe
called recursively on the rest of the list.
state-transformer primitives concerning references and
Once fill has (cid:12)nished, the array is frozen into an im- arrays work equally well when mixed with I/O opera-
mutableHaskellarraywhichisreturned fromthe thread. tions. More than that, the same \plumbing" combina-
tors, thenST, returnST and so on, work for I/O as for
Using mutable-array operations has enabled us to de- other state transformers. In addition, however, we pro-
scribe acomplexarray\primitive"intermsofmuchsim- videavarietyofI/Ooperationsthatworkonlyonthe IO
pler operations. Not only does this make the compiler- instanceofstate (thatis,theyarenotpolymorphicinthe
writer's job easier, but it also allows programmers state), such as:
to de(cid:12)ne their own variants for, say, the cases when
putChar :: Char -> IO ()
accumArraydoes not match their application precisely.
getChar :: IO Char
Theexampleisalsointerestingbecauseofitsuseofencap- It is easy to build more sophisticated I/O operations on
sulatedstate. The implementation(orinternaldetails)of top of these. For example:
accumArray is imperative, but its external behaviour is
putString :: [Char] -> IO ()
purely functional. Even the presence of the state cannot
putString [] = returnST ()
be detected fromoutside the de(cid:12)nition of accumArray.
putString (c:cs) = putChar c `thenST_`
putString cs
or, equivalently,
3.1.1 Combining State Transformers
putString cs = seqST (map putChar cs)
Because state transformers are (cid:12)rst class values, we can There is no way for a caller to tell whether putString
use the power of the functional language to de(cid:12)ne new is \primitive" or \programmed". Indeed, putChar and
combiningforms. One that wouldbe useful in the exam- getChar are not primitiveeither. There is actually only
ple above is for sequencing a list of \procedures": one primitive I/O operation, called ccall, which allows
the Haskell programmer to call any C procedure. For
seqST :: [ST s ()] -> ST s ()
example,putCharis de(cid:12)ned like this:
seqST = foldr thenST_ (returnST ())
putChar :: Char -> IO ()
Using this the example above can be rewritten:
putChar c = ccall putchar c `thenST` \_ ->
accumArray bnds f z ivs = runST returnST ()
(newArr bnds z `thenST` \a ->
That is, the state transformer (putChar c) transforms
seqST (map (update a f) ivs) `thenST_`
the real world by calling the C function putchar, pass-
freezeArr a)
ing it the character c. The value returned by the call
is ignored, as indicated by the \_" wild card. Similarly,
update a f (i,v) = readArr a i `thenST` \x->
getCharis implementedlike this:
writeArr a i (f x v)
getChar :: IO Char
The localfunction updatetakes an index/valuepair and
getChar = ccall getchar
evaluates to a state transformer which updates the array
referenced by a. Mapping this function down the list of ccall is actually implemented as a new language con-
index/value pairs ivs produces a list of state transform- struct, rather than as an ordinary function, because we
ers, and these are sequenced together by seqST. want it to work regardless of the number and type of its
6
arguments. The restrictions placed on its use are: the encapsulation.
Up to now, we have presented state transformers in the
(cid:15) All the arguments, and the result, must be types
context of the full-sized programming language Haskell,
which C understands: Int, Float, Double, Bool, or
since thatiswhere we haveimplementedthe ideas. Here,
Array. There is no automatic conversion of more
however,itisconvenient torestrict ourselves toasmaller
complex structured types, such as lists or trees.
language which includes only the essentials.
(cid:15) The (cid:12)rst \argument"ofccall, whichis the nameof
the C function to be called,must appear literally. It 5.1 A Language
is really part of the construct.
We focus on lambda calculus extended with the state
transformer operations. The syntax of the language is
4.1 Running IO given by:
The IOtype isaparticularinstance ofstate transformers e ::= x j k j e1 e2 j (cid:21)x:e j
so, in particular, I/O operations are not polymorphic in let x=e1 in e2 j runST e j
the state. An immediate consequence of this is that IO ccall x e1(cid:1)(cid:1)(cid:1)en
operationscannotbeencapsulated usingrunST. Whynot?
Again, because of runsST's type. It demands that its k ::= ::: j thenST j returnST j fixST j
statetransformerargumentbeuniversallyquanti(cid:12)edover newVar j readVar j writeVar j
the state, but that is exactly what IO is not! newArr j readArr j writeArr j
freezeArr
Fortunately, this is exactly what we want. If IO oper-
ations could be encapsulated then it would be possible
to write apparently pure functions, but whose behaviour 5.2 Types
depended on external factors, the contents of a (cid:12)le, user
Mostofthe typerulesaretheusualHindley-Milnerrules.
input, a shared C variable etc. The language would no
Themostinterestingadditionisthetypingjudgementfor
longer exhibit referential transparency.
runST. Treating it as a language construct avoids the
However, this does leave us with a problem: how are IO need to go beyond Hindley-Milner types. So rather than
operationsexecuted? Theansweristoprovideatoplevel actually give runST the type
identi(cid:12)er,
runST :: 8a.(8s.ST s a) -> a
mainIO :: IO ()
assuggestedintheintroduction,weensurethatitstyping
and to de(cid:12)ne the meaning of a program in terms of it. judgmenthas the same e(cid:11)ect. So because it is consistent
When a program is executed, mainIO is applied to the with the rank-2 type, our previous intuition still applies.
true external world state, and the meaning of the pro-
gram is given by the (cid:12)nal world state returned by the Asusual,wetalkbothoftypes andtype schemes(that is,
program(including,ofcourse,alltheincrementalchanges types possibly with universal quanti(cid:12)ers on the outside).
en route). We use T for types, S for type schemes, and K for type
constants such as Int and Bool. In addition we use C
By this means it is possible to give a full de(cid:12)nition
to range over the subset ofK that correspond to the \C-
of Haskell's standard input/output behaviour (involving
types" described in Section 4.
listsofrequests andresponses) as wellas muchmore. In-
deed,theGlasgowimplementationoftheHaskellI/Osys- T ::= t j K j T1 !T2 j ST T1 T2 j
tem is itself now written entirely in Haskell, using ccall MutVar T1 T2 j MutArr T1 T2
to invoke Unix I/O primitives directly. The same tech-
niques have been used to write libraries of routines for S ::= T j 8t:S
callingX, etc.
Note that the MutArr type constructor has only two ar-
guments here. The missing one is the index type. For
5 Formal semantics the purposes of the semantics we shall assume that ar-
rays are always indexed by naturals, starting at 0. The
Having given the programmer's eye view, it is time now type rules are given in Figure 1. (cid:0) ranges over type en-
to be more formal. In this section we present the static vironments (that is, partial functions from references to
and dynamic semantics of a small language supporting types), and we write FV(T) for the free variablesoftype
state transformers, andgiveanoutlineproofofsafety for T and likewise for type environments.
7
with some structure.
(cid:0)`e1 :T1 !T2 (cid:0)`e2 :T1
APP DST s a = State s!(Da(cid:2)State s)
(cid:0)`(e1 e2):T2 DMutVar s a = N?
DMutArr s a = (N (cid:2)N)?
(cid:0);x:T1 `e:T2 State s = ((N ,!Val)(cid:2)Ds)?
LAM
(cid:0)`(cid:21)x:e:T1 !T2
The state is a (cid:12)nite partial function from locations (rep-
resented by natural numbers) to values, together with
(cid:0)`e1 :S (cid:0);x:S `e2 :T
LET a component which depends on the type of the state.
(cid:0)`(let x=e1 in e2):T The only type of values here which will concern us is
RealWorld, the type that s takes in IO computations.
VAR (cid:0);x:S `x:S Moreonthislater. Wealsoaddabottomelementtorep-
resent an unde(cid:12)ned state, and distinguish between this
(cid:0)`e:8t:S unde(cid:12)ned state and states which are well-de(cid:12)ned partial
SPEC t62FV(T)
(cid:0)`e:S[T=t] functions, but which map every thing to ?. The unde-
(cid:12)nedstatearisesnaturallyasthestatewhichresultsfrom
(cid:0)`e:S an in(cid:12)nite loop of state transformers, for example.
GEN t62FV((cid:0))
(cid:0)`e:8t:S The meaning of a state transformer is a function which,
givenastate,producesapairofresults: avalueandanew
(cid:0)`e1 :C1 (cid:1)(cid:1)(cid:1) (cid:0)`en :Cn state. The least de(cid:12)ned state transformer is the function
CCALL
(cid:0)`(ccall x e1:::en):C which, given any state, returns the pair containing an
unde(cid:12)ned value and an unde(cid:12)ned state (i.e. the bottom
(cid:0)`e:8t:ST t T of the product domain).
RUN t62FV(T)
(cid:0)`(runST e):T
E[[Expr]]:Env !Val
Figure 1: Type rules
E[[k]] (cid:26) = B[[k]]
E[[x]](cid:26) = (cid:26) x
E[[e1 e2]] = (E[[e1]] (cid:26)) (E[[e2]] (cid:26))
E[[\x->e]] (cid:26) = (cid:21)v:(E[[e]] ((cid:26)(cid:8)fx7!vg)
5.3 DenotationalSemantics
E[[runSTe]] = run (E[[e]](cid:26))
The denotational semantics of state operations is easy
E[[e1 `thenST`e2]] = bind (E[[e1]] (cid:26)) (E[[e2]] (cid:26))
to add to standard semantics for lazy functional lan-
E[[returnSTe]] = unit (E[[e]](cid:26))
gauges. Figure 2 gives a standard semantics for a non-
E[[fixSTe]] = loop (E[[e]] (cid:26))
strictlambdacalculus,exceptthatweextenditwithstate
transformers.
run m = (cid:25)1 (m (;;?))
0 0
The valuation function E[[ ]] takes an expression and an (bind m k) (cid:27) = k x (cid:27) where (x;(cid:27))=m (cid:27)
environment andreturns avalue. Weuse Env forthe do- (unit v) (cid:27) = (v;(cid:27))
mainof environments, and Val for the domainof values, (loop f) (cid:27) = f x (cid:27)
de(cid:12)ned as follows: where x=fix ((cid:21)y:(cid:25)1 (f y (cid:27)))
Q
Env = S(cid:28)(var(cid:28) !D(cid:28)) Figure 2: Semantics of State Combinators
Val = (cid:28) D(cid:28)
References are denoted simply by natural numbers, ex-
cept that it is possible to have an unde(cid:12)ned reference
The environment maps a variable of type (cid:28) to a value in also, denoted by ?. The number represents a \location"
the domainD(cid:28), and the domainof values is the union of inthe state. Arrays are locatedbyapairofnaturalsrep-
all the D(cid:28), where (cid:28) ranges over monotypes. resenting the location of element 0, and the size of the
array,but again it is possible to have a totally unde(cid:12)ned
From the point of view of the language, the type con-
array reference.
structors ST, MutVar and MutArr are opaque. To give
themmeaning,however,thesemanticsmustprovidethem TurningtothedetailsofFigures2to5,wenoteanumber
8
E[[newVare1]] = n(cid:26)ewVar v1
?; if v1 =?
E[[readVare1]] = where vi =E[[ei]] (cid:26)
(cid:26) readVar v1 otherwise
?; if v1 =?
E[[writeVare1 e2]] =
writeVar v1 v2 otherwise
(newVar v) ? = (?; ?)
(newVar v) ((cid:28);w) = (p; ((cid:28)[p7!v];w)) where p62dom((cid:28))
(readVar p) ? = (?; ?)
(cid:26)
(?; ?); if p62dom((cid:28))
(readVar p) ((cid:28);w) = where vi =E[[ei]] (cid:26)
((cid:28) p; ((cid:28);w)); otherwise
(writeVar p v) ? = (?; ?)
(cid:26)
(?; ?); if p62dom((cid:28))
(writeVar p v) ((cid:28);w) =
((); (cid:28)[p7!v]); otherwise
Figure 3: Semantics of variables
(cid:26)
?; if v1 =?
E[[newArre1 e2]] =
(cid:26) newArr v1 v2 otherwise
?; if v1 =? or v2 =?
E[[readArre1 e2]] = where vi =E[[ei]] (cid:26)
(cid:26) readArr v1 v2 otherwise
?; if v1 =? or v2 =?
E[[writeArre1 e2 e3]] =
(cid:26) writeArr v1 v2 v3 otherwise
?; if v1 =?
E[[freezeArre1]] =
freezeArrv1 otherwise
(newArr n v) ? = (?;?)
(newArr n v) ((cid:28);w) = ((p;n); ((cid:28)[p7!v;:::;(p+n(cid:0)1)7!v];w))
where 8q:fp:::(p+n(cid:0)1)g:q62dom((cid:28))
(readArr (p;n) i) ? = (?;?)
(cid:26)
(?;?); if i62f0:::(n(cid:0)1)g or p+i62dom((cid:28))
(readArr (p;n) i) ((cid:28);w) =
((cid:28) (p+i); ((cid:28);w)); otherwise
(writeArr (p;n) i v) ? = (?;?)
(cid:26)
(?;?); if i62f0:::(n(cid:0)1)g or p+i62dom((cid:28))
(writeArr (p;n) i v) ((cid:28);w) =
((); ((cid:28)[p+i7!v];w)); otherwise
(freezeArr (p;n)) ? = (?;?)
(cid:26)
(?;?); if 9q:fp:::(p+n(cid:0)1)g:q62dom(cid:28)
(freezeArr (p;n)) ((cid:28);w) = n
(fi7!(cid:28)(p+i)gi=0; ((cid:28);w)); otherwise
Figure 4: Semantics of Arrays
9
of aspects. Some of the operations are strict. For exam- generated: whenever a Write is obeyed, the returnST
ple,readVar,and writeVarare strict intheir references, shouldbe ableto makethe (cid:12)rst elementofits outputlist
but none ofthe operations are strict in the values stored. available to the outside world before obeying the rest of
Again, newVar, readVar, and writeVar are strict in the the commands.
state, butthenSTandreturnSTare not. Weshallreturn
to this point in a moment.
5.4 Safety
Array references are treated similarly, except that they
How can we be sure that the above type system ensures
come in two parts: the base reference and an o(cid:11)set (the
thateachstate threadisindependent ofallothers? Afull
array index). We assume indexing ranges from 0 to the
prooflieswelloutsidethe scope ofthispaper, butwewill
size of the array minus1. Again, readArrand writeArr
provide an outline of the ideas, together with a (slightly
are strict in both the array reference and in the index.
informal)statement of the mainresult.
They also return unde(cid:12)ned if the index is out of bounds.
Finally, they and newArr are strict in the state. newArr Our ultimate intention is to implement all the distinct
is also strict in the array size. state threads using the single, global,machinestate, but
to do so without a(cid:11)ecting the values returned by state
The semantics makes the nature of arrays crystal clear.
computations. That is, we want to be able to map each
They are composed of many separate locations in the
threadontothe globalstate,andtoensure thattheindi-
state, each independently updatable, each update cost-
vidualstatethreads cannotcommunicatewitheachother
ing no more than a variable update would cost.
except through purely functional values. Similarly, we
want to guarantee that we can arbitrarily interleave the
evaluation of separate state threads, still without a(cid:11)ect-
E[[cca(cid:26)llfn e1:::en]] ingtheresultofthecomputationbecause,inpractice,the
?; if 9i:vi =? amountof computationwhich takes place in each thread
=
doIO fn [v1;:::;vn] otherwise will depend on the demand for its (cid:12)nal value. We cer-
where vi =E[[ei]] (cid:26) tainly do not want the value of the result to depend on
the pattern of demand.
doIO :Name!SeqVal !
Consider then a single state thread. In the semantics it
State RealWorld!(Val(cid:2)State RealWord)
is applied to the empty state, and this state is extended
doIO fn args ? = (?; ?)
0 by applicationsofnewVar(and newArrof course). There
doIO fn args ((cid:28);rw) = (v; ((cid:28);rw ))
0 are no other active locations,and the state undergoes no
where (v;rw)=IO fn args rw
transformationsother thanthose speci(cid:12)ed bythese reads
and writes.
IO:Name !Seq Val !
RealWorld!(Val(cid:2)RealWorld) In contrast, if we were to imagine using a single global
stateforallthe threads,then manymorelocationswould
be active and, because of possible interleavings of op-
Figure 5: Semantics of IO operations
erations from other threads, the underlying state might
change whilepassing fromone primitiveoperation tothe
The semantics of IO operations is given with respect to next. The big question is: how can we guarantee that
an unspeci(cid:12)ed function IO which is a state transformer these changes donota(cid:11)ect theresult ofthe state thread?
on the RealWorld.
Weviewthestatefromtheperspective ofasinglethread,
The primitive operations, such as newVar, readVar, and runST m,andmodelthechangesmadebyotherthreadsas
so on, are necessarily strict in the state. After all, they non-deterministicchanges to the state. So, (cid:12)rst, we have
each depend on the value of the state. In contrast, the to map the state of this particular thread into a global
semanticsdonotmakethenSTorrunSTstrictinthestate, state containing material from many separate threads.
since they do not need its value. Wemodelthis mappingbyaninjection(one-to-one map-
ping) (cid:30) :N ! N which maps a reference from the local
What di(cid:11)erence might this make? Consider the inter-
state of m to a reference in a global state. The range of
preter for a language with IO operations and state given
(cid:30) is that part ofthe globaladdress space which supports
in Figure 6. The values of variables are stored in a mu-
the execution of m.
table array, and a variable is used to store the input (a
lazy list). The result of obeying the commands is a list Wewillsaythataglobalstate(cid:28)1 modelsthelocalstateof
of the output values. The output should appear as it is the semantics,(cid:28)m,if(cid:28)m =(cid:28)1(cid:14)(cid:30). Thatis,if(cid:28)m isde(cid:12)ned
10
