Causing Communication Closure: Safe Program Composition with Reliable Non-FIFO Channels

0.52 MB·English

by  Kai Engelhardt

Causing Communication Closure: Safe Program
∗
Composition with Reliable Non-FIFO Channels
Kai Engelhardt† Yoram Moses‡
7
0
0 May 6, 2009
2

n
a
J

9

A semantic framework for analyzing safe composition of distributed programs is presented.
]
C Its applicability is illustrated by a study of program composition when communication is reli-
D ablebutnotnecessarilyFIFO. Inthismodel,specialcaremustbetakentoensurethatmessages
. do not accidentally overtake one another in the composed program. We show that barriers do
s
c not exist in this model. Indeed, no program that sends or receives messages can automatically
[
be composed with arbitrary programs without jeopardizing their intended behavior. Safety of

1 composition becomes context-sensitive and new tools are needed for ensuring it. A notion of
v
sealing is defined, where if a program P is immediately followed by a program Q that seals
4
6 P then P will be communication-closed—it will execute as if it runs in isolation. The investi-
0 gation ofsealing inthis model reveals anovel connection between Lamportcausality and safe
1
composition. A characterization of sealable programs is given, as well as efficient algorithms
0
7 fortestingifQsealsPandforconstructingasealforasignificantclassofprograms. Itisshown
0 that every sealable program that isopen tointerference onO(n2)channels can besealed using
/
s O(n)messages.
c
:
v
Xi 1. Introduction
r
a Much of the distributed algorithms literature is devoted to solutions for individual tasks. Implicitly it may
appearthatthesesolutionscanbereadilycombinedtocreatelargerapplications. Composingsuchsolutions
is not, however, automatically guaranteed to maintain their correctness and their intended behavior. For
example,algorithmsaretypicallydesignedundertheassumptionthattheybeginexecutinginawell-defined
initial global state in which all channels are empty. In most cases, the algorithms are not guaranteed to
terminateinsuchastate. Anotherinherent feature ofdistributed systemsisthat,eventhough theyareoften
designedinclearlyseparatedphases,thesephasestypicallyexecuteconcurrently. Forinstance,Lynchwrites
in[Lyn96,p.523]:
∗Apreliminaryversionappearedas[EM05a].WorkwaspartiallysupportedbyARCDiscoveryGrantRM02036.
†[email protected], School of Computer Science and Engineering, The University of New South Wales, and NICTA,
Sydney, NSW 2052, Australia. National ICT Australia is funded through the Australian Government’s Backing Australia’s
Abilityinitiative,inpartthroughtheAustralianResearchCouncil.
‡[email protected], Department of Electrical Engineering, Technion, Haifa, 32000 Israel. Work onthispaper hap-
pened during a sabbatical visit to the School of Computer Science and Engineering, The University of New South Wales,
Sydney,NSW2052,Australia.
1
“AnMSTalgorithmcanbeusedtosolvetheleader-electionproblem[...]. Namely,afterestab-
lishing anMST,theprocesses participate intheSTtoLeader protocol toselect theleader. Note
that the processes do not need to know when the MST algorithm has completed its execution
throughout thenetwork;itisenoughforeachprocessitowaituntilitisfinishedlocally,[...].”
In general, when two phases, such as implementations of an MST algorithm and of the STtoLeader al-
gorithm, are developed independently and then executed in sequence, one phase may confuse messages
originating from the other with its own messages. Perhaps the first formal treatment of this issue was via
thenotionofcommunication-closed layersintroduced byElradandFrancezin[EF82]. Consideraprogram
P=P k...kP consisting of n concurrent processes P =Q;L;Q′, the execution of which is, intuitively,
1 n i i i i
dividedintothreephases,Q,L,andQ′. ElradandFrancezdefineL=L k...kL tobeacommunication-
i i i 1 n
closed layer (CCL)in Pif under no execution of P does a command in some L communicate with a com-
i
mand in any Q or Q′ [EF82]. If a program P can be decomposed into a sequence of CCLs then every
j j
execution of P can be viewed as a concatenation of executions of P’s layers in order. Hence, reasoning
about P can be reduced to reasoning about its layers in isolation. This approach has been investigated fur-
therandappliedtoavarietyofproblemsbyJanssen, Poel,andZwiers[JPZ91,Jan94,Jan95,PZ92]. Stomp
anddeRoeverconsideredrelatednotionsinthecontextofsynchronouscommunication[SdR94]. Gerthand
Shrira considered the issue of using distributed programs as off-the-shelf components to serve as layers in
larger distributed programs [GS86]. They observe that the above definition of CCL is made with respect
to the whole program P as context, and hence is unsuitable for off-the-shelf components. They solve the
problem by defining Lto be aGeneral Tail Communication Closed (GTCC)layer if, roughly speaking, for
all layers T k...kT we have that L is a CCL in L ;T k...kL ;T . Since this definition does not refer
1 n 1 1 n n
to the surrounding program context of a layer, it asserts a certain quality of composability. Sequentially
composing GTCClayersguarantees thateachoneofthemisaCCL.
Wedevelop aframework fordefining and reasoning about various notions central tothe design ofCCLs
indifferentmodelsofcommunication. Thecommunication modelusedinmostoftheliterature concerning
CCLs is that of reliable FIFO channels. In practice, channels often fail to satisfy this assumption. Three
main sources of imperfection are loss, reordering, and duplication of messages by a channel. This paper
studies the impact of message reordering on the design of CCLs. Our communication model, which we
call REL, will therefore assume that channels neither lose nor duplicate messages but message delivery is
not necessarily FIFO. As weshall see, in REL, the CCLproperty depends in an essential way on Lamport
causality[Lam78]. Indeed,toensureCCL,causalityisallthatisneededinREL,whereaseitherduplication
orlossalreadymandatetheneedforheadersinmessages[FL90,EM05c].
Consider for instance the task of transmitting a message
m from process i to process j where it is stored in variable
i snd rcv snd x. Thetaskisaccomplishedbyiperforming SNDmi→j tosend
themessageand jperformingRCVxj←itoreceiveitintovari-
j rcv snd able x. This implementation denoted MTmi→→jx (for Message-
Transmit) works fine in isolation. Composing two copies1
MT i→j MT j→i
of MTi→j, however, does not guarantee the same behavior
as executing the first to completion and then executing the
Figure1:MTj→i seals MTi→j. second. Sincecommunication isnotFIFO,thesecondmes-
sage sent by i could be the first one received by j. On the
other hand, if MTi→j is followed by MTj→i no such interference occurs. Moreover, no later program can
ever interfere with the first MTi→j in this pair. Ofcourse the second program, MTj→i, is still susceptible to
interference, e.g., byanother MTj→i. In fact, non-trivial programs are never safe from interference in REL.
As we shall show, for any terminating program P transmitting a message from i to j there is a program Q
1WeomittedthesubscriptinMTi→j.Wheneveraparameterisirrelevanttothepointbeingmade,wetendtoomitit.
2
potentiallyinterferingwithcommunicationinP. Oneconsequenceisthatnoterminatingprogramthatsends
messagescanbeaGTCClayer.
Theabovediscussion suggests thatitisnecessary toinspect thenextlayerinordertodetermine whether
agivenlayerisaCCL.Infact,weshalldefineanotionofaprogramQsealingitspredecessorP,whichwill
ensure that P is a CCL in P immediately followed by Q. For example, MTj→i seals MTi→j and vice versa.
Intuitively, Q seals P if Q guarantees that no message sent after P can be received in P. Let us consider
why MTj→i seals MTi→j. Suppose that a later message is sent on the channel from i to j as in Fig. 1. This
ACK
send is performed only after the message sent in the opposite direction has been received by i, which in
turn must have been sent after the first message has been received by j. Consequently, j’s receive event
mustprecede i’ssending ofthelatermessage. Therefore, thelatermessagecannot competewiththeearlier
one. A message transmitted in the opposite direction is often called an acknowledgment. More interesting
examplesofsealingarepresentedinFigures2(a)and3. ForadecompositionofaprogramPintoasequence
ofℓlayers L(1),...,L(ℓ),itfollows thatifL(k+1) seals L(k) for all1≤k<ℓthen eachlayer L(k) isaCCLin
P.
In[Lam78]Lamportdefinedcausalityamongeventsofasynchronousmessagepassingsystems. Causality
implies temporal precedence. As discussed above, transmitting an acknowledgment guarantees that the
receive of the first message causally precedes any later sends on the same channel. Observe that the same
effect could be obtained by other means ensuring the intended precedence. For instance, a causal chain
consisting of a sequence of messages starting at j, going through a number of intermediate processes, and
endingaticouldbeusedjustaswell. Whilethistransitiveformofacknowledgmentappearstobeinefficient,
agivenmessage can play arole inanumber oftransitive acknowledgments. Fig.2(a) illustrates aprogram
consisting of the transmission of three messages over three different channels. It is sealed using transitive
acknowledgments bytheprogram displayed inFig.2(b),whichsendsonlytwomessages.
snd snd rcv snd
rcv snd rcv
rcv rcv snd
(a) AprogramP. (b) AsealforP.
Figure2:Anexampleofsealing.
Indeed, weshalllatershowhowO(n)messagescanusefullysubstitute forW (n2)acknowledgments. Not
all programs can be sealed. We shall later prove that program X shown in Fig. 3(a) is unsealable. The
same program executed in the presence of a third process as in Fig. 3(b) is, however, sealable. Any seal
of this program will necessarily use transitive acknowledgments as discussed above. See Fig. 3(c) for an
illustration ofonewaythisprogramcanbesealed.
Contributions. Thefirstmaincontributionofthispaperisinthepresentationofaframeworkstudyingsafe
compositionoflayersofdistributedprogramsindifferentmodelsofcommunication. Withintheframework
we define notions including CCL and barriers. Moreover, it is possible to define new notions such as
sealing that play an important role in ensuring safe composition. In this paper the power of the framework
is illustrated by a comprehensive study of safe composition in REL. In a companion paper [EM05b] the
frameworkisusedtodefineadditional notionsthatareusedtostudysafecomposition inFIFO-modelswith
duplicating and/orlossychannels.
3
snd rcv
snd rcv
(a) UnsealableprogramX.
snd rcv snd rcv
snd rcv rcv snd
rcv snd
(b) AsealableprogramP′. (c) AsealforP′.
Figure3:Anexampleofaprogram fortwoprocesses thatisunsealable unlessathirdprocess isadded.
Oursecond maincontribution isinidentifying thenotion ofsealing and demonstrating itscentral rolein
thedesignofCCLsin REL. Westudythetheoryofsealing inREL andpresentthefollowingresults.
• Sealablestraight-line programsarecompletely characterized.
• Adefinitionofthesealingsignatureofstraight-lineprogramsisgiven,whichcharacterizesthesealing
behaviorofaprogramconcisely,forbothpurposes,sealingandbeingsealed. Thesizeofthesignature
isO(n2).
• Analgorithm fordeciding whetherQsealsPbasedonlyontheirsignatures ispresented.
• Analgorithm forconstructing sealsforsealable straight-line programsispresented. Itproduces seals
thatperform lessthan3nmessagetransmissions eventhoughW (n2)channels mayneedtobesealed.
The restriction to straight-line programs is motivated by the undecidability of the corresponding problems
forgeneralprograms. Specifically,thehaltingproblemcanbereducedtoeachoftheseproblemsforgeneral
programs. Asfarascommunicationclosureisconcerned,straight-lineprogramsalreadydisplaymostofthe
interesting aspectsrelevanttothesubjectofsealing.
2. AModelofDistributedProgramswithLayering
In this section we define a simple language for writing message-passing concurrent programs. Its compo-
sition operator “∗” is called layering. Layering subsumes the two more traditional operators “;” and “k”
(as discussed by Janssen in [Jan94]). The meaning of P∗Q is that each process i first executes its share of
P and then proceeds directly to execute its share of Q. In particular, layering does not impose any barrier
synchronization between P and Q. In other words, inP∗Q process ineed not waitfor any other processes
tofinishtheirsharesofPbeforemovingontoQ. Consequently, programsexecutebetweencutsratherthan
global states. Weshalldefineanotion r[c,d](cid:13)Pofaprogram Poccurring overaninterval r[c,d]between
thecutscandd ofarunr.
Our later analysis willbe concerned with CCLsP. Thus weneed to ensure that no message crosses any
initialorfinalcutofaninterval overwhichPoccurs. Aconcise wayofcapturing thisformallyisviaanew
language construct, the silent cut , ≀. Writing ≀ specifies that all communication channels are empty at this
cut. Inotherwords,nostatementtotheleftofthe≀cancommunicate withastatementtotheright. IfPisa
4
CCLinagiven larger program Lthen everyexecution ofPinLisalsoanexecution of≀P≀. Inother words,
P can be substituted for ≀P≀ in L.2 We adopt a standard notion of refinement to indicate substitutability
of programs. Program P refines program Q if every execution of P over an interval r[c,d] is also one of
Q, regardless of what happens before c and after d. The notions of “∗”, “≀”, and refinement provide a
unifiedlanguagefordefiningnotionsofsafecomposition. Theprogramminglanguageanditssemanticsare
formallydefinedasfollows.
2.1. Syntax
Let n∈N and P={1,...,n} be a set of processes. Throughout the paper n will be reserved for denoting
the number of processes. Let (Vari)i∈P be mutually disjoint sets of program variables (of process i) not
containing the name h which is reserved for i’s communication history. Let Expr be the set of arithmetic
i i
L
expressions overVar. Let bepropositional logicoveratomsformedfrom expressions withequality “=”
i
andless-than “<”. Wedefineasyntactic categoryPrgofprograms:
Prg∋P ::= e | x:=e | SNDei→j | RCVxj←i | [f ] | ≀ | P∗P | P+P | Pw
wherex∈Var,e∈Expr ,i,j∈P,andf ∈L.
i i
Theintuitivemeaningoftheseconstructsisasfollows. Thesymbole denotestheemptyprogram. Ittakes
no time to execute. Assignment statement x:=e evaluates expression e and assigns its value to variable x.
TheSNDei→j statementsendsamessagecontainingthevalueofeonthechannelfromito j. Communication
is asynchronous, and sending is non-blocking. The RCVxj←i statement, however, blocks until a message
arrives on the channel from i to j. It takes a message off the channel and assigns its content to x. The
guard [f ] expresses a constraint on the execution of the program: in a run of the program, f must hold
at this location. Guards take no time to execute. The program ≀ is a guard-like constraint stating that all
L
channels must be empty at this location. Formally, our propositional language is not expressive enough
to define ≀ as a guard because formulas are not capable of refering to channel contents. The operation “∗”
representslayeredcompositionfollowingJanssenetal.[Jan95]. Layeringstatementsofdistinctprocessesis
essentiallythesameasparallelcompositionwhereaslayeringofstatementsofthesameprocesscorresponds
to sequential composition. We tend to omit “∗” when no confusion will arise. The symbol “+” denotes
w
nondeterministic choice. By P we denote zero or more (possibly infinitely many) repetitions of program
P.3
2.2. Semantics
A send record (for i) is a triple (i→ j,v), which records sending a message with contents v from i to the
receiver j. Similarly, (j←i,v) is a receive record (for j). A local state (for process i) is a mapping from
Var to values and from h to a sequence of send and receive records for i. A local run (for process i) is
i i
an infinite sequence of local states. We identify an event (of i) with the transition from one local state in a
localrunofitothenext. Aneventiseither asend, areceive, oraninternal event. A(global) runisatuple
r=((ri)i∈P,d r)oflocalruns—oneforeachprocess—plusaninjectivematchingfunctiond r associating a
sendeventwitheachreceiveeventinr. Themappingd isrestricted suchthat:4
r
2Inplaceofthesilentcut≀thepreliminaryversionofthispaper[EM05a]usedaphasequantifiert . Programt Proughlycorre-
spondstoour≀P≀.
3Using guards, choices, and repetition it is possible to define iff thenPelseQfi as an abbreviation for [f ]P+[¬f ]Q and
whilef doPod for ([f ]P)w [¬f ]. The resultsinthispaper alsohold for alanguage based on if and whileinstead of [.], +,
w
and .
4Ourchoiceofexecutionmodeliscloselyrelatedtothemorestandardoneofinfinitesequencesofglobalstates,representingan
interleavingofmovesbyprocesses. Ourconditionsond r guaranteetheexistenceofsuchaninterleaving. Ingeneral,eachof
ourrunsrepresentsanequivalenceclassofinterleavings.
5
1. Ifd (e)=e′andeisareceiveeventofprocess jresultingintheappendingof(j←i,v)to j’smessage
r
history then e′ is a send event of process i appending the corresponding send record (i→ j,v) to i’s
messagehistory.
2. Lamport’s causality relation −→L induced by d on the events of r, as defined below, is an irreflexive
r
partialorder, henceacyclic.
Thefirstconditioncapturesthepropertythatmessagesarenotcorruptedintransit. Thefactthatthefunction
d is total precludes the reception of spurious messages, whereas injectivity ensures that messages are not
r
duplicated intransit. Further restrictions ond can bemadetocapture additional properties ofthecommu-
r
nication mediumsuchasreliability, FIFO,fairness, etc.
Wesaythatr∈REL ifnounmatchedsendeventissucceeded byinfinitelymanymatchedsendeventson
thesamechannel.
In[Lam78]Lamport defined a“happened before” relation −→L onthe setofevents occurring inarunr of
a distributed system. The relation −→L is defined as the smallest transitive relation subsuming (1) the total
orders ontheeventsofprocess igivenbyther,and(2)therelation {(e ,e )| d (e )=e }betweensend
i 1 2 r 2 1
andreceiveeventsinducedbythematchingfunction d .
r
2.2.1. CutsandChannels
Write N+ for N∪{¥ }. A cut is a pair (r,c) consisting of a run r and a P-indexed family c= (ci)i∈P of
N -elements. Wewrite“≤”forthecomponent-wise extension ofthenaturalordering onN tocutswithin
+ +
thesamerun. Acutisfiniteifallitscomponents are.
Say that an event e performed by process iis in acut (r,c) if e occurs in r at an index no larger than c,
i i
and eoccurs outside of (r,c) if the index is larger than c. A cut (r,c) corresponds to the, possibly implau-
i
sible, situation in which the events in the cut have occurred for each process i∈P. We define the channel
chan at a cut (r,c) to be the set of i’s send events to j and j’s receive events from i in (r,c) that are not
i→j
matched byd toanyeventalsoin(r,c). Finally, aformula f ∈L holds at(r,c), andwewrite(r,c)|=f ,if
r
f holds in standard propositional logic when, for each i∈P, program variables in Var are evaluated in the
i
localstatesr(c)ifc isfinite,andareconsidered unspecified otherwise.5
i i i
Observe that a cut can, in general, be fairly arbitrary. In particular, there is no requirement that all
messages thatarereceived beforeacutisreachedweresentbeforethecut. Thisisdeliberate. Thereare,of
course, many instances in which morestructured cuts may beof interest. Indeed, wecan define acut (r,c)
tobeconsistent ifevery−→L predecessor ofaneventinthecut(r,c)isalsointhecut. Moreover,inthiswork
wemakeuseofastronger propertyofcuts—thatallchannels areemptyatthecut.
2.2.2. SemanticsofPrograms
Wedefinethemeaningofprogramsbystatingwhenaprogramoccursoveraninterval. Anintervalconsists
of two cuts (r,c) and (r,d) over the same run with c≤d, which we denote for simplicity by r[c,d]. An
eventisinr[c,d]ifitisin(r,d)butnotin(r,c). Wedefinetheoccurrence relation (cid:13)betweenintervals and
programs by induction on the structure of programs. The interesting cases are those of ∗ and ≀. Formally,
program P∈Prgoccursoverintervalr[c,d],denotedr[c,d](cid:13)P,iff:6
r[c,d](cid:13)e ifc=d.
r[c,d](cid:13)x:=eifd=c[i7→c +1]andr(d)=r(c)[x7→v],wherevisthevalueofeinr(c).
i i i i i i i
5Recallthatlocalstatesassignvaluestolocalvariables.
6Weshalldenoteby f[a7→b]thefunctionthatagreeswith f oneverythingbuta,andmapsatob.
6
r[c,d](cid:13)SNDei→j ifd =c[i7→ci+1]andri(di)=ri(ci)[hi 7→ri(ci)(hi)·h(i→ j,v)i], wherevisthevalueof
einr(c).
i i
r[c,d](cid:13)RCVxi←j ifd=c[i7→ci+1]andri(di)=ri(ci)[hi 7→ri(ci)(hi)·h(i← j,v)i,x7→v].
r[c,d](cid:13)[f ]ifc=d and(r,c)|=f .
r[c,d](cid:13)≀ifc=d andnocommunication eventin(r,c)ismatchedbyd withaneventoutside(r,c).7
r
r[c,d](cid:13)P∗Qifthereexistsc′ satisfying c≤c′≤d suchthatr[c,c′](cid:13)Pandr[c′,d](cid:13)Q.
r[c,d](cid:13)P+Qifr[c,d](cid:13)Porr[c,d](cid:13)Q.
r[c,d](cid:13)Pw if, intuitively, an infinite or finite number (possibly zero) of iterations of P occur over r[c,d].
More formally, r[c,d] (cid:13) Pw if there exists a finite or infinite sequence (c(k)) such that I is a non-void
k∈I
prefixofN ,c(0) =c,c(k) ≤c(k′) forallk<k′∈I,F c(k) =d,andr[c(k),c(k+1)](cid:13)Pforallk,k+1∈I.
+ k∈I
The program semantics is insensitive to deadlocks because deadlocking executions are not represented by
runs. Wedeliberately chose toignore deadlocks tosimplify thepresentation andfocus onthemainaspects
ofcomposition. Whetheraprogramdeadlocks canbeanalyzed usingstandardtechniques [Lyn96,p.635f].
Generalassumption. Fromnowonward,weshallonlyconsiderprogramsthataredeadlock-free.
2.2.3. Refinement
Weshall capture various assumptions about properties of systems by specifying sets of runs. Forinstance,
REL isthe class ofrunswithreliable communication, and RELFI isitssubclass inwhich channels are also
FIFO.
Given a set G of runs, we say that P refines Q in G , denoted P≤G Q, iff r[c,d](cid:13)P implies r[c,d](cid:13)Q,
forallr∈G andc,d ∈(N )P. Inotherwords,everyexecutionofP(inaG run)isalsooneofQ,regardless
+
of what happens before and after. Therefore, we may replace Q by P in any larger program context. This
definitionofrefinementisthusappropriate forstepwisetop-downdevelopmentofprogramsfromspecifica-
tions. Therefinementrelationonprogramsistransitive(infactapre-order)andallprogrammingconstructs
aremonotonew.r.t.therefinementorder.
3. CapturingSafeComposition
Thesilent cut program ≀allows us to delineate the interactions that a layer can have withother parts of the
program. When combined with refinement it is useful for defining various notions central to the study of
safecomposition, aswenowillustrate.
CCL. Wecanexpressthattheprogram LisaCCLintheprogramP∗L∗Qw.r.t.G by:
≀P∗L∗Q≀ ≤G P≀L≀Q .
In words, any isolated execution of P∗L∗Q will have the property that all communication in L is internal
andhenceLexecutesasinisolation. Thisdefinitioniscontext-sensitive.
7I.e.,noreceiveinthecut(r,c)ismappedbyd r toasendoutsideofthecut,andnoreceivefromoutsideismappedtoasendin
thecut.
7
Barriers. More modular would be a notion that guarantees safe composition regardless of the program
context. One technique to ensure that two consecutive layers do not interfere with each other is to place a
barrierBbetweenthem. Formally,program Bisabarrier inG if
≀P∗B∗Q ≤G P≀B≀Q ,forallP,Q.
Traditionally, barriers have been used to synchronize the progression through phases by enforcing that no
processcouldstartitsn+1st taskbeforealltheotherprocesseshadcompletedtheirnth tasks. Thiscouldbe
formilzedbyrequiring that,ifr[c,c′](cid:13)≀P,r[c′,d′](cid:13)B,andr[d′,d](cid:13)Q,thenalleventsin(r,c′)necessarily
−→L -precedealleventsnotin(r,d′),forallrunsr∈G ,andprogramsP,Q.
TCC. Some programs can be safely composed without the need for communication-closedness [EF82,
JZ92]. Depending onthemodelG ,there maybeprograms Pthatsafely compose withallfollowing layers.
WesaythatPistailcommunication closed(TCC)inG if,
≀P ≤G P≀ .
Thus,ifPisTCCthenanyexecution ofPstarting inemptychannelswillalsoendwithallchannels empty.
Therefore TCCprograms can bereadily composed.8 Itisstraightforward tocheck thatthe programs e , [f ],
x:=e,andP≀areTCCinanyG . Moreover, ifPandQareTCCinG thensoareP+Q,P∗Q,andPw .
ObservethateverybarrierBinG isinparticular TCCinG .
Seals. In manymodels ofinterest, only trivial programs are TCC. Thisis the case, for example, in REL,
asshowninSection 4below. Insuchmodels, analternative methodology isrequired fordetermining when
it is safe to compose given programs. Next we define a notion of sealing that formalizes the concept of
program S serving as an impermeable layer between P and later phases such that no later communication
willinteract withP. WesaythatSsealsPinG if,
≀P∗S ≤G P≀S .
Thus,ifSsealsPinG thenneitherSnoranylaterprogramcaninterferewithcommunicationinP. IfSseals
PandQsealsS,thenSwillbehave in≀P∗S∗Qasitdoesinisolation. Sealingallowsincremental program
development whilemaintaining CCL-stylecomposition.
Lemma1 1. IfbothPandP′ aresealedbySinG thensoisP+P′.
2. IfbothSandS′ sealPinG thenS+S′ (properly) sealsPinG .
3. IfSsealsPinG thenS∗QsealsPinG .
4. IfbothSsealsPandS′ sealsSinG ,thenS′ sealsP∗SinG .
5. IfPsealsitselfinG thenPsealsPw inG .
6. TCCsubsumessealing: PisTCCinG iffallprogramssealPinG .
It follows from this lemma that, if program P can be decomposed into asequence of ℓ layers L(1),...,L(ℓ),
andinaddition L(k+1) sealsL(k) forall1≤k<ℓ,theneachlayerL(k) isaCCLinP.
For example, as discussed in the introduction, any program of the form MTj→i seals any program of the
form MTi→j in REL. Consequently, aprogram oftheform MTi→j∗MTj→i seals itself in REL. Ontheother
hand, the shorter program MTi→j does not seal itself in REL—in an execution of MTi→j∗MTi→j the two
messagessentbyicouldbereceivedinthereverseorderofsending.
8TCCfollowsandiscloselyrelatedtothenotionofGTCCintroducedbyGerthandShrira[GS86]. Themaindifferenceisthat
theirnotionisdefinedw.r.t.asetofinitialstates.
8
ProperSeals. SupposethatP={1,2}andx ∈Var fori∈P. ThentheprogramQ=whiletruedo(x :=
i i 1
5∗x2:=17)odisTCCinRELFI,aCCLinREL,andsealsanyprograminREL. Foritnecessarily diverges,
thatis,itoccurs onlyoverintervals r[c,d]withnon-finite d. Thisimpliesthatnolayer followingQhasany
impact on the semantics of the whole program. It follows trivially that no communication of a later layer
can interfere with anything before. Programs such as Q are not particularly useful as seals, in contrast to
ones that seal without diverging. This motivates the following definition. Wesay that S is a proper seal of
PinG ifSsealsPandSneverdiverges after P. Thatis,forallr∈G andc,d,d′,whenever r[c,d](cid:13)≀P,and
r[d,d′](cid:13)≀Sandd isfinitethensoisd′.
For instance, since MTi→j is a terminating program that seals MTj→i in REL, it is in particular a proper
seal.
4. CaseStudy: SafeCompositionin REL
WenowconsidersafecompositioninthemodelREL. Communicationeventscancauseaprogramnottobe
TCCin REL. Forexample, reconsider theprogram MTei→→jx=SNDei→j∗RCVxj←i. ItisTCCin RELFI butnot
TCCin REL. ThatMTi→j isnotTCCinREL isnocoincidence. Nextweshowthatnoterminating program
performing anycommunication whatsoeverisTCCinREL.
Theorem2 Ifr[c,d](cid:13)Pforsomer∈REL andfinitec,d suchthatallchannelsareemptyin(r,c)andthere
isatleastonesendorreceiveeventinr[c,d],thenPisnotTCCin REL.
Proof: Assume that r[c,d](cid:13)P where r∈ REL, c,d are finite, all channels are empty at (r,c) and there is
a send or receive event in r[c,d]. If there is a non-empty channel in (r,d) the claim is immediate since a
matching communication event following Pcould interact withP. Otherwise, every message sentinr[c,d]
is received in r[c,d]. Since P is deadlock-free by the general assumption, there are processes whose last
communicationeventinr[c,d]isareceive. W.l.o.g.letibesuchaprocessandassumethatitslastreceiveis
ofamessagevsentby jintovariable x∈Var.
i
A run r′ ∈ REL that equals r up to d can be constructed such that r′[d,d′](cid:13)≀SNDej→i∗RCVxi←j≀, where
e evaluates to v in rj(dj). So the same message is transmitted twice between j and i. Let r′′ ∈ REL be
the same as r′, except for d , which swaps the matching send events between the two receive events. For
r
Q=SNDej→i∗RCVxi←j itfollowsthatr′′[c,d′](cid:13)≀P∗Q≀butr′′[c,d′]6(cid:13)≀P≀Q≀. Theclaimfollows. (cid:4)
Sinceabarrierisnecessarily TCCweimmediatelyobtain
Corollary 3 NoprogramcanserveasabarrierinREL.
Having shown that TCCand thus barriers are not generally useful notions in REL, weturn our attention to
(proper) sealing. Itisinstructive thatnotallterminating programscanbeproperlysealedin REL:
Lemma4 IfP={1,2}thentheprogramX =SND1→2∗SND2→1∗RCV1←2∗RCV2←1 illustratedinFig.3(a)
x+1 y+1 x y
cannotbesealedproperlyin REL.
Proof: Assume, by way of contradiction, that S properly seals X in REL. Consider a run r ∈ REL such
that r[(0,0),(2,2)] (cid:13) X and r[(2,2),d′](cid:13)S where d′ is finite. If some process i ∈P does not engage in
any communication event in r[(2,2),d′] then S does not seal X since a send by process i performed at d′
i
potentially interacts with X. Otherwise, let e be the first communication events of each process i=1,2 in
i
r[(2,2),d′]. If one of the e is a send then, as before, this send can interact with X. Finally, if both e are
i i
receivesthenScausesadeadlock, contradicting theassumption thatr[(2,2),d′](cid:13)S. (cid:4)
9
Our programming language Prg is Turing-complete. Since the halting problem for Prg can be reduced to
sealability in REL weobtain
Theorem5 Sealability inREL isundecidable.
Given this theorem we shall restrict our attention to more tractable subclasses of programs. Program P is
balanced (in REL)if, whenever r[c,d](cid:13)Pand allchannels areempty at(r,c), then everychannel contains
an equal number of sends and receives at (r,d). Note that balanced programs are TCC in RELFI. The
followingtheorem showsthatin REL balanceisanecessary prerequisite forbeingproperly sealable.
Theorem6 InREL,everynon-divergent programthatisproperlysealable isalsobalanced.
Proof: LetP and S beprograms such that in REL Pdoes not diverge and S properly seals P. Assume by
wayofcontradiction thatPisnotbalanced. Letr∈REL andc,c′,d besuchthatr[c,c′](cid:13)P,r[c′,d](cid:13)S,all
channels are empty in (r,c), and, w.l.o.g., chan contains k sends and m receives at (r,c′) where k6=m.
i→j
Since S is a proper seal, there is neither a send nor a receive event in r[c,c′] matched with an event not in
r[c,c′]. Since every receive event must be matched to some event by d it follows that k>m, that is, there
r
are more sends than receives on chan in r[c,c′]. No receive in the seal can be matched to any of those
i→j
sends. There exist r′ ∈ REL, y∈Varj, and d′ such that r′ is the same as r up to d (hence r′[c,d](cid:13)P∗S),
r′[d,d′](cid:13)RCVjj←i,andd r mapsthereceiveeventrj(dj)tooneofthesendeventsofPthatareunmatchedin
r. Thismatchcontradicts theassumption thatSproperly sealsP. (cid:4)
Program P is said to close chani→j (in REL)if chani→j is empty after P in any execution ofP starting at a
cut with empty channels. More formally this is expressed as follows. For all r∈REL, if r[c,d](cid:13)≀P then
chan is empty in (r,d). A channel that is not closed is open. The state of a program’s channels is the
i→j
essential elementindetermining sealability.
Program P is straight-line if it contains neither nondeterministic choices nor loops nor guards. In other
words, P isbuilt from sends, receives, and assignments using layering only. Ourfocus inthis section ison
balanced straight-line programs, orBSL forshort.
TheprogramgraphofaBSLPisagraph(V,E)thathasanodeforeverysendandreceiveeventinPplus
aninitialdummynode FSTi andafinaldummynode LSTi foreachprocessi. TheedgesetE consists ofthe
successor relation over events in the same process extended to the dummynodes plus an edge between the
k’th send and the k’th receive on channel chan , for all k, i, and j. All the graphs in Figures 2 and 3 are
i→j
program graphs. ThesizeofaBSLP’sprogram graphisoftheorderofthesizeoftheprogram.
Next weinvestigate the connection between program graphs and Lamport causality. Weuse E+ to refer
tothe irreflexive transitive closure ofE and call edges not containing dummynodes normal. Thesubset of
normaledges isdenoted byNE. In RELFI,thenormal edgesinduce thefullcausality relation ontheevents
oftheprogram. Asweshallshow,in REL thenormaledgesofaprogram grapharealso−→L edges.
Lemma7 Letr∈REL. LetPbeaBSLwithprogram graph(V,E). Ifr[c,d](cid:13)≀PthenNE ⊆−→L .
Proof: The only interesting normal edges are those between sends and receives of different processes.
Considertheedge(e1,e2)∈E betweenthek’thsendandthek’threceiveonchani→j. Letr∈REL suchthat
r[c,d](cid:13)≀Pandassumethate =d (e )istheℓ’thsendonchan inP. Weneedtoshowthate −→L e . By
3 r 2 i→j 1 2
definitionof−→L ,wehavethate −→L e . Ifℓ=kthene =e andwearedone. Ifℓ>kthene −→L e because
3 2 3 1 1 3
e isanearliereventofithane andtheclaimfollowsbytransitivityof−→L . Finally,supposethatℓ<k. This
1 3
caseisillustratedinFig.4. Considerthek−1receivesonchan thatprecedee . Theyareallmatchedinr
i→j 2
tosendsbyi. Sinceℓ<kande isalreadymatchedtoe ,oneofthesereceives,saye ,mustbematchedto
3 2 4
asendevente thatdoesnotprecedee . Sincee −→L e ande −→L e ,itfollowsthate −→L e ,asdesired. (cid:4)
5 1 5 4 4 2 1 2
10