Causing Communication Closure: Safe Program Composition with Non-FIFO Channels

Abstract

A semantic framework for analyzing safe composition of distributed programs is presented. Its applicability is illustrated by a study of program composition when communication is reliable but not necessarily FIFO. In this model, special care must be taken to ensure that messages do not accidentally overtake one another in the composed program. We show that barriers do not exist in this model. Indeed, no program that sends or receives messages can automatically be composed with arbitrary programs without jeopardizing their intended behavior. Safety of composition becomes context-sensitive and new tools are needed for ensuring it. A notion of sealing is defined, where if a program P is immediately followed by a program Q that seals P then P will be communication-closed-it will execute as if it runs in isolation. The investigation of sealing in this model reveals a novel connection between Lamport causality and safe composition. A characterization of sealable programs is given, as well as efficient algorithms for testing if Q seals P and for constructing a seal for a significant class of programs. It is shown that every sealable program that is open to interference on O(n 2 ) channels can be sealed using O(n) messages.

Safe Composition of Distributed Programs Communicating over Order-Preserving Imperfect Channels

“…Observe that the program P =  t i→ j * ¯t i→ j of our example properly seals itself in RDF. Lemma 3 of [4] also states that if P properly seals itself in RDF then P properly seals P ω in RDF. It follows that the infinite repetition of P solves the sequence transmission problem in RDF.…”

“…As we explained in detail in [4], the phase operator τ allows us to delineate the interactions that a layer can have with other parts of the program. When combined with refinement it is useful for defining CCL and related notions.…”

“…In [4] we defined a notion of sealing that formalizes the concept of a program S serving as an impermeable layer between P and later layers such that no later communication will interact with P. This notion is stronger than fitting after. We defined that S seals P in Γ if, for all programs Q,…”

“…Under what assumptions can we achieve safe composition of programs at a significantly reduced cost? In a previous work [4] we studied safe composition in the R model of communication, when channels are reliable and non-duplicating but may reorder messages. It was shown that safe composition can be achieved in R at a much smaller price than required by a data-link layer implementation, or by the use of global barriers.…”

“…We defined in [4] that a program Q seals a program P if the two do not communicate and furthermore no succeeding program R can communicate with P in any isolated execution of P * Q * R. (m) . In this paper we introduce and characterize two additional properties of interest in this context.…”