Algebraic Laws for Weak Consistency (Extended Version)

TL;DR

This paper introduces algebraic laws linking two formal models of weakly-consistent databases, enabling better reasoning about program robustness and correctness in distributed systems.

Contribution

It presents novel algebraic laws connecting abstract executions and dependency graphs, and establishes robustness criteria for programs on weakly-consistent databases.

Findings

Algebraic laws relate different specification styles.

Robustness criteria ensure program correctness.

Full abstraction connects models for certain consistency classes.

Abstract

Modern distributed systems often rely on so called weakly-consistent databases, which achieve scalability by sacrificing the consistency guarantee of distributed transaction processing. Such databases have been formalised in two different styles, one based on abstract executions and the other based on dependency graphs. The choice between these styles has been made according to intended applications: the former has been used to specify and verify the implementation of these databases, and the latter to prove properties of programs running on top of the databases. In this paper, we present a set of novel algebraic laws (i.e. inequations) that connect these two styles of specifications; the laws relate binary relations used in a specification based on abstract executions, to those used in a specification based on dependency graphs. We then show that this algebraic connection gives rise to so called robustness criteria, conditions which ensures that a program running on top of a weakly-consistent database does not exhibit anomalous behaviours due to this weak consistency. These criteria make it easy to reason about programs running on top of these databases, and may become a basis for dynamic or static program analyses. For a certain class of consistency models specifications, we prove a full abstraction result that connects the two styles of specifications.

Equations

$$\begin{array}[]{| lcl | l l l | }\hline\cr\text{Function}&&\text{Definition}\\ \hline\cr\rho_{\mathsf{Id}}(R)&$=$&\mathsf{Id}\\ \rho_{\mathsf{SI}}(R)&=&R\setminus\mathsf{Id}\\ \rho_{x}(R)&=&{[{\sf{Writes}}_{x}]}\\ \rho_{S}(R)&=&{[{{\tt SerTx}}]}\\ \hline\cr\text{Guarantee}&\lx@intercol\hfil\text{Associated Axiom}\hfil\lx@intercol\vrule\lx@intercol\\ \hline\cr(\rho_{\mathsf{Id}},\rho_{\mathsf{Id}})&\lx@intercol\hfil{\sf{AR}}\subseteq{\mathsf{VIS}}\lx@intercol\vrule\lx@intercol\\ (\rho_{\mathsf{Id}},\rho_{\mathsf{SI}})&\lx@intercol\hfil{\sf{AR}}\mathrel{;}{\mathsf{VIS}}\subseteq{\mathsf{VIS}}\lx@intercol\vrule\lx@intercol\\ (\rho_{x},\rho_{x})&\lx@intercol\hfil{[{\sf{Writes}}_{x}]}\mathrel{;}{\sf{AR}}\mathrel{;}{[{\sf{Writes}}_{x}]}\subseteq{\mathsf{VIS}}\lx@intercol\vrule\lx@intercol\\ (\rho_{S},\rho_{S})&\lx@intercol\hfil{[{{\tt SerTx}}]}\mathrel{;}{\sf{AR}}\mathrel{;}{[{{\tt SerTx}}]}\subseteq{\mathsf{VIS}}\lx@intercol\vrule\lx@intercol\\ \hline\cr\end{array}$$

$$\begin{array}[]{| l l l l | l l l l |}\hline\cr\vrule\lx@intercol\hfil{\textbf{(a)}}\;\text{Algebraic laws for sets of transactions}\hfil\lx@intercol\vrule\lx@intercol&\lx@intercol\hfil{\textbf{(c)}}\leavevmode\nobreak\ \text{Algebraic laws for abstract Executions}\hfil\lx@intercol\vrule\lx@intercol\\[5.0pt] {\textbf{(a.1)}}&{[\mathcal{T}^{\prime}]}\subseteq\mathsf{Id}&{\textbf{(a.2)}}&{[\mathcal{T}_{1}\cap\mathcal{T}_{2}]}={[\mathcal{T}_{1}]}\mathrel{;}{[\mathcal{T}_{2}]}&{\textbf{(c.1)}}&{\mathsf{WR}}(x)\subseteq{\mathsf{VIS}}&{\textbf{(c.2)}}&{\mathsf{WW}}(x)\subseteq{\sf{AR}}\\ {\textbf{(a.3)}}&\lx@intercol(R_{1}\mathrel{;}{[\mathcal{T}^{\prime}]})\cap R_{2}=(R_{1}\cap R_{2})\mathrel{;}{[\mathcal{T}^{\prime}]}\hfil\lx@intercol\vrule\lx@intercol&{\textbf{(c.3)}}&{\mathsf{RW}}(x)\subseteq\overline{{\mathsf{VIS}}^{-1}}&{\textbf{(c.4)}}&{\mathsf{VIS}}^{+}\subseteq{\mathsf{VIS}}\\ {\textbf{(a.4)}}&\lx@intercol({[\mathcal{T}^{\prime}]}\mathrel{;}R_{1})\cap R_{2}={[\mathcal{T}^{\prime}]}\mathrel{;}(R\cap R_{2})\hfil\lx@intercol\vrule\lx@intercol&{\textbf{(c.5)}}&{\sf{AR}}^{+}\subseteq{\sf{AR}}&{\textbf{(c.6)}}&{\mathsf{VIS}}\subseteq{\sf{AR}}\\ \cline{1-4}\cr\vrule\lx@intercol\hfil{\textbf{(b)}}\leavevmode\nobreak\ \text{Algebraic laws for (anti-)dependencies}\hfil\lx@intercol\vrule\lx@intercol&{\textbf{(c.7)}}&\lx@intercol{[{\sf{Writes}}_{x}]}\mathrel{;}{\mathsf{VIS}}\mathrel{;}{\mathsf{RW}}(x)\subseteq{\sf{AR}}\hfil\lx@intercol\vrule\lx@intercol\\[5.0pt] {\textbf{(b.1)}}&\lx@intercol{\mathsf{WR}}(x)\subseteq{[{\sf{Writes}}_{x}]}\mathrel{;}{\mathsf{WR}}(x)\mathrel{;}{[{\sf{Reads}}_{x}]}\hfil\lx@intercol\vrule\lx@intercol&{\textbf{(c.8)}}&\lx@intercol{\mathsf{VIS}}\mathrel{;}\overline{{\mathsf{VIS}}^{-1}}\subseteq\overline{{\mathsf{VIS}}^{-1}}\hfil\lx@intercol\vrule\lx@intercol\\ {\textbf{(b.2)}}&\lx@intercol{\mathsf{WW}}(x)\subseteq{[{\sf{Writes}}_{x}]}\mathrel{;}{\mathsf{WW}}(x)\mathrel{;}{[{\sf{Writes}}_{x}]}\hfil\lx@intercol\vrule\lx@intercol&{\textbf{(c.9)}}&\lx@intercol\overline{{\mathsf{VIS}}^{-1}}\mathrel{;}{\mathsf{VIS}}\subseteq\overline{{\mathsf{VIS}}^{-1}}\hfil\lx@intercol\vrule\lx@intercol\\ {\textbf{(b.3)}}&\lx@intercol{\mathsf{RW}}(x)\subseteq{[{\sf{Reads}}_{x}]}\mathrel{;}{\mathsf{RW}}(x)\mathrel{;}{[{\sf{Writes}}_{x}]}\hfil\lx@intercol\vrule\lx@intercol&{\textbf{(c.10)}}&\lx@intercol(\overline{{\mathsf{VIS}}^{-1}}\mathrel{;}{\mathsf{VIS}})\cap\mathsf{Id}\subseteq\emptyset\hfil\lx@intercol\vrule\lx@intercol\\ {\textbf{(b.4)}}&\lx@intercol{\mathsf{WR}}(x)\subseteq{\mathsf{WR}}(x)\setminus\mathsf{Id}\hfil\lx@intercol\vrule\lx@intercol&{\textbf{(c.11)}}&\lx@intercol({\mathsf{VIS}}\mathrel{;}\overline{{\mathsf{VIS}}^{-1}})\cap\mathsf{Id}\subseteq\emptyset\hfil\lx@intercol\vrule\lx@intercol\\ {\textbf{(b.5)}}&\lx@intercol{\mathsf{WW}}(x)\subseteq{\mathsf{WW}}(x)\setminus\mathsf{Id}\hfil\lx@intercol\vrule\lx@intercol&{\textbf{(c.12)}}&{\sf{AR}}\cap\mathsf{Id}\subseteq\emptyset&&\\ {\textbf{(b.6)}}&\lx@intercol{\mathsf{RW}}(x)\subseteq{\mathsf{RW}}(x)\setminus\mathsf{Id}\hfil\lx@intercol\vrule\lx@intercol&&&&\\ \hline\cr\vrule\lx@intercol\hfil{\textbf{(d)}}\leavevmode\nobreak\ \text{Algebraic laws induced by the consistency guarantee }(\rho,\pi)\hfil\lx@intercol\vrule\lx@intercol\\[5.0pt] {\textbf{(d.1)}}&\lx@intercol\rho({\mathsf{VIS}})\mathrel{;}{\sf{AR}}\mathrel{;}\pi({\mathsf{VIS}})\subseteq{\mathsf{VIS}}\hfil\lx@intercol&{\textbf{(d.2)}}&\lx@intercol(\pi({\mathsf{VIS}})\mathrel{;}\overline{{\mathsf{VIS}}^{-1}}\mathrel{;}\rho({\mathsf{VIS}}))\setminus\mathsf{Id}\subseteq{\sf{AR}}\hfil\lx@intercol\vrule\lx@intercol\\ {\textbf{(d.3)}}&\lx@intercol\hfil({\sf{AR}}\mathrel{;}\pi({\mathsf{VIS}})\mathrel{;}\overline{{\mathsf{VIS}}^{-1}})\cap\rho(\mathcal{T}\times\mathcal{T})^{-1}\subseteq\overline{{\mathsf{VIS}}^{-1}}\hfil\lx@intercol\vrule\lx@intercol\\ {\textbf{(d.4)}}&\lx@intercol\hfil(\overline{{\mathsf{VIS}}^{-1}}\mathrel{;}\rho({\mathsf{VIS}})\mathrel{;}{\sf{AR}})\cap\pi(\mathcal{T}\times\mathcal{T})^{-1}\subseteq\overline{{\mathsf{VIS}}^{-1}}\hfil\lx@intercol\vrule\lx@intercol\\ \hline\cr\end{array}$$

$${\mathsf{RW}}_{\mathcal{X}}\stackrel{\text{(b.6)}}{\subseteq }{\mathsf{RW}}_{\mathcal{X}}\setminus \mathsf{Id}\stackrel{\text{(c.3)}}{\subseteq }\overline{{\mathsf{VIS}}_{\mathcal{X}}^{-1}}\setminus \mathsf{Id}=({\rho }_{\mathsf{Id}}({\mathsf{VIS}}_{\mathcal{X}});\overline{{\mathsf{VIS}}_{\mathcal{X}}^{-1}};{\rho }_{\mathsf{Id}}({\mathsf{VIS}}_{\mathcal{X}}))\setminus \mathsf{Id}\stackrel{\text{(d.2)}}{\subseteq }{\mathsf{AR}}_{\mathcal{X}}$$

$$({\mathsf{WR}}_{\mathcal{X}}\cup {\mathsf{WW}}_{\mathcal{X}}\cup {\mathsf{RW}}_{\mathcal{X}})\stackrel{\text{(c.1,c.6)}}{\subseteq }({\mathsf{AR}}_{\mathcal{X}}\cup {\mathsf{WW}}_{\mathcal{X}}\cup {\mathsf{RW}}_{\mathcal{X}})\stackrel{\text{(c.2)}}{\subseteq }({\mathsf{AR}}_{\mathcal{X}}\cup {\mathsf{RW}}_{\mathcal{X}})\stackrel{\text{eqref}eq:RWinAR}{\subseteq }{\mathsf{AR}}_{\mathcal{X}}$$

$$({\mathsf{WR}}_{\mathcal{X}}\cup {\mathsf{WW}}_{\mathcal{X}}\cup {\mathsf{RW}}_{\mathcal{X}}{)}^{+}\cap \mathsf{Id}\stackrel{\text{eqref}eq:AllinAR}{\subseteq }{\mathsf{AR}}_{\mathcal{X}}^{+}\cap \mathsf{Id}\stackrel{\text{(c.5)}}{\subseteq }{\mathsf{AR}}_{\mathcal{X}}\cap \mathsf{Id}\stackrel{\text{(c.12)}}{\subseteq }\varnothing .$$

$${\mathsf{WR}}_{\mathcal{X}}^{\ast };{\mathsf{RW}}_{\mathcal{X}};{\mathsf{WR}}_{\mathcal{X}}^{\ast }\stackrel{\text{(c.1,c.4)}}{\subseteq }{\mathsf{VIS}}_{\mathcal{X}}?;{\mathsf{RW}}_{\mathcal{X}};{\mathsf{VIS}}_{\mathcal{X}}?\stackrel{\text{(b.6)}}{\subseteq }{\mathsf{VIS}}_{\mathcal{X}}?;({\mathsf{RW}}_{\mathcal{X}}\setminus \mathsf{Id});{\mathsf{VIS}}_{\mathcal{X}}?\stackrel{\text{(c.3)}}{\subseteq }$$

$${\mathsf{VIS}}_{\mathcal{X}}?;(\overline{{\mathsf{VIS}}_{\mathcal{X}}^{-1}}\setminus \mathsf{Id});{\mathsf{VIS}}_{\mathcal{X}}?\subseteq ((\overline{{\mathsf{VIS}}_{\mathcal{X}}^{-1}}\setminus \mathsf{Id})\cup ({\mathsf{VIS}}_{\mathcal{X}};\overline{{\mathsf{VIS}}_{\mathcal{X}}^{-1}}));{\mathsf{VIS}}_{\mathcal{X}}?\stackrel{\text{(c.11)}}{\subseteq }$$

$$((\overline{{\mathsf{VIS}}_{\mathcal{X}}^{-1}}\setminus \mathsf{Id})\cup ({\mathsf{VIS}}_{\mathcal{X}};\overline{{\mathsf{VIS}}_{\mathcal{X}}^{-1}})\setminus \mathsf{Id});{\mathsf{VIS}}_{\mathcal{X}}?\stackrel{\text{(c.8)}}{\subseteq }(\overline{{\mathsf{VIS}}_{\mathcal{X}}^{-1}}\setminus \mathsf{Id});{\mathsf{VIS}}_{\mathcal{X}}?\stackrel{\text{(c.10,c.9)}}{\subseteq }\overline{{\mathsf{VIS}}_{\mathcal{X}}^{-1}}\setminus \mathsf{Id}$$

$$[\mathtt{SerTx}];(\overline{{\mathsf{VIS}}_{\mathcal{X}}^{-1}}\setminus \mathsf{Id});[\mathtt{SerTx}]\stackrel{\text{(a.3,a.4)}}{=}([\mathtt{SerTx}];\overline{{\mathsf{VIS}}_{\mathcal{X}}^{-1}};[\mathtt{SerTx}])\setminus \mathsf{Id}=$$

$$({\rho }_S({\mathsf{VIS}}_{\mathcal{X}});\overline{{\mathsf{VIS}}_{\mathcal{X}}^{-1}};{\rho }_S({\mathsf{VIS}}_{\mathcal{X}}))\setminus \mathsf{Id}\stackrel{\text{(d.2)}}{\subseteq }{\mathsf{AR}}_{\mathcal{X}}$$

$$⊩{\mathsf{RW}}_{\mathcal{X}}\text{dashV}=[\mathtt{SerTx}];{\mathsf{WR}}_{\mathcal{X}}^{\ast };{\mathsf{RW}}_{\mathcal{X}};{\mathsf{WR}}_{\mathcal{X}}^{\ast };[\mathtt{SerTx}]\stackrel{(\text{ref}eq:VIS.RW.VIS,\text{ref}eq:FencedinAR)}{\subseteq }{\mathsf{AR}}_{\mathcal{X}}.$$

$$\mathsf{WR}\subseteq X_V$$

$$\rho (X_V);X_A;\pi (X_V)\subseteq X_V$$

$$\mathsf{WW}\subseteq X_A$$

$$X_A;X_A\subseteq X_A$$

$$\mathsf{RW}\subseteq X_N$$

$${\delta }_{\mathsf{PSI}}(\mathcal{G})=({\mathsf{WR}}_{\mathcal{G}}\cup {\mathsf{WW}}_{\mathcal{G}}{)}^{+}\cup \bigcup _{x\in \mathsf{Obj}}{\left([{\mathsf{Writes}}_x];({\mathsf{WR}}_{\mathcal{G}}\cup {\mathsf{WW}}_{\mathcal{G}}{)}^{\ast };{\mathsf{RW}}_{\mathcal{G}}(x)\right)}^{+}.$$

$${\mathsf{WW}}_{\mathcal{X}}(x)\stackrel{\text{(b.2)}}{=}[{\mathsf{Writes}}_x];{\mathsf{WW}}_{\mathcal{X}}(x);[{\mathsf{Writes}}_x]\stackrel{\text{(c.2)}}{\subseteq }[{\mathsf{Writes}}_x];{\mathsf{AR}}_{\mathcal{X}};[{\mathsf{Writes}}_x]\stackrel{\text{(d.1)}}{\subseteq }{\mathsf{VIS}}_{\mathcal{X}}.\text{qed}$$

$$\rho (R)\cup \rho (R^{\prime })=(\rho (\mathcal{T}\times \mathcal{T})\cap R?)\cup (\rho (\mathcal{T}\times \mathcal{T})\cap R^{\prime }?)=\rho (\mathcal{T}\times \mathcal{T})\cap (R?\cup R^{\prime }?)=$$

$$\rho (\mathcal{T}\times \mathcal{T})\cap (R\cup R^{\prime })?=\rho (R\cup R^{\prime })$$

$$\begin{gathered} [{\mathcal{T}}_1];[{\mathcal{T}}_2]=\{(T,S)\mid \exists V.(T,V)\in [{\mathcal{T}}_1]\wedge (V,S)\in [{\mathcal{T}}_2]\}= \\ \{(T,S)\mid \exists V.T\in {\mathcal{T}}_1\wedge V\in {\mathcal{T}}_1\wedge T=V\wedge S\in {\mathcal{T}}_2\wedge V\in {\mathcal{T}}_2\wedge V=S\}= \\ \{(T,S)\mid T\in {\mathcal{T}}_1\wedge S\in {\mathcal{T}}_1\wedge S=V\wedge S\in {\mathcal{T}}_2\wedge T\in {\mathcal{T}}_2\}= \\ \{(T,S)\mid T\in ({\mathcal{T}}_1\cap {\mathcal{T}}_2)\wedge S\in ({\mathcal{T}}_1\cap {\mathcal{T}}_2)\wedge (S=T)\}=[{\mathcal{T}}_1\cap {\mathcal{T}}_2] \end{gathered}$$

$$\begin{gathered} (R_1;[{\mathcal{T}}^{\prime }])\cap R_2=\{(T,S)\mid (\exists V.(T,V)\in R_1\wedge V\in {\mathcal{T}}^{\prime }\wedge V=S)\wedge (T,S)\in R_2\}= \\ \{(T,S)\mid (T,S)\in R_1\cap R_2\wedge S\in {\mathcal{T}}^{\prime }\}=(R_1\cap R_2);[{\mathcal{T}}^{\prime }] \end{gathered}$$

$$\begin{gathered} ([{\mathcal{T}}^{\prime }];R_1)\cap R_2=\{(T,S)\mid =(\exists V.T=V\wedge T\in {\mathcal{T}}^{\prime }\wedge (V,S)\in R_1)\wedge (T,S)\in R_2\}= \\ \{(T,S)\mid (T,S)\in R_1\cap R_2\wedge T\in {\mathcal{T}}^{\prime }\}=[{\mathcal{T}}^{\prime }];(R_1\cap R_2) \end{gathered}$$

$$\mathsf{WR}(x)=(\mathsf{WR}(x)\cap (\mathsf{Id}\cup \overline{\mathsf{Id}}))=(\mathsf{WR}(x)\cap \mathsf{Id})\cup \mathsf{WR}(x)\cap \overline{\mathsf{Id}}=$$

$$\varnothing \cup (\mathsf{WR}(x)\cap \overline{\mathsf{Id}})=\mathsf{WR}(x)\cap \overline{\mathsf{Id}}=\mathsf{WR}(x)\setminus \mathsf{Id}.$$

$$\begin{gathered} (R;\overline{R^{-1}})\cap \mathsf{Id}=\{(T,T)\mid \exists S.(T,S)\in R\wedge (S,T)\in \overline{R^{-1}}\}= \\ \{(T,T)\mid \exists S.(T,S)\in R\wedge (T,S)\notin R\}=\varnothing \end{gathered}$$

$$\mathsf{WR}=\bigcup _{x\in \mathsf{Obj}}\mathsf{WR}(x)\stackrel{\text{(c.1)}}{\subseteq }\bigcup _{x\in \mathsf{Obj}}\mathsf{VIS}=\mathsf{VIS}.$$

$$(R_1;R_2)\cap \mathsf{Id}\subseteq \varnothing ⟹(R_2;R_1)\cap \mathsf{Id}\subseteq \varnothing$$

$$[{\mathcal{T}}^{\prime }]=[{\mathcal{T}}^{\prime }];[{\mathcal{T}}^{\prime }].$$

$$(R\cap \mathsf{Id}=\varnothing )⟺(R\subseteq R\setminus \mathsf{Id}).$$

$$R=R\cap (\mathsf{Id}\cup \overline{\mathsf{Id}})=(R\cap \mathsf{Id})\cup (R\cap \overline{\mathsf{Id}})=\varnothing \cup (R\setminus \mathsf{Id})=(R\setminus \mathsf{Id}).$$

$$(R\cap \mathsf{Id})\subseteq (R\setminus \mathsf{Id})\cap \mathsf{Id}=(R\cap \overline{\mathsf{Id}})\cap \mathsf{Id}=R\cap (\overline{\mathsf{Id}}\cap \mathsf{Id})=R\cap \varnothing =\varnothing$$

$$\mathsf{AR}\cap \mathsf{Id}\stackrel{\text{(c.12)}}{\subseteq }\varnothing \stackrel{\text{eqref}eq:acycl.irrefl}{⟹}\left(\mathsf{AR}\subseteq (\mathsf{AR}\setminus \mathsf{Id})\right).$$

$$\mathsf{VIS}\stackrel{\text{(c.6,c.12)}}{\subseteq }\mathsf{VIS}\setminus \mathsf{Id}$$

$$(\mathsf{VIS};\overline{{\mathsf{VIS}}^{-1}})\stackrel{\text{(c.11)}}{\subseteq }(\mathsf{VIS};\overline{{\mathsf{VIS}}^{-1}})\setminus \mathsf{Id}$$

$$(\overline{{\mathsf{VIS}}^{-1}};\mathsf{VIS})\stackrel{\text{(c.10)}}{\subseteq }(\overline{{\mathsf{VIS}}^{-1}};\mathsf{VIS})\setminus \mathsf{Id}.$$

$$\mathsf{WW}(x)\subseteq \mathsf{VIS}.$$

$$\mathsf{WW}(x)\stackrel{\text{(b.2)}}{\subseteq }[{\mathsf{Writes}}_x];\mathsf{WW}(x);[{\mathsf{Writes}}_x]\stackrel{\text{(c.2)}}{\subseteq }[{\mathsf{Writes}}_x];\mathsf{AR};[{\mathsf{Writes}}_x]=$$

Full text

1. Introduction

Modern distributed systems often rely on databases that achieve scalability by weakening consistency guarantees of distributed transaction processing. These databases are said to implement weak consistency models. Such weakly consistent databases allow for faster transaction processing, but exhibit anomalous behaviours, which do not arise under a database with a strong consistency guarantee, such as serialisability. Two important problems for the weakly consistent databases are: (i) to find elegant formal specifications of their consistency models and to prove that these specifications are correctly implemented by protocols used in the databases; (ii) to develop effective reasoning techniques for applications running on top of such databases. These problems have been tackled by using two different formalisms, which model the run-time behaviours of weakly consistent databases differently.

When the goal is to verify the correctness of a protocol implementing a weak consistency model, the run-time behaviour of a distributed database is often described in terms of abstract executions [14], which abstract away low-level implementation details of the database (§2). An example of abstract execution is depicted in Figure 1; ignore the bold edges for the moment. It comprises four transactions, $T_{0}$, $T_{1}$, $T_{2}$, and $S$; transaction $T_{0}$ initializes the value of an object $\mathsf{acct}$ to [math]; transactions $T_{1}$ and $T_{2}$ increment the value of $\mathsf{acct}$ by $50$ and $25$, respectively, after reading its initial value; transaction $S$ reads the value of $\mathsf{acct}$. In this abstract execution, both the updates of $T_{1}$ and $T_{2}$ are VISible to transaction $S$, as witnessed by the two ${\mathsf{VIS}}$-labelled edges: $T_{1}\xrightarrow{{\mathsf{VIS}}}S$ and $T_{2}\xrightarrow{{\mathsf{VIS}}}S$.

On the other hand, the update of $T_{1}$ is not visible to $T_{2}$, and vice versa, as indicated by the absence of an edge labelled with ${\mathsf{VIS}}$ between these transactions. Intuitively, the absence of such an edge means that $T_{1}$ and $T_{2}$ are executed concurrently. Because $S$ sees $T_{1}$ and $T_{2}$, as indicated by ${\mathsf{VIS}}$-labelled edges from $T_{1}$ and $T_{2}$ to $S$, the result of reading the value of $\mathsf{acct}$ in $S$ must be one of the values written by $T_{1}$ and $T_{2}$. However, because these transactions are concurrent, there is a race, or conflict, between them. The ${\sf{AR}}$-labelled edge connecting $T_{1}$ to $T_{2}$, is used to ARbitrate the conflict: it states that the update of $T_{1}$ is older than the one of $T_{2}$, hence the query of $\mathsf{acct}$ in $S$ returns the value written by the latter.

The style of specifications of consistency models in terms of abstract executions can be given by imposing constraints over the relations ${\mathsf{VIS}},{\sf{AR}}$ (§2.1). A set of transactions $\mathcal{T}=\{T_{1},T_{2},\cdots\}$, called a history, is allowed by a consistency model specification if it is possible to exhibit two witness relations ${\mathsf{VIS}},{\sf{AR}}$ over $\mathcal{T}$ such that the resulting abstract execution satisfies the constraints imposed by the specification. For example, serialisability can be specified by requiring that the relation ${\mathsf{VIS}}$ should be a strict total order. The set of transactions $\{T_{0},T_{1},T_{2},S\}$ from Figure 1 is not serialisable: it is not possible to choose a relation ${\mathsf{VIS}}$ such that the resulting abstract execution relates the transactions $T_{1},T_{2}$ and the results of read operations are consistent with visible updates.

Specifications of consistency models using abstract executions have been used in the work on proving the correctness of protocols implementing weak consistency models, as well as on justifying operational, implementation-dependent descriptions of these models [16, 14, 12, 13].

The second formalism used to define weak consistency models is based on the notion of dependency graphs [2], and it has been used for proving properties of client programs running on top of a weakly consistent database. Dependency graphs capture the data dependencies of transactions at run-time (§3); the transactions $\{T_{0},T_{1},T_{2},S\}$ depicted above, together with the bold edges but without normal edges, constitute an example of dependency graph. The edge $T_{2}\xrightarrow{{\mathsf{WR}}(\mathsf{acct})}S$111For simplicity, references to the object $\mathsf{acct}$ have been removed from the dependencies of Figure 1. denotes a write-read dependency. It means that the read of $\mathsf{acct}$ in transaction $S$ returns the value written by transaction $T_{2}$, and the edges $T_{0}\xrightarrow{{\mathsf{WR}}(\mathsf{acct})}T_{1}$ and $T_{0}\xrightarrow{{\mathsf{WR}}(\mathsf{acct})}T_{2}$ mean something similar. The edge $T_{1}\xrightarrow{{\mathsf{WW}}(\mathsf{acct})}T_{2}$ denotes a write-write dependency, and says that the write to $\mathsf{acct}$ in $T_{2}$ supersedes the write to the same object in $T_{1}$. The remaining edges $T_{1}\xrightarrow{{\mathsf{RW}}(\mathsf{acct})}T_{2}$ and $T_{2}\xrightarrow{{\mathsf{RW}}(\mathsf{acct})}T_{1}$ express anti-dependencies. The former means that $T_{1}$ reads a value for object $\mathsf{acct}$ which is older than the value written by $T_{2}$.

When using dependency graphs, consistency models are specified as sets of transactions for which there exist ${\mathsf{WR}},{\mathsf{WW}},{\mathsf{RW}}$ relations that satisfy certain properties, usually stated as particular relations being acyclic [17, 8]; for example, serialisability can be specified by requiring that dependency graphs are acyclic. Because dependencies of transactions can be over-approximated at the compilation time, specifications of consistency models in terms of dependency graphs have been widely used for manually or automatically reasoning about properties of client programs of weakly consistent databases [19, 27]. They have also been used in the complexity and undecidability results for verifying implementations of consistency models [10].

Our ultimate aim is to reveal a deep connection between these two styles of specifying weak consistency models, which was hinted at for specific consistent models in the literature. Such a connection would, for instance, give us a systematic way to derive a specification of a weak consistency model based on dependency graphs from the specification based on abstract executions, while ensuring that the original and the derived specifications are equivalent in a sense. In doing so, it would enable us to prove properties about client programs of a weakly consistent database using techniques based on dependency graphs [17, 18, 10] even when the consistency model of the database is specified in terms of abstract executions.

In this paper, we present our first step towards this ultimate aim. First, we observe that each abstract execution determines an underlying dependency graph. Then we study the connection between these two structures at an algebraic level. We propose a set of algebraic laws, parametric in the specification of a consistency model to which the original abstract execution belongs (§4). These laws can be used to derive properties of the form $R_{\mathsf{G}}\subseteq R_{\mathsf{A}}$: here $R_{\mathsf{G}}$ is an expression from the Kleene Algebra with Tests [23] whose ground terms are run-time dependencies of transactions, and tests are properties over transactions. The relation $R_{\mathsf{A}}$ is one of the fundamental relations of abstract executions: ${\mathsf{VIS}}$, ${\sf{AR}}$, or a novel relation $\overline{{\mathsf{VIS}}^{-1}}$ that we call anti-visibility, defined as $\overline{{\mathsf{VIS}}^{-1}}=\{(T,S)\mid\neg(S\xrightarrow{{\mathsf{VIS}}}T)\}$. Some of the algebraic laws that we propose show that there is a direct connection between each kind of dependencies and the relations of abstract executions: ${\mathsf{WR}}\subseteq{\mathsf{VIS}},{\mathsf{WW}}\subseteq{\sf{AR}}$, and ${\mathsf{RW}}\subseteq\overline{{\mathsf{VIS}}^{-1}}$. The other laws capture the connection between the relations of abstract executions ${\mathsf{VIS}},{\sf{AR}}$, and $\overline{{\mathsf{VIS}}^{-1}}$. The exact nature of this connection depends on the specification of the consistency model of the considered abstract execution.

We are particularly interested in deriving properties of the form $R_{\mathsf{G}}\subseteq{\sf{AR}}$. Properties of this form give rise to so called robustness criteria for client programs, conditions ensuring that a program only exhibits serialisable behaviours even when it runs under a weak consistency model [19, 8, 11]. Because ${\sf{AR}}$ is a total order, this implies that $R_{\mathsf{G}}$ must be acyclic, hence all cycles must be in the complement of $R_{\mathsf{G}}$. We can then check for the absence of such critical cycles at compile time: because dependency graphs of serialisable databases are always acyclic, this ensures that said application only exhibits serialisable behaviours.

As another contribution we show that, for a relevant class of consistency models, our algebraic laws can be used to derive properties which are not only necessary, but also sufficient, for dependency graphs in such models (§5).

2. Abstract Executions

We consider a database storing objects in $\mathsf{Obj}=\{x,y,\cdots\}$, which for simplicity we assume to be integer-valued. Client programs can interact with the database by executing operations from a set $\mathsf{Op}$, grouped inside transactions. We leave the set $\mathsf{Op}$ unspecified, apart from requiring that it contains read and write operations over objects: $\{{{\tt write}}(x,n),{{\tt read}}(x,n)\mid x\in\mathsf{Obj},n\in\mathbb{N}\}\subseteq\mathsf{Op}$.

Histories. To specify a consistency model, we first define the set of all client-database interactions allowed by the model. We start by introducing (run-time) transactions and histories, which record such interactions in a single computation. Transactions are elements from a set $\mathbb{T}=\{T,S,\cdots\}$; the operations executed by transactions are given by a function $\mathsf{behav}:\mathbb{T}\rightarrow 2^{\mathsf{Op}}$, which maps a transaction $T$ to a set of operations that are performed by the transaction and can be observed by other transactions. We often abuse notations and just write $o\in T$ (or $T\ni o$) instead of $o\in\mathsf{behav}(T)$. We adopt similar conventions for $\mathcal{O}\subseteq\mathsf{behav}(T)$ and $\mathcal{O}=\mathsf{behav}(T)$ where $\mathcal{O}$ is a subset of operations.

We assume that transactions enjoy atomic visibility : for each object $x$, (i) a transaction $S$ never observes two different writes to $x$ from a single transaction $T$ and (ii) it never reads two different values of $x$. Formally, the requirements are that if $T\ni({{\tt write}}\;x:n)$ and $T\ni({{\tt write}}\;x:m)$, or $T\ni({{\tt read}}\;x:n)$ and $T\ni({{\tt read}}\;x:m)$, then $n=m$. Our treatment of atomic visibility is taken from our previous work on transactional consistency models [16]. Atomic visibility is guaranteed by many consistency models [6, 28, 19]. We point out that although we focus on transactions in distributed systems in the paper, our results apply to weak shared-memory models [5]; there a transaction $T$ is the singleton set of a read operation ($T=\{{{\tt read}}\;x:n\}$), that of a write operation ($T=\{{{\tt write}}\;x:n\}$), or the set of read and write representing a compare and set operation ($T=\{{{\tt read}}\;x:n,\;{{\tt write}}\;x:m\}$).

For each object $x$, we let ${\sf{Writes}}_{x}:=\{T\mid\exists n.\;({{\tt write}}\;x:n)\in T\}$ and ${\sf{Reads}}_{x}:=\{T\mid\exists n,\;({{\tt read}}\;x:n)\in\mathcal{T}\}$ be the sets of transactions that write to and read from $x$, respectively.

Definition 2.1**.**

A history $\mathcal{T}$ is a finite set of transactions $\{T_{1},T_{2},\cdots,T_{n}\}$.

Consistency Models. A consistency model $\Gamma$ is a set of histories that may arise when client programs interact with the database. To define $\Gamma$ formally, we augment histories with two relations, called visibility and arbitration.

Definition 2.2**.**

An abstract execution $\mathcal{X}$ is a tuple $(\mathcal{T},{\mathsf{VIS}},{\sf{AR}})$ where $\mathcal{T}$ is a history and ${\mathsf{VIS}},{\sf{AR}}\subseteq(\mathcal{T}\times\mathcal{T})$ are relations on transactions such that ${\mathsf{VIS}}\subseteq{\sf{AR}}$ and ${\sf{AR}}$ is a strict total order222A relation $R\subseteq\mathcal{T}\times\mathcal{T}$ is a strict (partial) order if it is transitive and irreflexive; it is total if for any $T,S\in\mathcal{T}$, either $T=S$, $(T,S)\in R$ or $(S,T)\in R$..

We often write $T\xrightarrow{{\mathsf{VIS}}}S$ for $(T,S)\in{\mathsf{VIS}}$, and similarly for other relations. For each abstract execution $\mathcal{X}=(\mathcal{T},{\mathsf{VIS}},{\sf{AR}})$, we let $\mathcal{T}_{\mathcal{X}}:=\mathcal{T}$, ${\mathsf{VIS}}_{\mathcal{X}}:={\mathsf{VIS}}$, and ${\sf{AR}}_{\mathcal{X}}:={\sf{AR}}$.

In an abstract execution $\mathcal{X}$, $T\xrightarrow{{\mathsf{VIS}}_{\mathcal{X}}}S$ means that the read operations in $S$ may depend on the updates of $T$, while $T\xrightarrow{{\sf{AR}}_{\mathcal{X}}}S$ means that the update operations of $S$ supersede those performed by $T$. Naturally, one would expect that the value fetched by read operations in a transaction $T$ is the most up-to-date one among all the values written by transactions visible to $T$. For simplicity, we assume that such a transaction always exists.

Definition 2.3**.**

An abstract execution $\mathcal{X}=(\mathcal{T},{\mathsf{VIS}},{\sf{AR}})$ respects the Last Write Win (LWW) policy, if for all $T\in\mathcal{T}$ such that $T\ni({{\tt read}}\;x:n)$, the set $\mathcal{T}^{\prime}:=\left({\mathsf{VIS}}^{-1}(T)\cap{\sf{Writes}}_{x}\right)$ is not empty, and $\max_{{\sf{AR}}}(\mathcal{T}^{\prime})\ni({{\tt write}}\;x:n)$, where $\max_{{\sf{AR}}}(\mathcal{T}^{\prime})$ is the ${\sf{AR}}$-supremum of $\mathcal{T}^{\prime}$.

Definition 2.4**.**

An abstract execution $\mathcal{X}=(\mathcal{T},{\mathsf{VIS}},{\sf{AR}})$ respects causality if ${\mathsf{VIS}}$ is transitive. Any abstract execution that respects both causality and the LWW policy is said to be valid.

We always assume an abstract execution to be valid, unless otherwise stated. Causality is respected by all abstract executions allowed by several interesting consistency models. They also simplify the mathematical development of our results. In (§B), we explain how our results can be generalised for consistency models that do not respect causality. We also discuss how the model can be generalised to account for sessions and session guarantees [29].

We can specify a consistency model using abstract executions in two steps. First, we identify properties on abstract executions, or axioms, that formally express an informal consistency guarantee, and form a set with the abstract executions satisfying the properties. Next, we project abstract executions in this set to underlying histories, and define a consistency model $\Gamma$ to be the set of resulting histories.

Abstract executions hide low-level operational details of the interaction between client programs and weakly consistent databases. This benefit has been exploited for proving that such databases implement intended consistency models [14, 20, 12, 13, 16].

2.1. Specification of Weak Consistency Models

In this section we introduce a simple framework for specifying consistency models using the style of specification discussed above. In our framework, axioms of consistency models relate the visibility and arbitration relations via inequalities of the form $R_{1}\mathrel{;}{\sf{AR}}_{\mathcal{X}}\mathrel{;}R_{2}\subseteq{\mathsf{VIS}}_{\mathcal{X}}$, where $R_{1}$ and $R_{2}$ are particular relations over transactions, and $\mathcal{X}$ is an abstract execution. As we will explain later, axioms of this form establish a necessary condition for two transactions in an abstract execution $\mathcal{X}$ to be related by ${\mathsf{VIS}}_{\mathcal{X}}$, i.e. they cannot be executed concurrently. Despite its simplicity, the framework is expressive enough to capture several consistency models for distributed databases [16, 24]; as we will show in §4, one of the benefits of this simplicity is that we can infer robustness criteria of consistency models in a systematic way.

As we will see, the relations $R_{1},R_{2}$ in axioms of the form above, may depend on the visibility relation of the abstract execution $\mathcal{X}$. To define such relations, we introduce the notion of specification function.

Definition 2.5**.**

A function $\rho:2^{(\mathbb{T}\times\mathbb{T})}\rightarrow 2^{(\mathbb{T}\times\mathbb{T})}$ is a specification function if for every history $\mathcal{T}$ and relation $R\subseteq\mathcal{T}\times\mathcal{T}$, then $\rho(R)=\rho(\mathcal{T}\times\mathcal{T})\cap R?$. Here $R?$ is the reflexive closure of $R$. A consistency guarantee, or simply guarantee, is a pair of specification functions $(\rho,\pi)$.

Definition 2.5 ensures that specification functions are defined locally: for any $R_{1},R_{2}\subseteq\mathcal{T}\times\mathcal{T}$, $\rho(R_{1}\cup R_{2})=\rho(R_{1})\cup\rho(R_{2})$, and in particular for any $R\subseteq\mathcal{T}\times\mathcal{T}$, $\rho(R)=\left(\bigcup_{T,S\in\mathcal{T}}\rho(\{(T,S)\})\right)\cap R?$. The reflexive closure in Definition 2.5 is needed because we will always apply specification functions to irreflexive relations (namely, the visibility relation of abstract executions), although the result of this application need not be irreflexive. For example, $\rho_{\mathsf{Id}}(R):=\mathsf{Id}$, where $\mathsf{Id}$ is the identity function, is a valid specification function.

Each consistency guarantee $(\rho,\pi)$ defines, for each abstract execution $\mathcal{X}$, an axiom of the form $\rho({\mathsf{VIS}}_{\mathcal{X}})\mathrel{;}{\sf{AR}}_{\mathcal{X}}\mathrel{;}\pi({\mathsf{VIS}}_{\mathcal{X}})\subseteq{\mathsf{VIS}}_{\mathcal{X}}$: if this axiom is satisfied by $\mathcal{X}$, we say that $\mathcal{X}$ satisfies the consistency guarantee $(\rho,\pi)$. Consistency guarantees impose a condition on when two transactions $T,S$ in an abstract execution $\mathcal{X}$ are not allowed to execute concurrently, i.e. they must be related by a ${\mathsf{VIS}}_{\mathcal{X}}$ edge. By definition, in abstract executions visibility edges cannot contradict arbitration edges, hence it is only natural that the order in which the transactions $T,S$ above are executed is determined by the arbitration order: in fact, the definition of specification function ensures that $\rho({\mathsf{VIS}}_{\mathcal{X}})\subseteq{\mathsf{VIS}}_{\mathcal{X}}?$ and $\pi({\mathsf{VIS}}_{\mathcal{X}})\subseteq{\mathsf{VIS}}_{\mathcal{X}}?$, so that $(\rho({\mathsf{VIS}}_{\mathcal{X}})\mathrel{;}{\sf{AR}}_{\mathcal{X}}\mathrel{;}\pi({\mathsf{VIS}}_{\mathcal{X}}))\subseteq{\sf{AR}}_{\mathcal{X}}$ for all abstract executions $\mathcal{X}$.

Definition 2.6**.**

A consistency model specification $\Sigma$ or x-specification is a set of consistency guarantees $\{(\rho_{i},\pi_{i})\}_{i\in I}$ for some index set $I$.

We define ${\mathsf{Executions}}(\Sigma)$ to be the set of valid abstract executions that satisfy all the consistency guarantees of $\Sigma$. We let $\mathsf{modelOf}(\Sigma):=\{\mathcal{T}_{\mathcal{X}}\mid\mathcal{X}\in{\mathsf{Executions}}(\Sigma)\}$.

Examples of Consistency Model Specifications. Figure 2 shows several examples of specification functions and consistency guarantees. In the figure we use the relations ${[\mathcal{T}]}:=\{(T,T)\mid T\in\mathcal{T}\}$ and ${[o]}:=\{(T,T)\mid T\ni o\}$ for $\mathcal{T}\subseteq\mathbb{T}$ and $o\in\mathsf{Op}$. The guarantees in the figure can be composed together to specify, among others, several of the consistency models considered in [16]: we give some examples of them below. Each of these consistency models allows different kinds of anomalies:

due to lack of space, these are illustrated in (§A).

**Causal Consistency [25]: ** This is the weakest consistency model we consider. It is specified by $\Sigma_{\mathsf{CC}}=\emptyset$. In this case, all abstract executions in ${\mathsf{Executions}}(\Sigma_{\mathsf{CC}})$ respect causality. The execution in Figure 1 is an example in ${\mathsf{Executions}}(\Sigma_{\mathsf{CC}})$.

Red-Blue Consistency [24]: This model extends causal consistency by marking a subset of transactions as serialisable, and ensuring that no two such transactions appear to execute concurrently. We model red-blue consistency via the x-specification $\Sigma_{{\mathsf{RB}}}=\{(\rho_{S},\rho_{S})\}$. In the definition of $\rho_{S}$, an element ${{\tt SerTx}}\in\mathsf{Op}$ is used to mark transactions as serialisable, and the specification requires that in every execution $\mathcal{X}\in{\mathsf{Executions}}(\Sigma_{{\mathsf{RB}}})$, any two transactions $T,S\ni{{\tt SerTx}}$ in $\mathcal{X}$ be compared by ${\mathsf{VIS}}_{\mathcal{X}}$. The abstract execution from Figure 1 is included in ${\mathsf{Executions}}(\Sigma_{{\mathsf{RB}}})$, but if it were modified so that transactions $T_{1},T_{2}$ were marked as serialisable, then the result would not belong to ${\mathsf{Executions}}(\Sigma_{{\mathsf{RB}}})$.

**Parallel Snapshot Isolation (PSI) [28, 26]: ** This model strengthens causal consistency by enforcing the Write Conflict Detection property: transactions writing to one same object do not execute concurrently. We let $\Sigma_{{\mathsf{PSI}}}=\{(\rho_{x},\rho_{x})\}_{x\in\mathsf{Obj}}$: every execution $\mathcal{X}\in{\mathsf{Executions}}(\Sigma_{{\mathsf{PSI}}})$ satisfies the inequality $({[{\sf{Writes}}_{x}]}\mathrel{;}{\sf{AR}}_{\mathcal{X}}\mathrel{;}{[{\sf{Writes}}_{x}]})\subseteq{\mathsf{VIS}}_{\mathcal{X}}$, for all $x\in\mathsf{Obj}$.

**Snapshot Isolation (SI) [7]: ** This consistency model strengthens PSI by requiring that, in executions, the set of transactions visible to any transaction $T$ is a prefix of the arbitration relation. Formally, we let $\Sigma_{\mathsf{SI}}=\Sigma_{{\mathsf{PSI}}}\cup\{(\rho_{\mathsf{Id}},\rho_{\mathsf{SI}})\}$. The consistency guarantee $(\rho_{\mathsf{Id}},\rho_{\mathsf{SI}})$ ensures that any abstract execution $\mathcal{X}\in{\mathsf{Executions}}(\mathsf{SI})$ satisfies the property $({\sf{AR}}_{\mathcal{X}}\mathrel{;}{\mathsf{VIS}}_{\mathcal{X}})\subseteq{\mathsf{VIS}}_{\mathcal{X}}$333To be precise, the property induced by the guarantee $(\rho_{\mathsf{Id}},\rho_{\mathsf{SI}})$ is $({\sf{AR}}_{\mathcal{X}}\mathrel{;}({\mathsf{VIS}}_{\mathcal{X}}\setminus\mathsf{Id}))\subseteq{\sf{AR}}_{\mathcal{X}}$. However, since ${\mathsf{VIS}}_{\mathcal{X}}$ is an irreflexive relation, ${\mathsf{VIS}}_{\mathcal{X}}\setminus\mathsf{Id}={\mathsf{VIS}}_{\mathcal{X}}$. Also, note that $\rho(R)=R$ is not a specification function, so we cannot replace the guarantee $(\rho_{\mathsf{Id}},\rho_{\mathsf{SI}})$ with $(\rho_{\mathsf{Id}},\rho)$..

Similarly to what we did to specify Red-Blue consistency, we can strengthen SI by allowing the possibility to mark transactions as serialisable. The resulting x-specification is $\Sigma_{\mathsf{SI}+\mathsf{SER}}=\Sigma_{\mathsf{SI}}\cup\{(\rho_{S},\rho_{S})\}$. This x-specification captures a fragment of Microsoft SQL server, which allows the user to select the consistency model at which a transaction should run [1].

**Serialisability: ** Executions in this consistency model require the visibility relation to be total. This can be formalised via the x-specification $\Sigma_{\mathsf{SER}}:=\{(\rho_{\mathsf{Id}},\rho_{\mathsf{Id}})\}$. Any $\mathcal{X}\in{\mathsf{Executions}}(\Sigma_{\mathsf{SER}})$ is such that ${\sf{AR}}_{\mathcal{X}}\subseteq{\mathsf{VIS}}_{\mathcal{X}}$, thus enforcing ${\mathsf{VIS}}_{\mathcal{X}}$ to be a strict total order.

3. Dependency Graphs

We present another style of specification for consistency models based on dependency graphs, introduced in [2]. These are structures that capture the data-dependencies between transactions accessing one same object. Such dependencies can be over approximated at compilation time. For this reason, they have found use in static analysis [19, 17, 18, 8] for programs running under a weak consistency model.

Definition 3.1**.**

A dependency graph is a tuple $\mathcal{G}=(\mathcal{T},{\mathsf{WR}},{\mathsf{WW}},{\mathsf{RW}})$, where $\mathcal{T}$ is a history and

1. (1)

${\mathsf{WR}}:\mathsf{Obj}\rightarrow 2^{\mathcal{T}\times\mathcal{T}}$* is such that:*

1. (a)

$\forall T,S\in\mathcal{T}.\,\forall x.\,T\xrightarrow{{\mathsf{WR}}(x)}S\implies{}T\neq S\wedge\exists n.\,(T\ni{{\tt write}}\;x:n)\wedge(S\ni{{\tt read}}\;x:n)$, 2. (b)

$\forall S\in\mathcal{T}.\,\forall x.\,(S\ni{{\tt read}}\;x:n)\implies\exists T.\,T\xrightarrow{{\mathsf{WR}}(x)}S$, 3. (c)

$\forall T,T^{\prime},S\in\mathcal{T}.\,\forall x.\,(T\xrightarrow{{\mathsf{WR}}(x)}S\wedge T^{\prime}\xrightarrow{{\mathsf{WR}}(x)}S)\implies T=T^{\prime}$; 2. (2)

${\mathsf{WW}}:\mathsf{Obj}\rightarrow 2^{\mathcal{T}\times\mathcal{T}}$* is such that for every $x\in\mathsf{Obj}$, ${\mathsf{WW}}(x)$ is a strict, total order over ${\sf{Writes}}_{x}$;* 3. (3)

${\mathsf{RW}}:\mathsf{Obj}\rightarrow 2^{\mathcal{T}\times\mathcal{T}}$* is such that $S\xrightarrow{{\mathsf{RW}}(x)}T$ iff $S\neq T$ and $\exists T^{\prime}.\;T^{\prime}\xrightarrow{{\mathsf{WR}}(x)}S\wedge T^{\prime}\xrightarrow{{\mathsf{WW}}(x)}T$.*

Given a dependency graph $\mathcal{G}=(\mathcal{T},{\mathsf{WR}},{\mathsf{WW}},{\mathsf{RW}})$, we let $\mathcal{T}_{\mathcal{G}}:=\mathcal{T}$, ${\mathsf{WR}}_{\mathcal{G}}:={\mathsf{WR}}$, ${\mathsf{WW}}_{\mathcal{G}}:={\mathsf{WW}}$, ${\mathsf{RW}}_{\mathcal{G}}:={\mathsf{RW}}$. The set of all dependency graphs is denoted as $\mathsf{Graphs}$. Sometimes, we commit an abuse of notation and use the symbol ${\mathsf{WR}}$ to denote the relation $\bigcup_{x\in\mathsf{Obj}}{\mathsf{WR}}(x)$, and similarly for ${\mathsf{WW}}$ and ${\mathsf{RW}}$. The actual meaning of ${\mathsf{WR}}$ will always be clear from the context.

Let $\mathcal{G}\in\mathsf{Graphs}$. The write-read dependency $T\xrightarrow{{\mathsf{WR}}_{\mathcal{G}}(x)}S$ means that $S$ reads the value of object $x$ that has been written by $T$. By Definition 3.1, for any transaction $S\in{\sf{Reads}}_{x}$ there exists exactly one transaction $T$ such that $T\xrightarrow{{\mathsf{WR}}_{\mathcal{G}}(x)}S$. The relation ${\mathsf{WW}}_{\mathcal{G}}(x)$ establishes a total order in which updates over object $x$ are executed by transactions; its elements are called write-write dependencies. Edges in the relation ${\mathsf{RW}}_{\mathcal{G}}(x)$ take the name of anti-dependencies. $T\xrightarrow{{\mathsf{RW}}_{\mathcal{G}}(x)}S$ means that transaction $T$ fetches some value for object $x$, but this is later updated by $S$. Given an abstract execution $\mathcal{X}$, we can extract a dependency graph $\mathsf{graph}(\mathcal{X})$ such that $\mathcal{T}_{\mathsf{graph}(\mathcal{X})}=\mathcal{T}_{\mathcal{X}}$.

Definition 3.2**.**

Let $\mathcal{X}=(\mathcal{T},{\mathsf{VIS}},{\sf{AR}})$ be an execution. For $x\in\mathsf{Obj}$, we define $\mathsf{graph}(\mathcal{X})=(\mathcal{T},{\mathsf{WR}}_{\mathcal{X}},{\mathsf{WW}}_{\mathcal{X}},{\mathsf{RW}}_{\mathcal{X}})$, where:

1. (1)

$T\xrightarrow{{\mathsf{WR}}_{\mathcal{X}}(x)}S\iff{(S\ni{{\tt read}}\;x:\_)}\wedge{T=\max_{{\sf{AR}}}({\mathsf{VIS}}^{-1}(S)\cap{\sf{Writes}}_{x})};$** 2. (2)

$T\xrightarrow{{\mathsf{WW}}_{\mathcal{X}}(x)}S\iff T\xrightarrow{{\sf{AR}}}S\wedge T,S\in{\sf{Writes}}_{x};$** 3. (3)

$T\xrightarrow{{\mathsf{RW}}_{\mathcal{X}}(x)}S\iff S\neq T\wedge(\exists T^{\prime}.\,T^{\prime}\xrightarrow{{\mathsf{WR}}_{\mathcal{X}}(x)}T\wedge T^{\prime}\xrightarrow{{\mathsf{WW}}_{\mathcal{X}}(x)}S)).$**

Proposition 3.3**.**

For any valid abstract execution $\mathcal{X}$, $\mathsf{graph}(\mathcal{X})$ is a dependency graph.

Specification of Consistency Models using Dependency Graphs. We interpret a dependency graph $\mathcal{G}$ as a labelled graph whose vertices are transactions in $\mathcal{T}_{x}$, and whose edges are pairs of the form $T\xrightarrow{R}S$, where $R\in\{{\mathsf{WR}}_{\mathcal{G}}(x),{\mathsf{WW}}_{\mathcal{G}}(x)_{\mathcal{G}},{\mathsf{RW}}_{\mathcal{G}}(x)\mid x\in\mathsf{Obj}\}$. To specify a consistency model, we employ a two-steps approach. We first identify one or more conditions to be satisfied by dependency graphs. Such conditions require cycles of a certain form not to appear in a dependency graph. Then we define a consistency model by projecting the set of dependency graphs satisfying the imposed conditions into the underlying histories. This style of specification is reminiscent of the one used in the CAT [5] language for formalising weak memory models. In the following we treat the relations ${\mathsf{WR}}_{\mathcal{G}}(x),{\mathsf{WW}}_{\mathcal{G}}(x),{\mathsf{RW}}_{\mathcal{G}}(x)$ both as set-theoretic relations, and as edges of a labelled graph.

Definition 3.4**.**

A dependency graph based specification, or simply g-specification, is a set $\Delta=\{\delta_{1},\cdots,\delta_{n}\}$, where for each $i\in\{1,\cdots,n\}$, $\delta_{i}$ is a function of type $\mathsf{Graphs}\rightarrow 2^{(\mathbb{T}\times\mathbb{T})}$ and satisfies $\delta_{i}(\mathcal{G})\subseteq({\mathsf{WR}}_{\mathcal{G}}\cup{\mathsf{WW}}_{\mathcal{G}}\cup{\mathsf{RW}}_{\mathcal{G}})^{\ast}$ for every $\mathcal{G}\in\mathsf{Graphs}$.

Given a g-specification $\Delta$, we define $\mathsf{Graphs}(\Delta)=\{\mathcal{G}\in\mathsf{Graphs}\mid\forall\delta\in\Delta.\,\delta(\mathcal{G})\cap\mathsf{Id}=\emptyset\}$, and we let $\mathsf{modelOf}(\Delta)=\{\mathcal{T}\mid\exists{\mathsf{WR}},{\mathsf{WW}},{\mathsf{RW}}.\,(\mathcal{T},{\mathsf{WR}},{\mathsf{WW}},{\mathsf{RW}})\in\mathsf{Graphs}(\Delta)\}$.

The requirement imposed over the functions $\delta_{1},\cdots,\delta_{n}$ ensures that, whenever $(T,S)\in\delta_{i}(\mathcal{G})$, for some dependency graph $\mathcal{G}$, then there exists a path in $\mathcal{G}$, that connects $T$ to $S$. For $\Delta=\{\delta_{i}\}_{i=1}^{n}$ and $\mathcal{G}\in\mathsf{Graphs}$, the requirement that $\delta_{i}(\mathcal{G})\cap\mathsf{Id}=\emptyset$ means that $\mathcal{G}$ does not contain any cycle $T_{0}\xrightarrow{R_{0}}T_{1}\xrightarrow{R_{1}}\cdots\xrightarrow{R_{n-1}}T_{n},$ such that $T_{0}=T_{n}$, and $(R_{0}\mathrel{;}\cdots\mathrel{;}R_{n-1})\subseteq\delta_{i}(\mathcal{G})$.

Examples of g-specifications of consistency models. Below we give some examples of $g$-specifications for the consistency models presented in §2.

Theorem 3.5**.**

1. (1)

An execution $\mathcal{X}$ is serialisable iff $\mathsf{graph}(\mathcal{X})$ does not contain any cycle. That is, $\mathsf{modelOf}(\Sigma_{\mathsf{SER}})=\mathsf{modelOf}(\{\delta_{\mathsf{SER}}\})$, where $\delta_{\mathsf{SER}}(\mathcal{G})=({\mathsf{WR}}_{\mathcal{G}}\cup{\mathsf{WW}}_{\mathcal{G}}\cup{\mathsf{RW}}_{\mathcal{G}})^{+}$. 2. (2)

An execution $\mathcal{X}$ is allowed by snapshot isolation iff $\mathsf{graph}(\mathcal{X})$ only admits cycles with at least two consecutive anti-dependency edge. That is, $\mathsf{modelOf}(\Sigma_{\mathsf{SI}})=\mathsf{modelOf}(\{\delta_{\mathsf{SI}}\})$, where $\delta_{\mathsf{SI}}(\mathcal{G})=(({\mathsf{WR}}_{\mathcal{G}}\cup{\mathsf{WW}}_{\mathcal{G}})\mathrel{;}{\mathsf{RW}}_{\mathcal{G}}?)^{+}$. 3. (3)

An execution $\mathcal{X}$ is allowed by parallel snapshot isolation iff $\mathsf{graph}(\mathcal{X})$ has no cycle where all anti-dependency edges are over the same object. Let $\delta_{{\mathsf{PSI}}_{0}}(\mathcal{G})=({\mathsf{WR}}_{\mathcal{G}}\cup{\mathsf{WW}}_{\mathcal{G}})^{+}$, $\delta_{{\mathsf{PSI}}(x)}(\mathcal{G})=(\bigcup_{x\in\mathsf{Obj}}({\mathsf{WR}}_{\mathcal{G}}\cup{\mathsf{WW}}_{\mathcal{G}})^{\ast}\mathrel{;}{\mathsf{RW}}_{\mathcal{G}}(x))^{+}$, and define $\Delta_{{\mathsf{PSI}}}=\{\delta_{{\mathsf{PSI}}_{0}}\}\cup\{\delta_{{\mathsf{PSI}}(x)}\mid x\in\mathsf{Obj}\}$. Then, $\mathsf{modelOf}(\Sigma_{\mathsf{PSI}})=\mathsf{modelOf}(\Delta_{{\mathsf{PSI}}})$.

Theorem 3.5(1) was proved in [2]. The only if condition of Theorem 3.5(2) was proved in [19]; we proved the if condition of Theorem 3.5(2) in [17]. Theorem 3.5(3) improves on the specification we gave for PSI in [17]; the latter does not have any constraints on the objects to which anti-dependencies refer to. We outline the proof of Theorem 3.5(3) in §5.

4. Algebraic Laws for Weak Consistency

Having two different styles for specifying consistency models gives rise to the following problems:

**Weak Correspondence Problem: ** given a x-specification $\Sigma$, determine a non-trivial g-specification $\Delta$ which over-approximates $\Sigma$, that is such that $\mathsf{modelOf}(\Sigma)\subseteq\mathsf{modelOf}(\Delta)$.

**Strong Correspondence Problem: ** Given a x-specification $\Sigma$, determine an equivalent g-specification $\Delta$, that is such that $\mathsf{modelOf}(\Sigma)=\mathsf{modelOf}(\Delta)$.

We first focus on the weak correspondence problem, and we discuss the strong correspondence problem in §5. This problem is not only of theoretical interest. Determining a g-specification $\Delta$ that over-approximates a x-specification $\Sigma$ corresponds to establishing one or more conditions satisfied by all cycles of dependency graphs from the set $\{\mathsf{graph}(\mathcal{X})\mid\mathcal{X}\in{\mathsf{Executions}}(\Sigma)\}$. Cycles in a dependency graph that respect such a condition are called $\Sigma$-critical (or simply critical), and graphs that admit a non-$\Sigma$-critical cycle cannot be obtained from abstract executions in ${\mathsf{Executions}}(\Sigma)$. One can ensure that an application running under the model $\Sigma$ is robust, i.e. it only produces serialisable behaviours, by checking for the absence of $\Sigma$-critical cycles at static time [19, 8]. Robustness of an application can also be checked at run-time, by incrementally constructing the dependency graph of executions, and detecting the presence of $\Sigma$-critical cycles [31].

General Methodology. Let $\Sigma$ be a given x-specification. We tackle the weak correspondence problem in two steps.

First, we identify a set of inequalities that hold for all the executions $\mathcal{X}$ satisfying consistency guarantees $(\rho,\pi)$ in $\Sigma$. There are two kinds of such inequalities. The first are the inequalities in Figure 3, and the second the inequalities corresponding to the axioms of the Kleene Algebra $(2^{\mathbb{T}\times\mathbb{T}},\emptyset,\mathsf{Id},\cup,\mathrel{;},\cdot^{\ast})$ and the Boolean algebra $(2^{\mathbb{T}\times\mathbb{T}},\emptyset,\mathbb{T}\times\mathbb{T},\cup,\cap,\overline{\cdot})$. The exact meaning of the inequalities in Figure 3 is discussed later in this section.

Second, we exploit our inequalities to derive other inequalities of the form $R_{\mathcal{X}}\subseteq{\sf{AR}}_{\mathcal{X}}$ for every $\mathcal{X}\in{\mathsf{Executions}}(\Sigma)$. Here $R_{\mathcal{X}}$ is a relation built from dependencies in $\mathsf{graph}(\mathcal{X})$, i.e. $R_{\mathcal{X}}\subseteq({\mathsf{WR}}_{\mathcal{X}}\cup{\mathsf{WW}}_{\mathcal{X}}\cup{\mathsf{RW}}_{\mathcal{X}})^{\ast}$. Because ${\sf{AR}}_{\mathcal{X}}$ is acyclic (that is ${\sf{AR}}_{\mathcal{X}}^{+}\cap\mathsf{Id}\subseteq\emptyset$), we may conclude that $R_{\mathcal{X}}$ is acyclic for any $\mathcal{X}\in{\mathsf{Executions}}(\Sigma)$. In particular, we have that $\mathsf{modelOf}(\Sigma)\subseteq\mathsf{modelOf}(\{\delta\})$, where $\delta$ is a function that maps, for every abstract execution $\mathcal{X}$, the dependency graph $\mathsf{graph}(\mathcal{X})$ into the relation $R_{\mathcal{X}}$.

Some of the inequalities we develop, namely those in Figure 3(d), are parametric in the consistency guarantee $(\rho,\pi)$. As a consequence, our approach can be specialised to any consistency model that is captured by our framework. To show its applicability, we derive critical cycles for several of the consistency models that we have presented.

Presentation of the Laws.   Let $\mathcal{X}=(\mathcal{T},{\mathsf{VIS}},{\sf{AR}})$, and $\mathsf{graph}(\mathcal{X})=(\mathcal{T},{\mathsf{WR}},{\mathsf{WW}},{\mathsf{RW}})$. We now explain the inequalities in Figure 3. Among these, the inequalities in Figures 3(a)  and (b)  should be self-explanatory.

Let us discuss the inequalities of Figure 3(c). The inequalities (c.1), (c.2)  and (c.3)  relate dependencies to either basic or derived relations of abstract executions. Dependencies of the form ${\mathsf{WR}},{\mathsf{WW}}$ are included in the relations ${\mathsf{VIS}},{\sf{AR}}$, respectively, as established by inequalities (c.1)  and (c.2). The inequality (c.3), which we prove presently, is non-standard. It relates anti-dependencies to a novel anti-visibility relation $\overline{{\mathsf{VIS}}^{-1}}$, defined as $T\xrightarrow{\overline{{\mathsf{VIS}}^{-1}}}S$ iff $\neg(S\xrightarrow{{\mathsf{VIS}}}T)$. In words, $S$ is anti-visible to $T$ if $T$ does not observe the effects of $S$. As we will explain later, anti-visibility plays a fundamental role in the development of our laws.

Proof of Inequality (c.3).

Suppose $T\xrightarrow{{\mathsf{RW}}(x)}S$ for some object $x\in\mathsf{Obj}$. By definition, $T\neq S$, and there exists a transaction $T^{\prime}$ such that $T^{\prime}\xrightarrow{{\mathsf{WR}}(x)}T$ and $T^{\prime}\xrightarrow{{\mathsf{WW}}(x)}S$. In particular, $T^{\prime}\xrightarrow{{\mathsf{VIS}}}T$ and $T^{\prime}\xrightarrow{{\sf{AR}}}S$ by the inequalities (c.1)  and (c.2), respectively. Now, if it were $S\xrightarrow{{\mathsf{VIS}}}T$, then we would have that $T^{\prime}$ is not the ${\sf{AR}}$-supremum of the set of transactions visible to $T$, and writing to object $x$. But this contradicts the definition of $\mathsf{graph}(\mathcal{X})$, and the edge $T^{\prime}\xrightarrow{{\mathsf{WR}}(x)}T$. Therefore, $T\xrightarrow{\overline{{\mathsf{VIS}}^{-1}}}S$. ∎

Another non-trivial inequality is (c.7)  in Figure 3(c). It says that if a transaction $T$ reads a value for an object $x$ that is later updated by another transaction $S$ ($T\xrightarrow{{\mathsf{RW}}}S)$, then the update of $S$ is more recent (i.e. it follows in arbitration) than all the updates to $x$ seen by $T$. We prove it in (§C). The other inequalities in Figure 3(c)  are self explanatory.

The inequalities in Figure 3(d)  are specific to a consistency guarantee $(\rho,\pi)$, and hold for an execution $\mathcal{X}$ when the execution satisfies $(\rho,\pi)$. The inequality (d.1)  is just the definition of consistency guarantee. The next inequality (d.2)  is where the novel anti-visibility relation, introduced previously, comes into play. While the consistency guarantee $(\rho,\pi)$ expresses when arbitration induces transactions related by visibility, the inequality (d.2)  expresses when anti-visibility induces transactions related by arbitration. To emphasise this correspondence, we call the inequality (d.2)  co-axiom induced by $(\rho,\pi)$. Later in this section, we show how by exploiting the co-axiom induced by several consistency guarantees, we can derive critical cycles of several consistency models.

Proof of Inequality (d.2). Assume $\mathcal{X}\in{\mathsf{Executions}}(\{(\rho,\pi)\})$. Let $T,T^{\prime},S^{\prime},S\in\mathcal{T}$ be such that $T\neq S$, $T\xrightarrow{\pi({\mathsf{VIS}})}T^{\prime}\xrightarrow{\overline{{\mathsf{VIS}}^{-1}}}S^{\prime}\xrightarrow{\rho({\mathsf{VIS}})}S$. Because ${\sf{AR}}$ is total, either $S\xrightarrow{{\sf{AR}}}T$ or $T\xrightarrow{{\sf{AR}}}S$. However, the former case is not possible. If so, we would have $S^{\prime}\xrightarrow{\rho({\mathsf{VIS}})}S\xrightarrow{{\sf{AR}}}T\xrightarrow{\pi({\mathsf{VIS}})}T^{\prime}$. because $\mathcal{X}\in{\mathsf{Executions}}(\{(\rho,\pi)\})$, by the inequality (d.1), it would follow that $S^{\prime}\xrightarrow{{\mathsf{VIS}}}T^{\prime}$, contradicting the assumption that $T^{\prime}\xrightarrow{\overline{{\mathsf{VIS}}^{-1}}}S^{\prime}$. Therefore, it has to be $T\xrightarrow{{\sf{AR}}}S$. ∎

The last inequalities (d.3)  and (d.4)  in Figure 3(d)  show that anti-visibility edges of $\mathcal{X}$ are also induced by the consistency guarantee $(\rho,\pi$). We prove them formally in (§C), where we also illustrate some of their applications.

Applications. We employ the algebraic laws of Figure 3 to derive $\Sigma$-critical cycles for arbitrary x-specifications, using the methodology explained previously: given a x-specification $\Sigma$ and an abstract execution $\mathcal{X}$, we characterise a subset of ${\sf{AR}}_{\mathcal{X}}$ as a relation $R_{\mathsf{G}}$ built from the dependencies in $\mathsf{graph}(\mathcal{X})$ and relations of the form ${[o]}$, where $o\in\mathsf{Op}$. Because $R_{\mathsf{G}}\subseteq{\sf{AR}}_{\mathcal{X}}$, we conclude that $R_{\mathsf{G}}$ is acyclic.

The inequalities (c.1), (c.6)  and (c.2)  ensure that we can always include write-read and write-write dependencies in the relation $R_{\mathsf{G}}$ above. Because of inequalities (c.3)  and (d.2)  (among others), we can include in $R_{\mathsf{G}}$ also relations that involve anti-dependencies. The following result shows how this methodology can be applied to serialisability. We use the notation $R_{1}\stackrel{{\scriptstyle\mathbf{(eq)}}}{{\subseteq}}R_{2}$ to denote that the inequality $R_{1}\subseteq R_{2}$ follows from $\mathbf{(eq)}$.

Theorem 4.1**.**

For all $\mathcal{X}\in{\mathsf{Executions}}(\Sigma_{\mathsf{SER}})$, the relation $({\mathsf{WR}}_{\mathcal{X}}\cup{\mathsf{WW}}_{\mathcal{X}}\cup{\mathsf{RW}}_{\mathcal{X}})$ is acyclic.

Proof. Recall that $\Sigma_{\mathsf{SER}}=\{(\rho_{\mathsf{Id}},\rho_{\mathsf{Id}})\}$, where $\rho_{\mathsf{Id}}(\_)=\mathsf{Id}$. We have

[TABLE]

Along the lines of the proof of Theorem 4.1, we can characterise $\Sigma$-critical cycles for an arbitrary x-specification $\Sigma$. Below, we show how to apply our methodology to derive $\Sigma_{{\mathsf{RB}}}$-critical cycles.

Theorem 4.2**.**

Let $\mathcal{X}\in{\mathsf{Executions}}(\Sigma_{{\mathsf{RB}}})$. Say that a ${\mathsf{RW}}_{\mathcal{X}}$ edge in a cycle of $\mathsf{graph}(\mathcal{X})$ is protected if its endpoints are connected to serialisable transactions via a sequence of ${\mathsf{WR}}_{\mathcal{X}}$ edges. Then all cycles in $\mathsf{graph}(\mathcal{X})$ have at least one unprotected ${\mathsf{RW}}_{\mathcal{X}}$ edge. Formally, let ${\Vdash{{\mathsf{RW}}_{\mathcal{X}}}\dashV}$ be $({[{{\tt SerTx}}]}\mathrel{;}({\mathsf{WR}}_{\mathcal{X}})^{\ast}\mathrel{;}{\mathsf{RW}}_{\mathcal{X}}\mathrel{;}({\mathsf{WR}}_{\mathcal{X}})^{\ast}\mathrel{;}{[{{\tt SerTx}}]})$. Then $({\mathsf{WR}}_{\mathcal{X}}\cup{\mathsf{WW}}_{\mathcal{X}}\cup{\Vdash{{\mathsf{RW}}_{\mathcal{X}}}\dashV})$ is acyclic.

Proof. It suffices to prove that ${\Vdash{{\mathsf{RW}}_{\mathcal{X}}}\dashV}\subseteq{\sf{AR}}_{\mathcal{X}}$. The rest of the proof is similar to the one of Theorem 4.1. We recall that $\Sigma_{{\mathsf{RB}}}=\{(\rho_{S},\rho_{S})\}$, where $\rho_{S}(\_)={[{{\tt SerTx}}]}$.

[TABLE]

We remark that our characterisation of $\Sigma_{{\mathsf{RB}}}$-critical cycle cannot be compared to the one given in [8]. In §C we show how our methodology can be applied to give a characterisation of $\Sigma_{{\mathsf{RB}}}$-critical cycles that is stronger than both the one presented in Theorem 4.2 and the one given in [8]. We also employ our proof technique to prove both known and new derivations of critical cycles for other x-specifications.

5. Characterisation of Simple Consistency Models

We now turn our attention to the Strong Correspondence Problem presented in §4. Given a x-specification $\Sigma=\{(\rho_{1},\pi_{1}),\cdots,(\rho_{n},\pi_{n})\}$ and a dependency graph $\mathcal{G}$, we want to find a sufficient and necessary condition for determining whether $\mathcal{G}=\mathsf{graph}(\mathcal{X})$ for some $\mathcal{X}\in{\mathsf{Executions}}(\Sigma)$.

In this section we propose a proof technique for solving the strong correspondence problem. This technique applies to a particular class of x-specifications, which we call simple x-specifications. This class includes several of the consistency models we have presented.

Characterisation of Simple x-specifications. Recall that for each $x\in\mathsf{Obj}$, the function $\rho_{x}$ of an abstract execution $\mathcal{X}$ is defined as $\rho_{x}(\_)={[{\sf{Writes}}_{x}]}$, and the associated axiom is ${[{\sf{Writes}}_{x}]}\mathrel{;}{\sf{AR}}_{\mathcal{X}}\mathrel{;}{[{\sf{Writes}}_{x}]}\subseteq{\mathsf{VIS}}_{\mathcal{X}}$.

Definition 5.1**.**

A x-specification $\Sigma$ is simple if there exists a consistency guarantee $(\rho,\pi)$ such that $\Sigma\subseteq\{(\rho,\pi)\}\cup\{(\rho_{x},\rho_{x})\}_{x\in\mathsf{Obj}}$.

That is, a simple x-specification $\Sigma$ contains at most one consistency guarantee, beside those of the form $(\rho_{x},\rho_{x})$ which express the write-conflict detection for some object $x\in\mathsf{Obj}$. Among the x-specifications that we have presented in this paper, the only non-simple one is $\Sigma_{\mathsf{SI}+\mathsf{SER}}$.

For simple x-specifications, it is possible to solve the strong correspondence problem. Fix a simple x-specification $\Sigma\subseteq\{(\rho,\pi)\}\cup\{(\rho_{x},\rho_{x})\mid x\in\mathsf{Obj}\}$ and a dependency graph $\mathcal{G}$. We define a system of inequalities $\mathsf{System}_{\Sigma}(\mathcal{G})$ in three unknowns $X_{V},X_{A}$ and $X_{N}$, and depicted in Figure 4 (the inequalities (V4)  and (A5)  are included in the system if and only if $(\rho,\pi)\in\Sigma$). These unknowns correspond to subsets of the visibility, arbitration and anti-visibility relations of the abstract execution $\mathcal{X}\in{\mathsf{Executions}}(\Sigma)$, with underlying dependency graph $\mathcal{G}$, that we wish to find. Note that each one of the inequalities of $\mathsf{System}_{\Sigma}(\mathcal{G})$, with the exception of (V3), follows the structure of one of the algebraic laws from Figure 3. We prove that, in order to ensure that the abstract execution $\mathcal{X}$ exists, it is sufficient to find a solution of $\mathsf{System}_{\Sigma}(\mathcal{G})$ whose $X_{A}$-component is acyclic. In particular, this is true if and only if the $X_{A}$-component of the smallest solution444 A solution $(X_{V}={\mathsf{VIS}},X_{A}={\sf{AR}},X_{N}=\mathsf{AntiVIS})$ is smaller than another one $(X_{V}={\mathsf{VIS}}^{\prime},X_{A}={\sf{AR}}^{\prime},X_{N}=\mathsf{AntiVIS}^{\prime})$ iff ${\mathsf{VIS}}\subseteq{\mathsf{VIS}}^{\prime},{\sf{AR}}\subseteq{\sf{AR}}^{\prime}$ and $\mathsf{AntiVIS}\subseteq\mathsf{AntiVIS}^{\prime}$. of $\mathsf{System}_{\Sigma}(\mathcal{G})$ is acyclic.

Theorem 5.2**.**

**Soundness: : **

for any $\mathcal{X}\in{\mathsf{Executions}}(\Sigma)$ such that $\mathsf{graph}(\mathcal{X})=\mathcal{G}$, the triple $(X_{V}={\mathsf{VIS}}_{\mathcal{X}},X_{A}={\sf{AR}}_{\mathcal{X}},X_{N}=\overline{{\mathsf{VIS}}^{-1}_{\mathcal{X}}})$ is a solution of $\mathsf{System}_{\Sigma}(\mathcal{G})$,

**Completeness: : **

Let $(X_{V}={\mathsf{VIS}}_{0},X_{A}={\sf{AR}}_{0},X_{N}=\mathsf{AntiVIS}_{0})$ be the smallest solution of $\mathsf{System}_{\Sigma}(\mathcal{G})$ . If ${\sf{AR}}_{0}$ is acyclic, then there exists an abstract execution $\mathcal{X}$ such that $\mathcal{X}\in{\mathsf{Executions}}(\Sigma)$ and $\mathsf{graph}(\mathcal{X})=\mathcal{G}$. ∎

Note that the relation ${\sf{AR}}_{0}$ need not to be total in the completeness direction of Theorem 5.2.

Before discussing the proof of Theorem 5.2, we show how it can be used to prove the equivalence of a x-specification and a g-specification. We give a proof of Theorem 3.5(3). Theorems 3.5(1) and 3.5(2) can be proved similarly, and their proof is given in (§D).

Proof Sketch of Theorem 3.5(3). Recall that $\Delta_{{\mathsf{PSI}}}=\{\delta_{{\mathsf{PSI}}_{0}}\}\cup\{\delta_{{\mathsf{PSI}}(x)}(\mathcal{G})\mid x\in\mathsf{Obj}\}$, where $\delta_{{\mathsf{PSI}}_{0}}(\mathcal{G})=({\mathsf{WR}}_{\mathcal{G}}\cup{\mathsf{WW}}_{\mathcal{G}})^{+}$, $\delta_{{\mathsf{PSI}}(x)}(\mathcal{G})=(({\mathsf{WR}}_{\mathcal{G}}\cup{\mathsf{WW}}_{\mathcal{G}})^{\ast}\mathrel{;}{\mathsf{RW}}_{\mathcal{G}}(x))^{+}$. In (§D) we prove that $\mathsf{Graphs}(\Delta_{{\mathsf{PSI}}})=\mathsf{Graphs}(\{\delta_{{\mathsf{PSI}}}\})$, where

[TABLE]

Therefore, it suffices to prove that $\mathsf{modelOf}(\Sigma_{{\mathsf{PSI}}})=\mathsf{modelOf}(\{\delta_{{\mathsf{PSI}}}\})$:

$\mathsf{modelOf}(\Sigma_{{\mathsf{PSI}}})\subseteq\mathsf{modelOf}(\{\delta_{{\mathsf{PSI}}}\})$**: : **

given $\mathcal{X}\in{\mathsf{Executions}}(\Sigma_{{\mathsf{PSI}}})$, and let $\mathcal{G}:=\mathsf{graph}(\mathcal{X})$, we need to show that $\delta_{{\mathsf{PSI}}}(\mathcal{G})\cap\mathsf{Id}=\emptyset$. The proof follows the style of Theorems 4.1  and 4.2; details can be found in (§C),

$\mathsf{modelOf}(\{\delta_{{\mathsf{PSI}}}\})\subseteq\mathsf{modelOf}(\Sigma_{{\mathsf{PSI}}})$**: : **

given $\mathcal{G}\in\mathsf{Graphs}(\{\delta_{{\mathsf{PSI}}}\})$, let ${\mathsf{VIS}}_{\mathcal{G}}=({\mathsf{WR}}\cup{\mathsf{WW}})^{+}$; It is immediate to prove that the triple $(X_{V}={\mathsf{VIS}}_{\mathcal{G}},X_{A}=\delta_{{\mathsf{PSI}}}(\mathcal{G}),X_{N}={\mathsf{VIS}}_{\mathcal{G}}?\mathrel{;}{\mathsf{RW}}\mathrel{;}{\mathsf{VIS}}_{\mathcal{G}}?)$ is a solution of $\mathsf{System}_{\Sigma_{{\mathsf{PSI}}}}(\mathcal{G})$. Because $\delta_{{\mathsf{PSI}}}(\mathcal{G})$ is acyclic, if we take the smallest solution $(X_{V}=\_,X_{A}={\sf{AR}}_{\mathcal{G}},X_{N}=\_)$ of $\mathsf{System}_{\Sigma}(\mathcal{G})$, then ${\sf{AR}}_{\mathcal{G}}\subseteq\delta_{{\mathsf{PSI}}}(\mathcal{G})$, hence ${\sf{AR}}_{\mathcal{G}}$ is acyclic. By Theorem 5.2, there exists an abstract execution $\mathcal{X}\in{\mathsf{Executions}}({\mathsf{PSI}})$ such that $\mathsf{graph}(\mathcal{X})=\mathcal{G}$, and in particular $\mathcal{T}_{\mathcal{X}}=\mathcal{T}_{\mathcal{G}}$. ∎

We now turn our attention to the proof of Theorem 5.2. The proof of the soundness direction is straightforward.

Proof of Theorem 5.2 (Soundness). Let $\mathcal{X}\in{\mathsf{Executions}}(\Sigma)$, and define $\mathcal{G}:=\mathsf{graph}(\mathcal{X})$. To show that the triple $(X_{V}={\mathsf{VIS}}_{\mathcal{X}},X_{A}={\sf{AR}}_{\mathcal{X}},X_{N}=\overline{{\mathsf{VIS}}^{-1}_{\mathcal{X}}})$ is a solution of $\mathsf{System}_{\Sigma}(\mathcal{G})$, we need to show that all the inequalities from said system are satisfied, when the unknowns $X_{A},X_{V},X_{N}$ are replaced with ${\mathsf{VIS}}_{\mathcal{X}},{\sf{AR}}_{\mathcal{X}},\overline{{\mathsf{VIS}}^{-1}_{\mathcal{X}}}$, respectively. In practice, all the inequalities, with the exception of (V3), follow from the algebraic laws of Figure 3. Let us prove that (V3) is also valid: for any $(\rho_{x},\rho_{x})\in\Sigma$ we have that

[TABLE]

The proof of the completeness direction of Theorem 5.2 is much less straightforward. Let $(X_{V}={\mathsf{VIS}}_{0},X_{A}={\sf{AR}}_{0},X_{N}=\mathsf{AntiVIS}_{0})$ be the smallest solution of $\mathsf{System}_{\Sigma}(\mathcal{G})$. Assume that ${\sf{AR}}_{0}$ is acyclic. The challenge is that of constructing a valid abstract execution $\mathcal{X}$, i.e. whose arbitration order is total, from the dependencies in $\mathcal{G}$, that is included in ${\mathsf{Executions}}(\Sigma)$. We do this incrementally: at intermediate stages of the construction we get structures similar to abstract executions, but where the arbitration order can be partial.

Definition 5.3**.**

A pre-execution $\mathcal{P}=(\mathcal{T}_{\mathcal{G}},{\mathsf{VIS}},{\sf{AR}})$ is a tuple that satisfies all the constraints of abstract executions, except that ${\sf{AR}}$ is not necessarily total, although ${\sf{AR}}$ is still required to be total over the set ${\sf{Writes}}_{x}$ for every object $x$.

The notation adopted for abstract executions naturally extends to pre-executions; also, for any pre-execution $\mathcal{P}$, $\mathsf{graph}(\mathcal{P})$ is a well-defined dependency graph. Given a x-specification $\Sigma$, we let $\mathsf{PreExecutions}(\Sigma)$ be the set of all valid pre-executions that satisfy all the consistency guarantees in $\Sigma$.

$\mathsf{System}_{\Sigma}(\mathcal{G})$ is defined so that all of its solutions whose $X_{A}$-component is acyclic induce a valid pre-execution in $\mathsf{PreExecutions}(\Sigma)$ with underlying dependency graph $\mathcal{G}$.

Proposition 5.4**.**

Let $(X_{V}={\mathsf{VIS}}^{\prime},X_{A}={\sf{AR}}^{\prime},X_{N}=\mathsf{AntiVIS}^{\prime})$ be a solution to $\mathsf{System}_{\Sigma}(\mathcal{G})$. If ${\sf{AR}}^{\prime}\cap\mathsf{Id}=\emptyset$, then $\mathcal{P}=(\mathcal{T}_{\mathcal{G}},{\mathsf{VIS}}^{\prime},{\sf{AR}}^{\prime})\in\mathsf{PreExecutions}(\Sigma)$; moreover, $\mathsf{graph}(\mathcal{P})=\mathcal{G}$.

Proof Sketch. The inequalities (A1), (A2)  and (A4)  together with the assumption that ${\sf{AR}}_{0}$ is acyclic, ensure that $\mathcal{P}$ is a pre-execution. In particular, (A1)  ensures that ${\sf{AR}}_{0}$ is a total relation over the set ${\sf{Writes}}_{x}$, for any $x\in\mathsf{Obj}$. As we explain in (§D), the inequalities (V1), (A1)  and (A3)  enforce the Last Write Wins policy (Definition 2.3). The inequality (V2)  mandates that $\mathcal{P}$ respects causality. Finally, the inequalities (V3)  and (V4)  ensure that all the consistency guarantees in $\Sigma$ are satisfied by $\mathcal{P}$. ∎

In particular, the smallest solution $(X_{V}={\mathsf{VIS}}_{0},X_{A}={\sf{AR}}_{0},X_{N}=\mathsf{AntiVIS}_{0})$ of $\mathsf{System}_{\Sigma}(\mathcal{G})$ induces the pre-execution $(\mathcal{T}_{\mathcal{G}},{\mathsf{VIS}}_{0},{\sf{AR}}_{0})\in\mathsf{PreExecutions}(\Sigma)$.

To construct an abstract execution $\mathcal{X}\in{\mathsf{Executions}}(\Sigma)$, with $\mathsf{graph}(\mathcal{X})=\mathcal{G}$, we define a finite chain of pre-executions $\{\mathcal{P}_{i},\}_{i=0}^{n}$, $n\geq 0$, as follows: (i) let $\mathcal{P}_{0}:=(\mathcal{T}_{\mathcal{G}},{\mathsf{VIS}}_{0},{\sf{AR}}_{0})$; (ii) given $\mathcal{P}_{i}$, $i\geq 0$, choose two different transactions $T_{i},S_{i}\in\mathcal{T}_{\mathcal{G}}$ (if any) that are not related by ${\sf{AR}}_{i}$, compute the smallest solution $(X_{V}={\mathsf{VIS}}_{i+1},X_{A}={\sf{AR}}_{i+1},X_{N}=\_)$ such that ${\sf{AR}}_{i+1}\supseteq{\sf{AR}}_{i}\cup\{(T_{i},S_{i})\}$, and let $\mathcal{P}_{i+1}:=(\mathcal{T}_{\mathcal{G}},{\mathsf{VIS}}_{i+1},{\sf{AR}}_{i+1})$; (iii) if the transactions $T_{i},S_{i}\in\mathcal{T}_{\mathcal{G}}$ from the previous step do not exist, then let $n:=i$ and terminate the construction. Because we are assuming that $\mathcal{T}_{\mathcal{G}}$ is finite, the construction of $\{\mathcal{P}_{0},\cdots,\mathcal{P}_{n}\}$ always terminates.

To prove the completeness direction of Theorem 5.2, we show that all of the pre-executions $\{\mathcal{P}_{0},\cdots,\mathcal{P}_{n}\}$ in the construction outlined above are included in $\mathsf{PreExecutions}(\Sigma)$; then, because in $\mathcal{P}_{n}=(\mathcal{T}_{\mathcal{G}},{\mathsf{VIS}}_{n},{\sf{AR}}_{n})$ all transactions are related by ${\sf{AR}}_{n}$, we may conclude that ${\sf{AR}}_{n}$ is total, and $\mathcal{P}_{n}\in{\mathsf{Executions}}(\Sigma)$. According to Proposition 5.4, it suffices to show that each of the relations ${\sf{AR}}_{i},i=0,\cdots,n$ is acyclic. However, this is not completely trivial, because of how ${\sf{AR}}_{i+1}$ is defined: adding one edge $(T_{i},S_{i})$ in ${\sf{AR}}_{i+1}$ may cause more edges to be included in ${\mathsf{VIS}}_{i+1}$, due to the inequality (V4). This in turn leads to including more edges in ${\sf{AR}}_{i+1}$, thus augmenting the risk of having a cycle in ${\sf{AR}}_{i+1}$.

In practice, the definition of $\mathsf{System}_{\Sigma}(\mathcal{G})$ ensures that this scenario does not occur.

Proposition 5.5**.**

For $i=0,\cdots,n-1$, let $\Delta{\sf{AR}}_{i}:={\sf{AR}}_{i}?\mathrel{;}\{(T_{i},S_{i})\}\mathrel{;}{\sf{AR}}_{n}?$. Then ${\sf{AR}}_{i+1}={\sf{AR}}_{i}\cup\Delta{\sf{AR}}_{i}$.

Corollary 5.6**.**

For $i=0,\cdots,n-1$, if ${\sf{AR}}_{i}\cap\mathsf{Id}=\emptyset$, then ${\sf{AR}}_{i+1}\cap\mathsf{Id}=\emptyset$.

Proof. Because ${\sf{AR}}_{i}\cap\mathsf{Id}=\emptyset$ by hypothesis, by Proposition 5.5 we only need to show that $\Delta{\sf{AR}}_{i}\cap\mathsf{Id}=\emptyset$. If $(T,T)\in\Delta{\sf{AR}}_{i}$ for some $T\in\mathcal{T}_{\mathcal{G}}$, then it must be $T\xrightarrow{{\sf{AR}}_{i}?}T_{i}$ and $S_{i}\xrightarrow{{\sf{AR}}_{i}?}T$. It follows that $S_{i}\xrightarrow{{\sf{AR}}_{i}?}T_{i}$. But this contradicts the hypothesis that ${\sf{AR}}_{i}$ does not relate transactions $T_{i}$ and $S_{i}$. Therefore, $(T,T)\not\in\Delta{\sf{AR}}_{i}$ for any $T\in\mathcal{T}_{\mathcal{G}}$, i.e. $\Delta{\sf{AR}}_{i}\cap\mathsf{Id}=\emptyset$. ∎

We have now everything in place to prove Theorem 5.2.

Proof of Theorem 5.2 (Completeness). Let $\mathcal{G}$ be a dependency graph, and define the chain of pre-executions $\mathcal{P}_{0}=(\mathcal{T}_{\mathcal{G}},{\mathsf{VIS}}_{0},{\sf{AR}}_{0}),\cdots,\mathcal{P}_{n}=(\mathcal{T}_{\mathcal{G}},{\mathsf{VIS}}_{n},{\sf{AR}}_{n})$ as described above. We show that for any $i=0,\cdots,n$, $\mathcal{P}_{i}\in\mathsf{PreExecutions}(\Sigma)$, and $\mathsf{graph}(\mathcal{P}_{i})=\mathcal{G}$. Because ${\sf{AR}}_{n}$ is a total order, this implies that $\mathcal{P}_{n}\in{\mathsf{Executions}}(\Sigma)$, and $\mathsf{graph}(\mathcal{P}_{n})=\mathcal{G}$, as we wanted to prove. The proof is by induction on $n$.

**Case $i=0$: : **

observe that the triple $(X_{V}={\mathsf{VIS}}_{0},X_{A}={\sf{AR}}_{0},X_{N}=\_)$ corresponds to the smallest solution of $\mathsf{System}_{\Sigma}(\mathcal{G})$, hence ${\sf{AR}}_{0}$ is acyclic by hypothesis. It follows from Proposition 5.4  that $\mathcal{P}_{0}\in\mathsf{PreExecutions}(\Sigma)$, and $\mathsf{graph}(\mathcal{P}_{0})=\mathcal{G}$,

**Case $i>0$: : **

assume that $i\leq n$; then $i-1<n$, and by induction hypothesis $\mathcal{P}_{i-1}\in\mathsf{PreExecutions}(\Sigma)$. In particular, the relation ${\sf{AR}}_{i-1}$ is acyclic; by Corollary 5.6 we obtain that ${\sf{AR}}_{i}$ is acyclic. Finally, recall that the triple $(X_{V}={\mathsf{VIS}}_{i},X_{A}={\sf{AR}}_{i},X_{N}=\_)$ is a solution of $\mathsf{System}_{\Sigma}(\mathcal{G})$ by construction. It follows from Proposition 5.4 that $\mathcal{P}_{i}\in\mathsf{PreExecutions}(\Sigma)$, and $\mathsf{graph}(\mathcal{P}_{i})=\mathcal{G}$. ∎

6. Conclusion

We have explored the connection between two different styles of specifications for weak consistency models at an algebraic level. We have proposed several laws which we applied to devise several robustness criteria for consistency models. To the best of our knowledge, this is the first generic proof technique for proving robustness criteria of weak consistency models. We have shown that, for a particular class of consistency models, our algebraic approach leads to a precise characterisation of consistency models in terms of dependency graphs.

Related Work. Abstract executions have been introduced by Burckhardt in [13] to model the behaviour of eventually consistent data-stores; They have been used to capture the behaviour of replicated data types [Gotsman et al., 14], geo-replicated databases [Cerone et al., 16] and non-transactional distributed storage systems [Viotti et al., 30].

Dependency graphs have been introduced by Adya [2]; they have been used since to reason about programs running under weak consistency models. Bernardi et al., used dependency graphs to derive robustness criteria of several consistency models [8], including PSI and red-blue; in contrast with our work, the proofs there contained do not rely on a general technique. Brutschy et al. generalised the notion of dependency graphs to replicated data types, and proposed a robustness criterion for eventual consistency [11].

Weak consistency also arises in the context of shared memory systems [5]. Alglave et al., proposed the CAT language for specifying weak memory models in [5], which also specifies weak memory models as a set of irreflexive relations over data-dependencies of executions. Castellan [15], and Jeffrey et al. [21], proposed different formalisations of weak memory models via event structures. The problem of checking the robustness of applications has also been addressed for weak memory models [4, 9, 3].

The strong correspondence problem (§5) is also highlighted by Bouajjani et al. in [10]: there the authors emphasize the need for general techniques to identify all the bad patterns that can arise in dependency-graphs like structures. We solved the strong correspondence problem for SI in [17].

Appendix A Exampes of Anomalies

We give examples of several anomalies: for each of them we list those consistency models, among those considered in the paper, that allow the anomaly, and those that forbid it. For the sake of clarity, we have removed from the pictures below a transaction writing the initial value [math] to relevant objects, and visible to all other transactions. Also, unnecessary visibility and arbitration edges are omitted from figures.

**Fractured Reads: : **

Transaction $T_{2}$ reads only one of the updates performed by transaction $T_{1}$:

• **•: **

**Allowed by: ** No consistency model enjoying atomic visibility allows this anomaly.

${\mathsf{VIS}}$    ${\mathsf{VIS}}$    {\sf{AR}}$${\mathsf{VIS}}$${\mathsf{VIS}}WR, WW     WR, WW     RW, WWRWWRT_{0}$$T_{1}$$T_{2}$$S$$T_{1}$$T_{2}$${\mathsf{VIS}}$${{\tt write}}\;x:1$${{\tt write}}\;y:1$${{\tt read}}\;x:1$${{\tt read}}\;y:0

**Violation of Causality: : **

The update of transaction $T_{2}$ to object $y$ depends on the value of $x$ written by another transaction $T_{1}$. For example, $T_{2}$ can be generated by the code $\mathtt{if}(x=1)\;\mathtt{then}\;y:=1;$. A third transaction $T_{3}$ observes the update to $y$, but not the one to $x$.

• **•: **

**Allowed by: ** None of the models discussed in the paper. However, some other consistency models such as Read Atomic [6] allow this anomaly.

${\mathsf{VIS}}$    ${\mathsf{VIS}}$    {\sf{AR}}$${\mathsf{VIS}}$${\mathsf{VIS}}WR, WW     WR, WW     RW, WWRWWRT_{0}$$T_{1}$$T_{2}$$S$$T_{1}$$T_{2}$${\mathsf{VIS}}$$T_{1}$$T_{2}$$T_{3}✘{\mathsf{VIS}}$${\mathsf{VIS}}$${\mathsf{VIS}}$${{\tt write}}\;x:1$${{\tt read}}\;x:1$${{\tt write}}\;y:1$${{\tt read}}\;x:0$${{\tt read}}\;y:1

**Lost Update: : **

This is the abstract Execution depicted in Figure 1, which we draw again below. Two transactions $T_{1},T_{2}$ concurrently update the same object, after reading the initial value for it.

• **•: **

**Allowed by: ** Causal Consistency, Red-blue Consistency,

• **•: **

**Forbidden by: ** Parallel Snapshot Isolation, Snapshot Isolation, Serialisability.

${\mathsf{VIS}}$    ${\mathsf{VIS}}$    {\sf{AR}}$${\mathsf{VIS}}$${\mathsf{VIS}}WR, WW     WR, WW     RW, WWRWWRT_{0}$$T_{1}$$T_{2}$$S$$T_{1}$$T_{2}$${\mathsf{VIS}}$$T_{1}$$T_{2}$$T_{3}✘{\mathsf{VIS}}$${\mathsf{VIS}}$${\mathsf{VIS}}$${\sf{AR}}$${\mathsf{VIS}}$${\mathsf{VIS}}acct := acct + 50acct := acct + 25T_{1}$$T_{2}$$S$${{\tt read}}\;\mathsf{acct}:0$${{\tt write}}\;\mathsf{acct}:50$${{\tt read}}\;\mathsf{acct}:0$${{\tt write}}\;\mathsf{acct}:25$${{\tt read}}\;\mathsf{acct}:25

**Serialisable Lost Update: : **

This execution is the same as the one above, but the two transactions $T_{1},T_{2}$ are marked as serialisable. In the figure below, transactions marked as serialisable are depicted using a box with double borders. Because Causal Consistency does not distinguish between transactions marked as serialisable from those that are not marked as such, it allows the serialisable lost update. However, this anomaly is forbidden by Red-blue Consistency.

• **•: **

**Allowed by: ** Causal Consistency,

• **•: **

**Forbidden by: ** Red-blue Consistency, Parallel Snapshot Isolation, Snapshot Isolation, Serialisability.

${\mathsf{VIS}}$    ${\mathsf{VIS}}$    {\sf{AR}}$${\mathsf{VIS}}$${\mathsf{VIS}}WR, WW     WR, WW     RW, WWRWWRT_{0}$$T_{1}$$T_{2}$$S$$T_{1}$$T_{2}$${\mathsf{VIS}}$$T_{1}$$T_{2}$$T_{3}✘{\mathsf{VIS}}$${\mathsf{VIS}}$${\mathsf{VIS}}$${\sf{AR}}$${\mathsf{VIS}}$${\mathsf{VIS}}acct := acct + 50acct := acct + 25T_{1}$$T_{2}$$S$${\sf{AR}}$${\mathsf{VIS}}$${\mathsf{VIS}}acct := acct + 50acct := acct + 25T_{1}$$T_{2}$$S$${{\tt read}}\;\mathsf{acct}:0$${{\tt write}}\;\mathsf{acct}:50$${{\tt read}}\;\mathsf{acct}:0$${{\tt write}}\;\mathsf{acct}:25$${{\tt read}}\;\mathsf{acct}:25

**Long Fork: : **

Two transactions $T_{1}$, $T_{2}$ write to different objects: two other transactions $T_{3},T_{4}$ only observe the updates of $T_{1},T_{2}$, respectively:

• **•: **

Allowed by: Causal Consistency, Red-blue Consistency, Parallel Snapshot Isolation,

• **•: **

**Forbidden by: ** Snapshot Isolation, Serialisability.

${\mathsf{VIS}}$    ${\mathsf{VIS}}$    {\sf{AR}}$${\mathsf{VIS}}$${\mathsf{VIS}}WR, WW     WR, WW     RW, WWRWWRT_{0}$$T_{1}$$T_{2}$$S$$T_{1}$$T_{2}$${\mathsf{VIS}}$$T_{1}$$T_{2}$$T_{3}✘{\mathsf{VIS}}$${\mathsf{VIS}}$${\mathsf{VIS}}$${\sf{AR}}$${\mathsf{VIS}}$${\mathsf{VIS}}acct := acct + 50acct := acct + 25T_{1}$$T_{2}$$S$${\sf{AR}}$${\mathsf{VIS}}$${\mathsf{VIS}}acct := acct + 50acct := acct + 25T_{1}$$T_{2}$$S$$T_{1}$$T_{2}$$T_{3}$$T_{4}$${\mathsf{VIS}}$${\mathsf{VIS}}$${\sf{AR}}$${{\tt write}}\;x:1$${{\tt read}}\;x:1$${{\tt read}}\;y:0$${{\tt write}}\;y:1$${{\tt read}}\;y:1$${{\tt read}}\;x:0

**Long Fork with Serialisable Updates: : **

This is the same as the long fork, but the transactions $T_{1},T_{2}$ that write to objects $x,y$, respectively, are marked as serialisable. Because Parallel Snapshot Isolation does not take serialisable transactions into account, it allows this anomaly. However, Red-blue Consistency distinguishes between serialisable and non-serialisable transactions, hence it does not allow it.

• **•: **

Allowed by: Causal Consistency, Parallel Snapshot Isolation,

• **•: **

**Forbidden by: ** Red-blue Consistency, Snapshot Isolation, Serialisability.

${\mathsf{VIS}}$    ${\mathsf{VIS}}$    {\sf{AR}}$${\mathsf{VIS}}$${\mathsf{VIS}}WR, WW     WR, WW     RW, WWRWWRT_{0}$$T_{1}$$T_{2}$$S$$T_{1}$$T_{2}$${\mathsf{VIS}}$$T_{1}$$T_{2}$$T_{3}✘{\mathsf{VIS}}$${\mathsf{VIS}}$${\mathsf{VIS}}$${\sf{AR}}$${\mathsf{VIS}}$${\mathsf{VIS}}acct := acct + 50acct := acct + 25T_{1}$$T_{2}$$S$${\sf{AR}}$${\mathsf{VIS}}$${\mathsf{VIS}}acct := acct + 50acct := acct + 25T_{1}$$T_{2}$$S$$T_{1}$$T_{2}$$T_{3}$$T_{4}$${\mathsf{VIS}}$${\mathsf{VIS}}$${\sf{AR}}$$T_{1}$$T_{2}$$T_{3}$$T_{4}$${\mathsf{VIS}}$${\mathsf{VIS}}$${\sf{AR}}$${{\tt write}}\;x:1$${{\tt read}}\;x:1$${{\tt read}}\;y:0$${{\tt write}}\;y:1$${{\tt read}}\;y:1$${{\tt read}}\;x:0

**Remark: ** Note that Red-blue consistency forbids this anomaly, but allows the lost update anomaly from above. In contrast, Parallel Snapshot Isolation allows this anomaly, but forbids the lost-update anomaly. In other words, Red-blue Consistency and Parallel Snapshot Isolation are incomparable: ${\mathsf{Executions}}(\Sigma_{{\mathsf{RB}}})\not\subseteq{\mathsf{Executions}}(\Sigma_{{\mathsf{PSI}}})$ and ${\mathsf{Executions}}(\Sigma_{{\mathsf{PSI}}})\not\subseteq{\mathsf{Executions}}(\Sigma_{{\mathsf{RB}}})$.

**Write Skew: : **

Transactions $T_{1},T_{2}$ read each the initial value of an object which is updated by the other.

• **•: **

**Allowed by: ** Causal Consistency, Red-blue Consistency, Parallel Snapshot Isolation, Snapshot Isolation,

• **•: **

**Forbidden by: ** Serialisability.

${\mathsf{VIS}}$    ${\mathsf{VIS}}$    {\sf{AR}}$${\mathsf{VIS}}$${\mathsf{VIS}}WR, WW     WR, WW     RW, WWRWWRT_{0}$$T_{1}$$T_{2}$$S$$T_{1}$$T_{2}$${\mathsf{VIS}}$$T_{1}$$T_{2}$$T_{3}✘{\mathsf{VIS}}$${\mathsf{VIS}}$${\mathsf{VIS}}$${\sf{AR}}$${\mathsf{VIS}}$${\mathsf{VIS}}acct := acct + 50acct := acct + 25T_{1}$$T_{2}$$S$${\sf{AR}}$${\mathsf{VIS}}$${\mathsf{VIS}}acct := acct + 50acct := acct + 25T_{1}$$T_{2}$$S$$T_{1}$$T_{2}$$T_{3}$$T_{4}$${\mathsf{VIS}}$${\mathsf{VIS}}$${\sf{AR}}$$T_{1}$$T_{2}$$T_{3}$$T_{4}$${\mathsf{VIS}}$${\mathsf{VIS}}$${\sf{AR}}$$T_{1}$$T_{2}$${\sf{AR}}$${{\tt read}}\;x:0$${{\tt write}}\;y:1$${{\tt read}}\;y:0$${{\tt write}}\;x:1

Appendix B Session Guarantees and Non-Causal Consistency Models

We augment histories with sessions: clients submit transactions within sessions, and the order in which they are submitted to the database is tracked by a session order. We propose a variant of x-specifications that allows for specifying session guarantees, as well as causality guarantees that are weaker than causal consistency.

Definition B.1**.**

Let $\mathcal{T}$ be a set of transactions, and let $\{\mathcal{T}_{1},\mathcal{T}_{2},\cdots,\mathcal{T}_{n}\}$ be a partition of $\mathcal{T}$. An extended history is a pair $\mathcal{H}=(\mathcal{T},{\sf{SO}})$, where ${\sf{SO}}=\bigcup_{i=1}^{n}{\sf{SO}}_{i}$, and each ${\sf{SO}}_{i}$ is a strict, total order over $\mathcal{T}_{i}$. Each of the sets $\mathcal{T}_{i}=1,\cdots,n$ takes the name of session, and we call ${\sf{SO}}$ the session order.

Given an extended history $\mathcal{H}=(\mathcal{T},{\sf{SO}})$, we let $\mathcal{T}_{\mathcal{H}}=\mathcal{T}$, and ${\sf{SO}}_{\mathcal{H}}={\sf{SO}}$. If $(\mathcal{T},{\sf{SO}})$ is an extended history, and $(\mathcal{T},{\mathsf{VIS}},{\sf{AR}})$ is an abstract execution, then we call $(\mathcal{T},{\sf{SO}},{\mathsf{VIS}},{\sf{AR}})$ an extended abstract execution. Specification functions can also be lifted to take extended abstract executions into account: an extended specification function is a function $\rho:(\mathcal{H},R)\mapsto R^{\prime}$, such that for any extended history $\mathcal{H}$ and relation $R\subseteq\mathcal{T}_{\mathcal{H}}\times\mathcal{T}_{\mathcal{H}}$, $\rho(\mathcal{H},R)=\rho(\mathcal{H},\mathcal{T}_{\mathcal{H}}\times\mathcal{T}_{\mathcal{H}})\cap R?$. An example of extended specification function is $\rho(\mathcal{H},R)=R\setminus({\sf{SO}}_{\mathcal{H}}?)$. An extended consistency guarantee is a pair $(\rho,\pi)$, where $\rho,\pi$ are extended specification functions.

Definition B.2**.**

A session guarantee is a function $\sigma:2^{\mathbb{T}\times\mathbb{T}}\rightarrow 2^{\mathbb{T}\times\mathbb{T}}$ such that, for any relation $R\subseteq\mathbb{T}\times\mathbb{T}$, $\sigma(R)\subseteq R?$. A causality guarantee is a pair $(\gamma,\beta)$, where $\gamma$ and $\beta$ are extended specification functions.

An extended x-specification of a consistency model is a triple $\Sigma=(\{\sigma_{i}\}_{i\in I},\{(\gamma_{j},\beta_{j})\}_{j\in J},\allowbreak\{(\rho_{k},\leavevmode\nobreak\ \pi_{k})\}_{k\in K})$, where $I,J,K$ are (possibly empty) index sets, for any $i\in I,j\in J$ and $k\in K$, $\sigma_{i}$ is a session guarantee, $(\gamma_{j},\beta_{j})$ is a causality guarantee, and $(\rho_{k},\pi_{k})$ is an extended consistency guarantee.

Note that the definition of causality and (extended) consistency guarantees are the same. However, they play a different role when defining the set of executions admitted by a consistency model.

Definition B.3**.**

An extended abstract execution $\mathcal{X}=(\mathcal{T},{\sf{SO}},{\mathsf{VIS}},{\sf{AR}})$ conforms to the extended specification $(\{\sigma_{i}\}_{i\in I},\{(\gamma_{j},\beta_{j})\}_{j\in J},\{(\rho_{k},\pi_{k})\}_{k\in K}$ iff

1. (1)

for any $i\in I$, $\sigma_{i}({\sf{SO}})\subseteq{\mathsf{VIS}}$ 2. (2)

for any $j\in J$, $\gamma_{j}(\mathcal{H},{\mathsf{VIS}})\mathrel{;}\beta_{j}(\mathcal{H},{\mathsf{VIS}})\subseteq{\mathsf{VIS}}$, 3. (3)

for any $k\in K$, $\rho_{k}(\mathcal{H},{\mathsf{VIS}})\mathrel{;}{\sf{AR}}\mathrel{;}\pi_{k}(\mathcal{H},{\mathsf{VIS}})\subseteq{\mathsf{VIS}}$.

Any x-specification can be lifted to an extended one: let $\gamma_{\mathsf{CC}}(\_,R)=(R\setminus\mathsf{Id})$555The difference with the identity relation is needed for $\gamma$ to satisfy the definition of specification function. However, we will always apply $\gamma$ to an irreflexive relation $R$, for which $\gamma(\_,R)=(R\setminus\mathsf{Id})=R$.. Let also $\Sigma$ be any $x$-specification, and for any pair $(\rho,\pi)\in\Sigma$, define $\rho^{\prime}(\_,R)=\rho(R)$, $\pi^{\prime}(\_,R)=\pi(R)$. Then for any abstract $\mathcal{X}$, $\mathcal{X}\in{\mathsf{Executions}}(\Sigma)$ iff $\mathcal{X}$ conforms to the extended specification $(\emptyset,\{(\gamma_{\mathsf{CC}},\gamma_{\mathsf{CC}})\},\{(\rho^{\prime},\pi^{\prime})\mid(\rho,\pi)\in\Sigma\})$.

Dependency graphs can also be extended to take sessions into account. If $(\mathcal{T},{\sf{SO}})$ is a history, and $(\mathcal{T},{\mathsf{WR}},{\mathsf{WW}},{\mathsf{RW}})$ is a dependency graph, then $\mathcal{G}=(\mathcal{T},{\sf{SO}},{\mathsf{WR}},{\mathsf{WW}},{\mathsf{RW}})$ is an extended dependency graph. Given an extended abstract execution $\mathcal{X}=(\mathcal{T},{\sf{SO}},{\mathsf{VIS}},{\sf{AR}})$, we define $\mathsf{graph}(\mathcal{X})=(\mathcal{T},{\sf{SO}},{\mathsf{WR}},{\mathsf{WW}},{\mathsf{RW}})$, where $(\mathcal{T},{\mathsf{WR}},{\mathsf{WW}},{\mathsf{RW}})=\mathsf{graph}(\mathcal{T},{\mathsf{VIS}},{\sf{AR}})$. An extended abstract execution $\mathcal{X}=(\mathcal{T},{\sf{SO}},{\mathsf{VIS}},{\sf{AR}})$ with underlying extended dependency graph $\mathsf{graph}(\mathcal{X})=(\mathcal{T},{\sf{SO}},{\mathsf{WR}},{\mathsf{WW}},{\mathsf{RW}})$ and conforming to the extended specification

$(\{\sigma_{i}\}_{i\in I},\{(\gamma_{j},\beta_{j})\}_{j\in J},\{(\rho_{k},\pi_{k})\}_{k\in K}$, satisfies all the Equations of Figure 3, exception made for equations, (c.8)  and (c.9). Furthermore, sessions and causality guarantees induce novel inequalities, which are listed below:

1. (1)

$\bigcup_{i\in I}\sigma_{i}({\sf{SO}})\subseteq{\mathsf{VIS}}$, 2. (2)

for any $j\in J$, $(\beta_{j}(\mathcal{H},{\mathsf{VIS}})\mathrel{;}\overline{{\mathsf{VIS}}^{-1}})\cap\gamma(\mathcal{H},\mathcal{T}\times\mathcal{T})^{-1}\subseteq\overline{{\mathsf{VIS}}^{-1}}$, 3. (3)

for any $j\in J$, $(\overline{{\mathsf{VIS}}^{-1}}\mathrel{;}\gamma_{j}(\mathcal{H},{\mathsf{VIS}}))\cap\beta_{j}(\mathcal{H},\mathcal{T}\times\mathcal{T})^{-1}\subseteq\overline{{\mathsf{VIS}}^{-1}}$.

Equation (1) is obviously satisfied. To see why (2) is satisfied by $\mathcal{X}$, let $j\in J$ and suppose that $T\xrightarrow{\beta_{j}(\mathcal{H},{\mathsf{VIS}})}V\xrightarrow{\overline{{\mathsf{VIS}}^{-1}}}S$, and $S\xrightarrow{\gamma_{j}(\mathcal{H},\mathcal{T}\times\mathcal{T})}T$. If it were $S\xrightarrow{{\mathsf{VIS}}}T$, then we would have a contradiction: because $\gamma_{j}$ is an extended specification function, $S\xrightarrow{\gamma_{j}(\mathcal{H},\mathcal{T}\times\mathcal{T})}T$ and $S\xrightarrow{{\mathsf{VIS}}}T$ imply that $S\xrightarrow{\gamma_{j}(\mathcal{H},{\mathsf{VIS}})}T$, and together with $T\xrightarrow{\beta_{j}(\mathcal{H},{\mathsf{VIS}})}V$ then we would have $S\xrightarrow{{\mathsf{VIS}}}V$, contradicting the assumption that $V\xrightarrow{\overline{{\mathsf{VIS}}^{-1}}}S$. Therefore it has to be $\neg(S\xrightarrow{{\mathsf{VIS}}}T)$, or equivalently $T\xrightarrow{\overline{{\mathsf{VIS}}^{-1}}}S$. Equation (3) can be proved similarly.

Examples of Session Guarantees. Below we give some examples of session guarantees, inspired by [29].

Read Your Writes: This guarantee states that when processing a transaction, a client must see previous writes in the same session. This can be easily expressed via the collection of consistency guarantees $\{\sigma_{\mathsf{RYW(x)}}\}_{x\in\mathsf{Obj}}$, where for each object $x$, $\sigma_{\mathsf{RYW(x)}}(R)={[{\sf{Writes}}_{x}]}\mathrel{;}R\mathrel{;}{[{\sf{Reads}}_{x}]}$. An extended abstract execution $\mathcal{X}=(\mathcal{T},{\sf{SO}},{\mathsf{VIS}},{\sf{AR}})$ satisfies this session guarantee if $\bigcup_{x\in\mathsf{Obj}}{[{\sf{Writes}}_{x}]}\mathrel{;}{\sf{SO}}\mathrel{;}{[{\sf{Reads}}_{x}]}\subseteq{\mathsf{VIS}}$,

Monotonic Writes: This guarantee states that transactions writing at least to one object are processed in the same order in which the client requested them. It can be specified via the function $\sigma_{\mathsf{MW}}(R)=(\bigcup_{x\in\mathsf{Obj}}{[{\sf{Writes}}_{x}]})\mathrel{;}R\mathrel{;}(\bigcup_{x\in\mathsf{Obj}}{[{\sf{Writes}}_{x}]})$. Any extended abstract execution $\mathcal{X}=(\mathcal{T},{\sf{SO}},{\mathsf{VIS}},{\sf{AR}})$ satisfies the monotonic writes guarantee, is such that $(\bigcup_{x\in\mathsf{Obj}}{[{\sf{Writes}}_{x}]})\mathrel{;}{\sf{SO}}\mathrel{;}(\bigcup_{x\in\mathsf{Obj}}{[{\sf{Writes}}_{x}]})\subseteq{\mathsf{VIS}}$,

Strong Session Guarantees: This guarantee states that all transactions are processed by the database in the same order in which the client requested them. It can be specified via the function $\sigma_{\mathsf{SS}}(R)=R$; an extended abstract execution $(\mathcal{T},{\sf{SO}},{\mathsf{VIS}},{\sf{AR}})$ satisfies this guarantee if ${\sf{SO}}\subseteq{\mathsf{VIS}}$.

Examples of Causality Guarantee: . We have already seen how to model causal consistency via the causality guarantee $(\gamma_{\mathsf{CC}},\gamma_{\mathsf{CC}})$. Below we give an example of weak causality guarantee:

Per-object Causal Consistency: this guarantee states that causality is preserved only among transactions accessing the same object. That is, let $\gamma_{x}(R)=({[{\sf{Writes}}_{x}\cup{\sf{Reads}}_{x}]}\mathrel{;}R\mathrel{;}{[{\sf{Writes}}_{x}\cup{\sf{Reads}}_{x}]})\setminus\mathsf{Id}$. The difference with the identity set is needed in order for $\gamma_{x}(R)$ to be a specification function. By definition, An extended abstract execution $\mathcal{X}=(\mathcal{T},{\sf{SO}},{\mathsf{VIS}},{\sf{AR}})$ that satisfies the per-object causal consistency guarantee, satisfies the inequality ${[{\sf{Writes}}_{x}\cup{\sf{Reads}}_{x}]}\mathrel{;}{\mathsf{VIS}}\mathrel{;}{[{\sf{Writes}}_{x}\cup{\sf{Reads}}_{x}]}\mathrel{;}{\mathsf{VIS}}\mathrel{;}{[{\sf{Writes}}_{x}\cup{\sf{Reads}}_{x}]}\subseteq{\mathsf{VIS}}$.

Appendix C Additional Proofs of Algebraic Laws and Robustness Criteria

Throughout this Section, we assume that $\mathcal{X}=(\mathcal{T},{\mathsf{VIS}},{\sf{AR}})$ is a valid abstract execution, and $\mathsf{graph}(\mathcal{X})=(\mathcal{T},{\mathsf{WR}},{\mathsf{WW}},{\mathsf{RW}})$.

First, a result about specification functions, which was hinted at in the main paper:

Proposition C.1**.**

Let $\rho(\cdot)$ be a specification function. For all histories $\mathcal{T}$ and relations $R,R^{\prime}\subseteq\mathcal{T}\times\mathcal{T}$,

1. (i)

$\rho(R)\subseteq R?$; 2. (ii)

$\rho(\mathcal{T}\times\mathcal{T})\cap R\subseteq\rho(R)$; 3. (iii)

$\rho(R)\cup\rho(R^{\prime})=\rho(R\cup R^{\prime})$.

Proof. Recall that, by definition, if $\rho$ is a specification function, then $\rho(R)=\rho(\mathcal{T}\times\mathcal{T})\cap R?$. It is immediate to observe then that (i) $\rho(R)\subseteq R?$, and (ii) $\rho(\mathcal{T}\times\mathcal{T})\cap R\subseteq\rho(\mathcal{T}\times\mathcal{T})\cap R?=\rho(R)$. To prove (iii) note that

[TABLE]

C.1. Proof of the Algebraic Laws in Figure 3

Proposition C.2**.**

All the (in)equalities of Figure 3(a)  are satisfied.

Proof.   We prove each of the (in)equalities in Figure 3(a)  individually. Throughout the proof, we let $\mathcal{T}^{\prime},\mathcal{T}_{1},\mathcal{T}_{2}\subseteq\mathcal{T}$, and $R_{1},R_{2}\subseteq\mathcal{T}\times\mathcal{T}$

• •

(a.1): by Definition, ${[\mathcal{T}^{\prime}]}=\{(T,T)\mid T\in\mathcal{T}^{\prime}\}\subseteq\mathsf{Id}_{\mathcal{T}}$,

• •

(a.2): note that we can rewrite ${[\mathcal{T}_{i}]}=\{(T,S)\mid T\in\mathcal{T}_{1}\wedge S\in\mathcal{T}_{1}\wedge T=S\}$, where $i=1,2$; then

[TABLE]

• •

(a.3):

[TABLE]

• •

(a.4):

[TABLE]

∎

Proposition C.3**.**

All the inequalities of Figure 3(b)  are satisfied by $\mathcal{X}$.

Proof. We only prove (in)equalities (b.1)  and (b.4). The proof for the other (in)equalities is similar.

Suppose that $T\xrightarrow{{\mathsf{WR}}(x)}S$. By Definition, $S\ni({{\tt read}}\;x:\_)$, hence $(S,S)\in{[{\sf{Reads}}_{x}]}$. Also, $T\in{\mathsf{VIS}}^{-1}(S)\cap{\sf{Writes}}_{x}\subseteq{\sf{Writes}}_{x}$, from which $(T,T)\in{[{\sf{Writes}}_{x}]}$ follows. Thus, $(T,S)\in{[{\sf{Writes}}_{x}]}\mathrel{;}{\mathsf{WR}}(x)\mathrel{;}{[{\sf{Reads}}_{x}]}$; this proves Equation (b.1).

To prove Equation (b.4), first observe that because $T\xrightarrow{{\mathsf{WR}}(x)}S$, then $T\xrightarrow{{\mathsf{VIS}}}S$, and because ${\mathsf{VIS}}\subseteq{\sf{AR}}$ then also $T\xrightarrow{{\sf{AR}}}S$. By definition of abstract execution, then $T\neq S$. Therefore, ${\mathsf{WR}}(x)\cap\mathsf{Id}=\emptyset$. Now we can rewrite

[TABLE]

Proposition C.4**.**

$\mathcal{X}$* satisfies inequalities (c.1), (c.2)  and (c.7).*

Proof. The inequalities (c.1)  and (c.2)  follow directly from the Definition of $\mathsf{graph}(\mathcal{X})$. It remains to prove the inequality (c.7). Let $T,S,T^{\prime}$ be three transactions such that $T\ni({{\tt write}}\;x:\_)$, $T\xrightarrow{{\mathsf{VIS}}}S$ and $S\xrightarrow{{\mathsf{RW}}(x)}T^{\prime}$; we need to show that $T\xrightarrow{{\sf{AR}}}T^{\prime}$. Recall that, because $\mathcal{X}$ is an abstract execution, then the relation ${\sf{AR}}$ is total: either $T=T^{\prime}$, $T^{\prime}\xrightarrow{{\sf{AR}}}T$, or $T\xrightarrow{{\sf{AR}}}T^{\prime}$. It is not possible that $T=T^{\prime}$, because otherwise we would have $S\xrightarrow{{\mathsf{RW}}(x)}T$ and $T\xrightarrow{{\mathsf{VIS}}}S$

(equivalently, $\neg(S\xrightarrow{\overline{{\mathsf{VIS}}^{-1}}}T)$), contradicting the inequality (c.3). It cannot be that $T^{\prime}\xrightarrow{{\sf{AR}}}T$ either: in the picture to the right, we have given a graphical representation of this scenario, where dashed edges represent the consequences of having $T^{\prime}\xrightarrow{{\sf{AR}}}T$. In this case, $T\in{\sf{Writes}}_{x}$ by hypothesis; because $S\xrightarrow{{\mathsf{RW}}(x)}T^{\prime}$, we also have that $T^{\prime}\in{\sf{Writes}}_{x}$; because $T,T^{\prime}\in{\sf{Writes}}_{x}$, and $T^{\prime}\xrightarrow{{\sf{AR}}}T$, the definition of $\mathsf{graph}(\mathcal{X})$ implies that it has to be $T^{\prime}\xrightarrow{{\mathsf{WW}}(x)}T$. Since $S\xrightarrow{{\mathsf{RW}}(x)}T^{\prime}$, then $S^{\prime}\xrightarrow{{\mathsf{WR}}(x)}S$, and $S^{\prime}\xrightarrow{{\mathsf{WW}}(x)}T^{\prime}$ for some $S^{\prime}$; because ${\mathsf{WW}}(x)$ is transitive, then $S^{\prime}\xrightarrow{{\mathsf{WW}}(x)}T$. We have proved that $S^{\prime}\xrightarrow{{\mathsf{WR}}(x)}S$, and $S^{\prime}\xrightarrow{{\mathsf{WW}}(x)}T$. By definition, it follows that $S\xrightarrow{{\mathsf{RW}}(x)}T$: together with the hypothesis $T\xrightarrow{{\mathsf{VIS}}}S$, we get a contradiction because the inequality (c.3)  is violated. We have proved that it cannot be $T=T^{\prime}$, nor $T^{\prime}\xrightarrow{{\sf{AR}}}T$. Therefore $T\xrightarrow{{\sf{AR}}}T^{\prime}$, as we wanted to prove. ∎

Proposition C.5**.**

$\mathcal{X}$* satisfies inequalities (c.8)  and (c.9).*

Proof. We only prove the inequality (c.8), as the inequality (c.9)  can be proved in a similar manner.

Suppose that $T\xrightarrow{{\mathsf{VIS}}}V\xrightarrow{\overline{{\mathsf{VIS}}^{-1}}}S$. We prove that $\neg(S\xrightarrow{{\mathsf{VIS}}}T)$, or equivalently $(T\xrightarrow{\overline{{\mathsf{VIS}}^{-1}}}S)$, by contradiction. Let then $S\xrightarrow{{\mathsf{VIS}}}T$. Because $\mathcal{X}$ respects causality, $S\xrightarrow{{\mathsf{VIS}}}T\xrightarrow{{\mathsf{VIS}}}V$ implies that $S\xrightarrow{{\mathsf{VIS}}}V$. But $V\xrightarrow{\overline{{\mathsf{VIS}}^{-1}}}S$ by hypothesis, which causes the contradiction. A graphical representation of the proof is given to the right; here dashed edges are implied by the assumption that $S\xrightarrow{{\mathsf{VIS}}}T$. ∎

Proposition C.6**.**

$\mathcal{X}$* satisfies all the inequalities of Figure 3(c).*

Proof. We have proved that $\mathcal{X}$ satisfies the inequalities (c.1), (c.2)  and (c.7)  in Proposition C.4. The Proof of the inequality (c.3)  was given at Page 3. The inequalities (c.5), (c.6), and (c.12)  are trivial consequences of the definition of abstract execution. The inequalities (c.4)  is satisfied because we are assuming that $\mathcal{X}$ respects causality. The inequality (c.11)  is a trivial consequence of the fact that, for any relation $R\subseteq\mathcal{T}\times\mathcal{T}$, $\overline{R^{-1}}=\{(T,S)\mid(S,T)\notin R\}$; then

[TABLE]

The inequality (c.10)  can be proved similarly. Finally, the inequalities (c.8)  and (c.9)  are satisfied, as we have proved in Proposition C.5. ∎

Proposition C.7**.**

If $\mathcal{X}$ satisfies the consistency guarantee $(\rho,\pi)$, then it also satisfies the inequalities (d.3)  and (d.4).

Proof. We only prove the inequality (d.3). The proof for the inequaiton (d.4)  is similar. Let $T,T^{\prime},S^{\prime},S\in\mathcal{T}$ be such that $T\xrightarrow{{\sf{AR}}}T^{\prime}$, $T^{\prime}\xrightarrow{\pi({\mathsf{VIS}})}S^{\prime}$, $S^{\prime}\xrightarrow{\overline{{\mathsf{VIS}}^{-1}}}S$, and $S\xrightarrow{\rho(\mathcal{T}\times\mathcal{T})}T$.

We need to prove that $T\xrightarrow{\overline{{\mathsf{VIS}}^{-1}}}S$, or equivalently that $\neg(S\xrightarrow{{\mathsf{VIS}}}T)$. The proof goes by contradiction: suppose that $S\xrightarrow{{\mathsf{VIS}}}T$. Then we have that $S\xrightarrow{\rho(\mathcal{T}\times\mathcal{T})\cap{\mathsf{VIS}}}T$, and by Proposition C.1 it follows that $S\xrightarrow{\rho({\mathsf{VIS}})}T$. We have $S\xrightarrow{\rho({\mathsf{VIS}})}T\xrightarrow{{\sf{AR}}}T^{\prime}\xrightarrow{\pi({\mathsf{VIS}})}S^{\prime}$. Because $\mathcal{X}\in{\mathsf{Executions}}(\{\rho,\pi\})$, then $S\xrightarrow{{\mathsf{VIS}}}S^{\prime}$ by Inequality (d.1). But $S^{\prime}\xrightarrow{\overline{{\mathsf{VIS}}^{-1}}}S$ by hypothesis, hence the contradiction. A graphical representation of the proof is given to the right: here dashed edges are implied by the assumption that $S\xrightarrow{{\mathsf{VIS}}}T$. ∎

Proposition C.8**.**

If $\mathcal{X}$ satisfies the consistency guarantee $(\rho,\pi)$, then it satisfies all the inequalities of Figure 3(d), relatively to said consistency guarantee.

Proof. Because $\mathcal{X}$ satisfies the consistency guarantee $(\rho,\pi)$ by hypothesis, then it satisfies the inequality (d.1). It also satisfies the inequality (d.2), as we showed in §4. Finally, it satisfies inequalities (d.3)  and (d.4)  by Proposition C.7. ∎

C.2. Additional Algebraic Laws

Here we prove some additional algebraic laws that can be proved from the laws of Figure 3, and from the axioms of the Kleene Algebra and boolean algebra of set relations. In the following, we assume that $\mathcal{X}=(\mathcal{T},{\mathsf{VIS}},{\sf{AR}})$ is an abstract execution, and $\mathsf{graph}(\mathcal{X})=(\mathcal{T},{\mathsf{WR}},{\mathsf{WW}},{\mathsf{RW}})$. Given two relations $R_{1},R_{2}\subseteq\mathcal{T}\times\mathcal{T}$, we recall that we use the notation $R_{1}\stackrel{{\scriptstyle\textbf{(eq)}}}{{\subseteq}}R_{2}$ ($R_{1}\stackrel{{\scriptstyle\textbf{(eq)}}}{{=}}R_{2}$) to denote the fact that $R_{1}\subseteq R_{2}$ ($R_{1}=R_{2}$) follows from the (in)equality (eq). Sometimes we omit the complete sequence of steps needed to derive an inequality, when these can be easily inferred. For example, we write ${\mathsf{WR}}\stackrel{{\scriptstyle{\textbf{(c.1)}}}}{{\subseteq}}{\mathsf{VIS}}$, instead of the whole sequence of inclusions needed to prove such an inequality, namely

[TABLE]

Proposition C.9**.**

For all relations $R_{1},R_{2}\subseteq\mathcal{T}\times\mathcal{T}$,

[TABLE]

Proof. Suppose $(R_{1}\mathrel{;}R_{2})\cap\mathsf{Id}\subseteq\emptyset$. For any $T\in\mathcal{T}$, there exists no $S\in\mathcal{T}$ such that $(T,S)\in R_{1}$ and $(S,T)\in R_{2}$. In particular, there exists no $S\in T$ such that $(S,T)\in R_{2},(T,S)\in R_{1}$, for all $T\in\mathcal{T}$: equivalently, $(S,S)\notin(R_{2}\mathrel{;}R_{1})$ for all $S\in\mathcal{T}$. That is, $(R_{2}\mathrel{;}R_{1})\cap\mathsf{Id}\subseteq\emptyset$. ∎

Proposition C.10**.**

For any set $\mathcal{T}^{\prime}\subseteq\mathcal{T}$,

[TABLE]

Proof. ${[\mathcal{T}^{\prime}]}={[\mathcal{T}^{\prime}\cap\mathcal{T}^{\prime}]}\stackrel{{\scriptstyle{\textbf{(a.2)}}}}{{=}}{[\mathcal{T}^{\prime}]}\mathrel{;}{[\mathcal{T}^{\prime}]}.$ ∎

Proposition C.11**.**

For any relation $R\subseteq\mathcal{T}\times\mathcal{T}$,

[TABLE]

Proof. Suppose $R\cap\mathsf{Id}=\emptyset$. Then

[TABLE]

Now, suppose that $R\subseteq R\setminus\mathsf{Id}$. Then

[TABLE]

Most of the time we will omit applications of the implications given by equation (7). For example, we write ${\sf{AR}}\stackrel{{\scriptstyle{\textbf{(c.12)}}}}{{\subseteq}}{\sf{AR}}\setminus\mathsf{Id}$ instead of

[TABLE]

Other examples of inequalities that we can prove using equation (7) are given below:

[TABLE]

Proposition C.12**.**

Let $\Sigma$ be a x-specification such that $(\rho_{x},\rho_{x})\in\Sigma$, for some object $x\in\mathsf{Obj}$. If $\mathcal{X}\in{\mathsf{Executions}}(\Sigma)$, then

[TABLE]

Proof. Recall that $\rho_{x}(\_)={[{\sf{Writes}}_{x}]}$. Because $(\rho_{x},\rho_{x})\in\Sigma$, then

[TABLE]

∎

Corollary C.13**.**

Let $\Sigma$ be a consistency model such that $(\rho_{x},\rho_{x})\in\Sigma$ for all $x\in\mathsf{Obj}$. If $\mathcal{X}\in{\mathsf{Executions}}(\Sigma)$, then

[TABLE]

Proof. If $\mathcal{X}\in{\mathsf{Executions}}(\Sigma)$, then

[TABLE]

Corollary C.14**.**

Let $\Sigma$ be a consistency model such that $(\rho_{x},\rho_{x})\in\Sigma$ for any $x\in\mathsf{Obj}$. If $\mathcal{X}\in{\mathsf{Executions}}(\Sigma)$, then

[TABLE]

Proof. If $\mathcal{X}\in{\mathsf{Executions}}(\Sigma)$, then

[TABLE]

Some proofs of the robustness criteria we present require the following theorem from Kleene Algebra:

Theorem C.15** ([22]).**

For any relations $R_{1},R_{2}\subseteq\mathcal{T}\times\mathcal{T}$,

[TABLE]

Proof. Recall that $(R_{1}\mathrel{;}R_{2})^{+}=\bigcup_{n>0}(R_{1}\mathrel{;}R_{2})^{n}$, and $(R_{2}\mathrel{;}R_{1})^{\ast}=\bigcup_{n\geq 0}(R_{2}\mathrel{;}R_{1})^{n}$. We prove, by induction on $n$, that for all $n>0$, $(R_{1}\mathrel{;}R_{2})^{n}=(R_{1}\mathrel{;}(R_{2}\mathrel{;}R_{1})^{n-1}\mathrel{;}R_{2})$. Then we have

[TABLE]

**Case $n=1$:: **

[TABLE]

**Case $n>1$:: **

suppose that

[TABLE]

Then

[TABLE]

C.3. Robustness Criteria of x-Specifications

In this Section we show several applications of the algebraic laws for inferring robustness criteria for several x-specification. We start by giving alternative proofs of previously known results (theorems C.16 and C.17). Then we present and prove novel robustness criteria for other x-specifications (theorems C.19 and C.20).

Theorem C.16** ([19]).**

For all $\mathcal{X}\in{\mathsf{Executions}}(\Sigma_{\mathsf{SI}})$, every cycle in $\mathsf{graph}(\mathcal{X})$ has two consecutive ${\mathsf{RW}}_{\mathcal{X}}$ edges. That is, $(({\mathsf{WR}}_{\mathcal{X}}\cup{\mathsf{WW}}_{\mathcal{X}})\mathrel{;}{\mathsf{RW}}_{\mathcal{X}}?)$ is acyclic.

Proof. Recall that $\Sigma_{\mathsf{SI}}=\{(\rho_{\mathsf{Id}},\rho_{\mathsf{SI}})\}\cup\{(\rho_{x},\rho_{x})\}_{x\in\mathsf{Obj}}$, where $\rho_{\mathsf{Id}}(\_)=\mathsf{Id}$ and $\rho_{\mathsf{SI}}(R)=R\setminus\mathsf{Id}$. If $\mathcal{X}\in{\mathsf{Executions}}(\Sigma_{\mathsf{SI}})$, then

[TABLE]

Theorem C.17** ([8]).**

For all $\mathcal{X}\in{\mathsf{Executions}}(\Sigma_{{\mathsf{PSI}}})$, it is not possible that all anti-dependencies in a cycle of $\mathsf{graph}(\mathcal{X})$ are over the same object666This implies that all cycles have at least two anti-dependencies.: $({\mathsf{WR}}_{\mathcal{X}}\cup{\mathsf{WW}}_{\mathcal{X}})^{\ast}\mathrel{;}{\mathsf{RW}}(x)$ is acyclic for all $x\in\mathsf{Obj}$.

Proof. Recall that $\Sigma_{{\mathsf{PSI}}}=\{(\rho_{x},\rho_{x})\}_{x\in\mathsf{Obj}}$, where $\rho_{x}(\_)={[{\sf{Writes}}_{x}]}$. Then

[TABLE]

Definition C.18**.**

Let $\mathcal{X}\in\Sigma_{{\mathsf{RB}}}$, and suppose that $\mathsf{graph}(\mathcal{X})$ contains a cycle $T_{0}\xrightarrow{R_{0}}\cdots\xrightarrow{R_{n-1}}T_{n}$, where $T_{0}=T_{n}$ and $R_{i}\in\{{\mathsf{WR}}_{\mathcal{X}},{\mathsf{WW}}_{\mathcal{X}},{\mathsf{RW}}_{\mathcal{X}}\}$ for any $i=0,\cdots,n-1$. We recall the following definition of protected anti-dependency edge in the cycle, and also introduce the notion of protected ${\mathsf{WW}}$-dependencies.

• •

an anti-dependency edge $R_{i}={\mathsf{RW}}_{\mathcal{X}}$ is protected if there exist two integers $j,k=0,\cdots,n-1$ such that $(T_{(i-j)\,\mathsf{mod}\,{n}})\ni{{\tt SerTx}},(T_{((i+1)+k)\,\mathsf{mod}\,n})\ni{{\tt SerTx}}$, and for all $h=(i-j),\cdots,(i+k+1)$, $R_{h\,\mathsf{mod}\,n}={\mathsf{WR}}_{\mathcal{X}}$; in other words, in the cycle the endpoints of the $R_{i}$ anti-dependency edge are connected to serialisable transactions by a sequence of ${\mathsf{WR}}$-dependencies,

• •

a ${\mathsf{WW}}$-dependency edge $R_{i}={\mathsf{WW}}_{\mathcal{X}}$ is protected if tere exist two integers $j,k=0,\cdots,n-1$ such that $(T_{(i-j)\,\mathsf{mod}\,n})\ni{{\tt SerTx}},(T_{((i+1)+k)\,\mathsf{mod}\,n})\ni{{\tt SerTx}}$, and for all $h=(i-j),\cdots,(i+k+1)$, $R_{h\,\mathsf{mod}\,n}\in\{{\mathsf{WR}}_{\mathcal{X}},{\mathsf{WW}}_{\mathcal{X}}\}$; in other words, in the cycle the endpoints of the $R_{i}$ dependency edge are connected to serialisable transactions by a sequence of both ${\mathsf{WR}}$-dependencies and ${\mathsf{WW}}$-dependencies.

Theorem C.19**.**

Let $\mathcal{X}\in{\mathsf{Executions}}(\Sigma_{{\mathsf{RB}}})$. Then any cycle in $\mathsf{graph}(\mathcal{X})$ contains at least one unprotected anti-dependency edge, and another edge that is either an unprotected anti-dependency, or an unprotected ${\mathsf{WW}}$-dependency. Formally, given a relation $R\subseteq\mathcal{T}_{\mathcal{X}}\times\mathcal{T}_{\mathcal{X}}$, let ${\Vdash{R}\dashV}={[{{\tt SerTx}}]}\mathrel{;}{\mathsf{WR}}_{\mathcal{X}}^{\ast}\mathrel{;}R\mathrel{;}{\mathsf{WR}}_{\mathcal{X}}^{\ast}\mathrel{;}{[{{\tt SerTx}}]}$. then

[TABLE]

Proof. Recall that $\Sigma_{{\mathsf{RB}}}=\{(\rho_{S},\rho_{S})\}$, where $\rho_{S}(\_)={[{{\tt SerTx}}]}$. In the proof of Theorem 4.2 we proved the following fact:

[TABLE]

which we will need to prove Theorem C.19. We have

[TABLE]

[TABLE]

So far, none of the robustness criteria that we have derived has exploited the inequalities (d.3)  and (d.4)  from Figure 3. Here we give another example of x-specification, for which we can derive a robustness criterion which makes use of the inequalities (d.3)  and (d.4). Such a x-specification is given by $\Sigma_{\mathsf{CP}}=\{(\rho_{\mathsf{Id}},\rho_{\mathsf{SI}}),(\rho_{S},\rho_{S})\}$. The set of executions ${\mathsf{Executions}}(\Sigma_{\mathsf{CP}})$ coincides with the definition of the Consistent Prefix consistency model given in [8]. The x-specification $\Sigma_{\mathsf{CP}}$ can be thought as a weakening of $\Sigma_{\mathsf{SI}+\mathsf{SER}}$ which does not have any write conflict detection.

Theorem C.20**.**

Let $\mathcal{X}=(\mathcal{T},{\mathsf{VIS}},{\sf{AR}})\in{\mathsf{Executions}}(\Sigma_{\mathsf{CP}})$. We say that a path $T_{0}\xrightarrow{R_{0}}\cdots\xrightarrow{R_{n-1}}T_{n}$ of $\mathsf{graph}(\mathcal{X})$, is critical if $T_{0}\neq T_{n}$, both $T_{0},T_{n}\ni{{\tt SerTx}}$, only one of the edges $R_{i},0\leq i<n$ is an anti-dependency, and none of the edges $R_{j},0\leq j<i$ is a ${\mathsf{WW}}$-edge (note that if $j>i$, we allow $R_{j}={\mathsf{WW}}_{\mathcal{X}}$). Then all cycles of $\mathsf{graph}(\mathcal{X})$ have at least one anti-dependency edge that is not contained within a critical sub-path of the cycle.

Formally, let $\mathsf{CSub}_{\mathcal{X}}=({[{{\tt SerTx}}]}\mathrel{;}{\mathsf{WR}}^{\ast}\mathrel{;}{\mathsf{RW}}\mathrel{;}({\mathsf{WW}}\cup{\mathsf{WR}})^{\ast}\mathrel{;}{[{{\tt SerTx}}]})\setminus\mathsf{Id}$, where $\mathsf{graph}(\mathcal{X})=(\mathcal{T},{\mathsf{WR}},{\mathsf{WW}},{\mathsf{RW}})$. Then $({\mathsf{WR}}\cup{\mathsf{WW}}\cup\mathsf{CSub}_{\mathcal{X}})$ is acyclic.

Proof. By Definition, $\Sigma_{\mathsf{CP}}=\{(\rho_{S},\rho_{S}),(\rho_{\mathsf{Id}},\rho{\mathsf{SI}})\}$, where $\rho_{S}(\_)={[{{\tt SerTx}}]}$, $\rho_{\mathsf{Id}}(\_)=\mathsf{Id}$ and $\rho_{\mathsf{SI}}(R)=R\setminus\mathsf{Id}$. This implies that $\rho_{\mathsf{SI}}(\mathcal{T}\times\mathcal{T})^{-1}=((\mathcal{T}\times\mathcal{T})\setminus\mathsf{Id})^{-1}=(\mathcal{T}\times\mathcal{T})\setminus\mathsf{Id}$, and for any relation $R\subseteq\mathcal{T}\times\mathcal{T}$,

[TABLE]

For $\mathcal{X}\in{\mathsf{Executions}}(\Sigma_{\mathsf{CP}})$, we have:

[TABLE]

[TABLE]

Appendix D Proofs of Results for Simple x-Specifications

Let $X\subseteq\mathsf{Obj}$ and suppose that $(\rho,\pi)$ is a consistency guarantee. Throughout this section we will work with the (simple) x-specification $\Sigma=\{(\rho_{x},\rho_{x})\}_{x\in X}\cup\{(\rho,\pi)\}$, although all the results apply to the x-specification $\Sigma^{\prime}=\{(\rho_{x},\rho_{x})\}_{x\in X}$ which does not contain any consistency guarantee, aside from those enforcing the write conflict detection property over the objects included in $X$.

D.1. Proof of Proposition 5.4

Let $\mathcal{G}=(\mathcal{T},{\mathsf{WR}},{\mathsf{WW}},{\mathsf{RW}})$ be a dependency graph.

Recall the following definition of valid pre-execution:

Definition D.1**.**

a pre-execution is a quadruple $\mathcal{P}=(\mathcal{T},{\mathsf{VIS}},{\sf{AR}})$ such that

1. (1)

${\mathsf{VIS}}\subseteq{\sf{AR}}$, 2. (2)

${\mathsf{VIS}}$* and ${\sf{AR}}$ are strict partial orders,* 3. (3)

for any object $x\in\mathsf{Obj}$, ${\sf{AR}}$ is total over the set ${\sf{Writes}}_{x}$, 4. (4)

$\mathcal{P}$* satisfies the Last Write Wins property: for any $T\in\mathcal{T}$, if $T\ni({{\tt read}}\;x:n)$ then $S:=\max_{{\sf{AR}}}({\mathsf{VIS}}^{-1}(T)\cap{\sf{Writes}}_{x})$ is well defined, and $S\ni{{\tt write}}\;x:n$.*

The proof of Proposition 5.4 relies on the following auxiliary result:

Proposition D.2**.**

Let $(X_{V}={\mathsf{VIS}},X_{A}={\sf{AR}},X_{N}=\mathsf{AntiVIS})$ be a solution of $\mathsf{System}_{\Sigma}(\mathcal{G})$. If ${\sf{AR}}\cap\mathsf{Id}$ is acyclic, then $\mathcal{P}=(\mathcal{T},{\mathsf{VIS}},{\sf{AR}})$ is a valid pre-execution.

Proof. Because $(X_{V}={\mathsf{VIS}},X_{A}={\sf{AR}},X_{N}=\mathsf{AntiVIS})$ is a solution of $\mathsf{System}_{\Sigma}(\mathcal{G})$, all the inequalities in the latter are satisfied when substituting the relations ${\mathsf{VIS}},{\sf{AR}},\mathsf{AntiVIS}$ for the unknowns $X_{V},X_{A},X_{N}$, respectively. We prove that all the properties (1)-(4) from Definition D.1 is satisfied by $\mathcal{P}=(\mathcal{T},{\mathsf{VIS}},{\sf{AR}})$.

1. (1)

${\mathsf{VIS}}\subseteq{\sf{AR}}$: this follows directly from the inequality (A2), 2. (2)

${\mathsf{VIS}},{\sf{AR}}$ are strict partial orders (i.e. they are irreflexive and transitive): the relation ${\sf{AR}}$ is irreflexive by hypothesis, and transitive because of the inequality (A4). The relation ${\mathsf{VIS}}$ is irreflexive because of the inequality (A2)  and the assumption that ${\sf{AR}}\cap\mathsf{Id}\subseteq\emptyset$; ${\mathsf{VIS}}$ is also transitive because of the inequality (V2), 3. (3)

${\sf{AR}}$ is a strict total order order over the set ${\sf{Writes}}_{x}$, for any $x\in\mathsf{Obj}$: we prove that ${\sf{AR}}\cap({\sf{Writes}}_{x}\times{\sf{Writes}}_{x})={\mathsf{WW}}(x)$; then the claim follows because ${\mathsf{WW}}(x)$ is a strict total order over ${\sf{Writes}}_{x}$ by definition. Let then $x\in\mathsf{Obj}$. For all $T,T^{\prime}\in\mathcal{T}$ such that $T\xrightarrow{{\mathsf{WW}}(x)}T^{\prime}$, we have that $T\in{\sf{Writes}}_{x},T^{\prime}\in{\sf{Writes}}_{x}$, and $T\xrightarrow{{\sf{AR}}}T^{\prime}$ because of the inequality (A1). This proves that ${\mathsf{WW}}(x)\subseteq{\sf{AR}}\cap({\sf{Writes}}_{x}\times{\sf{Writes}}_{x})$. For the opposite implication, let $T,T^{\prime}\in\mathcal{T}$ be transactions such that $T\in{\sf{Writes}}_{x},T^{\prime}\in{\sf{Writes}}_{x}$ and $T\xrightarrow{{\sf{AR}}}T^{\prime}$. Because ${\mathsf{WW}}(x)$ is a strict total order over ${\sf{Writes}}_{x}$ by hypothesis, then either $T=T^{\prime},T^{\prime}\xrightarrow{{\mathsf{WW}}(x)}T$, or $T\xrightarrow{{\mathsf{WW}}(x)}T^{\prime}$. Because $T\xrightarrow{{\sf{AR}}}T^{\prime}$ and because ${\sf{AR}}\cap\mathsf{Id}\subseteq\emptyset$ by hypothesis, then $T\neq T^{\prime}$. Also, it cannot be $T^{\prime}\xrightarrow{{\mathsf{WW}}(x)}T$. By the inequality (A1)  this would imply that $T^{\prime}\xrightarrow{{\sf{AR}}}T$, and because of the assumption $T\xrightarrow{{\sf{AR}}}T^{\prime}$ and the inequality (A4), this would mean that $T^{\prime}\xrightarrow{{\sf{AR}}}T^{\prime}$, contradicting the assumption that ${\sf{AR}}\cap\mathsf{Id}\subseteq\emptyset$, 4. (4)

$\mathcal{P}$ satisfies the Last Write Wins property: let $T\in\mathcal{T}$ be a transaction such that $T\ni({{\tt read}}\;x:n)$. By Definition 3.1 there exists a transaction $S$ such that $S\ni{{\tt write}}\;x:n$ and $S\xrightarrow{{\mathsf{WR}}(x)}T$. By Equation (V1), we have that ${\mathsf{WR}}\subseteq{\mathsf{VIS}}$, hence $S\xrightarrow{{\mathsf{VIS}}}T$. Because $S\xrightarrow{{\mathsf{VIS}}}T$ and $S\ni({{\tt write}}\;x:n)$, we have that $S\in({\mathsf{VIS}}^{-1}(T)\cap{\sf{Writes}}_{x})$, and in particular $({\mathsf{VIS}}^{-1}(T)\cap{\sf{Writes}}_{x})\neq\emptyset$. Because $({\mathsf{VIS}}^{-1}(T)\cap{\sf{Writes}}_{x})\neq\emptyset$, and because by (3) above we have that ${\sf{AR}}\cap({\sf{Writes}}_{x}\times{\sf{Writes}}_{x})={\mathsf{WW}}(x)$, then the entity $S^{\prime}=\max_{{\sf{AR}}}({\mathsf{VIS}}^{-1}(T)\cap{\sf{Writes}}_{x})$ is well-defined. It remains to prove that $S^{\prime}\ni({{\tt write}}\;x:n)$. To this end, we show that that $S=S^{\prime}$ (recall that $S$ is the unique transaction such that $S\xrightarrow{{\mathsf{WR}}(x)}T$), and observe that $S\ni({{\tt write}}\;x:n)$, from which the claim follows. Because $S,S^{\prime}\in{\sf{Writes}}_{x}$ and ${\mathsf{WW}}(x)$ coincides with the restriction of ${\sf{AR}}$ to the set ${\sf{Writes}}_{x}$, we obtain that either $S^{\prime}\xrightarrow{{\sf{AR}}}S$, $S\xrightarrow{{\sf{AR}}}S^{\prime}$ or $S=S^{\prime}$. The first case is not possible, because $S\in{\mathsf{VIS}}^{-1}(T)\cap{\sf{Writes}}_{x}$, and $S^{\prime}=\max_{{\sf{AR}}}({\mathsf{VIS}}^{-1}(T)\cap{\sf{Writes}}_{x})$. The second case is also not possible: if $S\xrightarrow{{\sf{AR}}}S^{\prime}$ then $S\xrightarrow{{\mathsf{WW}}(x)}S^{\prime}$; together with $S\xrightarrow{{\mathsf{WR}}(x)}T$ this implies that there is an anti-dependency edge $T\xrightarrow{{\mathsf{RW}}(x)}S^{\prime}$; now we have that $S^{\prime}\in{\sf{Writes}}_{x}$, and $S^{\prime}\xrightarrow{{\mathsf{VIS}}}T\xrightarrow{{\mathsf{RW}}(x)}S^{\prime}$: that is, $(S^{\prime},S^{\prime})\in{[{\sf{Writes}}_{x}]}\mathrel{;}{\mathsf{VIS}}\mathrel{;}{\mathsf{WR}}(x)$. By the inequation (A3), this implies that $S^{\prime}\xrightarrow{{\sf{AR}}}S^{\prime}$, contradicting the assumption that ${\sf{AR}}\cap\mathsf{Id}\subseteq\emptyset$. We are left with the only possibility $S=S^{\prime}$, which is exactly what we wanted to prove. ∎

Proof of Proposition 5.4. Let $\mathcal{P}:=(\mathcal{T},{\mathsf{VIS}},{\sf{AR}})$. By Proposition D.2 we know that $\mathcal{P}$ is a valid pre-execution. We need to show that $\mathcal{P}\in\mathsf{PreExecutions}(\Sigma)$, and $\mathsf{graph}(\mathcal{P})$ is well-defined and equal to $\mathcal{G}=(\mathcal{T},{\mathsf{WR}},{\mathsf{WW}},{\mathsf{RW}})$. To show that $\mathcal{P}\in\mathsf{PreExecutions}(\Sigma)$, we need to show the following:

1. (1)

$\mathcal{P}$ satisfies the consistency guarantee $(\rho_{x},\rho_{x})$ for any object $x\in X$: that is, given $x\in X$, then ${[{\sf{Writes}}_{x}]}\mathrel{;}{\sf{AR}}\mathrel{;}{[{\sf{Writes}}_{x}]}\subseteq{\mathsf{VIS}}$ Let then $x\in X$, and consider two transactions $T,S$ be such that $T\xrightarrow{{\sf{AR}}}S$, and $T,S\in{\sf{Writes}}_{x}$: we show that $T\xrightarrow{{\mathsf{VIS}}}S$. Because ${\sf{AR}}\cap\mathsf{Id}\subseteq\emptyset$, then $T\neq S$. Also, it cannot be $S\xrightarrow{{\mathsf{WW}}(x)}T$: by inequation (A1)  this would imply that $S\xrightarrow{{\sf{AR}}}T$; by inequation (A4)  and the assumption that $T\xrightarrow{{\sf{AR}}}S$, this would lead to $S\xrightarrow{{\sf{AR}}}S$, contradicting the assumption that ${\sf{AR}}\cap\mathsf{Id}=\emptyset$. We have proved that $T,S\in{\sf{Writes}}_{x}$, $T\neq S$ and $\neg(S\xrightarrow{{\mathsf{WW}}(x)}T)$: since ${\mathsf{WW}}(x)$ is a total order over the set ${\sf{Writes}}_{x}$, it must be $T\xrightarrow{{\mathsf{WW}}(x)}S$. It follows from the inequation (V3)  that $T\xrightarrow{{\mathsf{VIS}}}S$, 2. (2)

$\rho({\mathsf{VIS}})\mathrel{;}{\sf{AR}}\mathrel{;}\pi({\mathsf{VIS}})\subseteq{\mathsf{VIS}}$; this inequality is directly enforced by the inequation (V4).

Therefore, $\mathcal{P}$ is a valid pre-execution that satisfies all the consistency guarantees of the x-specification $\Sigma=\{(\rho_{{\sf{Writes}}_{x}},\rho_{{\sf{Writes}}_{x}})\}_{x\in X}\cup\{(\rho,\pi)\}$. By definition, $\mathcal{P}\in\mathsf{PreExecutions}(\Sigma)$.

Next, we show that $\mathsf{graph}(\mathcal{P})$ is well-defined and equal to $\mathcal{G}$. To this end, let $\mathcal{G}^{\prime}:=\mathsf{graph}(\mathcal{P})$. The proof that $\mathcal{G}^{\prime}$ is a well-defined dependency graph is analogous to the one given for abstract executions in [17, extended version, Proposition 23].

It remains to prove that $\mathcal{G}^{\prime}=\mathcal{G}$; to this end, it suffices to show that for any $x\in\mathsf{Obj}$, ${\mathsf{WR}}_{\mathcal{G}}(x)={\mathsf{WR}}_{\mathcal{G}^{\prime}}(x)$, and ${\mathsf{WW}}_{\mathcal{G}}(x)={\mathsf{WW}}_{\mathcal{G}^{\prime}}(x)$.

Let $T,S$ be two entities such that $T\xrightarrow{{\mathsf{WR}}_{\mathcal{G}}(x)}S$. By definition, $S\ni({{\tt read}}\;x:n)$, and $T\ni({{\tt write}}\;x:n)$ for some $n$. Also, let $T^{\prime}\ni({{\tt write}}\;x:n)$ be the entity such that $T^{\prime}\xrightarrow{{\mathsf{WR}}_{\mathcal{G}^{\prime}}(x)}S$, which exists because $S\ni({{\tt read}}\;x:n)$ and $\mathcal{G}^{\prime}$ is a well-defined dependency graph. By definition, $T^{\prime}=\max_{{\sf{AR}}}({\mathsf{VIS}}^{-1}(S)\cap{\sf{Writes}}_{x})$, and in particular $T^{\prime}\xrightarrow{{\mathsf{VIS}}}S$.

Since $T,T^{\prime}\ni({{\tt write}}\;x:n)$, we have that either $T=T^{\prime}$, $T\xrightarrow{{\mathsf{WW}}_{\mathcal{G}}(x)}T^{\prime}$, or $T^{\prime}\xrightarrow{{\mathsf{WW}}_{\mathcal{G}}(x)}T$. We prove that the first case is the only possible one:

• •

if $T\xrightarrow{{\mathsf{WW}}_{\mathcal{G}}(x)}T^{\prime}$, then by definition, the edges $T\xrightarrow{{\mathsf{WR}}_{\mathcal{G}}(x)}S$ and $T\xrightarrow{{\mathsf{WW}}_{\mathcal{G}}(x)}T^{\prime}$ induce the anti-dependency $S\xrightarrow{{\mathsf{RW}}_{\mathcal{G}}(x)}T^{\prime}$. However, now we have that $T^{\prime}\ni({{\tt write}}\;x:\_)$, $T^{\prime}\xrightarrow{{\mathsf{VIS}}}S$ and $S\xrightarrow{{\mathsf{RW}}_{\mathcal{G}}(x)}T^{\prime}$: by the inequation (A3), it follows that $T^{\prime}\xrightarrow{{\sf{AR}}}T^{\prime}$, contradicting the assumption that ${\sf{AR}}\cap\mathsf{Id}\subseteq\emptyset$,

• •

if $T^{\prime}\xrightarrow{{\mathsf{WW}}_{\mathcal{G}}(x)}T$, then note that by the inequation (A1)  it has to be $T^{\prime}\xrightarrow{{\sf{AR}}}T$; also, because of the dependency $T\xrightarrow{{\mathsf{WR}}_{\mathcal{G}}(x)}S$ and the inequality (V1), it has to be $T\xrightarrow{{\mathsf{VIS}}}S$; but this contradicts the assumption that $T^{\prime}=\max_{{\sf{AR}}}({\mathsf{VIS}}^{-1}(S)\cap{\sf{Writes}}_{x})$.

We are left with the case $T=T^{\prime}$, from which $T\xrightarrow{{\mathsf{WR}}_{\mathcal{G}^{\prime}}(x)}S$ follows.

Next, suppose that $T^{\prime}\xrightarrow{{\mathsf{WR}}_{\mathcal{G}^{\prime}}(x)}S$. Then $S\ni{{\tt read}}\;x:n$ for some $n$, and because $\mathcal{G}$ is a dependency graph, there exists an entity $T$ such that $T\xrightarrow{{\mathsf{WR}}_{\mathcal{G}}(x)}S$. We can proceed as in the previous case to show that $T=T^{\prime}$, hence $T^{\prime}\xrightarrow{{\mathsf{WR}}_{\mathcal{G}}(x)}T$.

Finally, we need to show that ${\mathsf{WW}}_{\mathcal{G}^{\prime}}(x)={\mathsf{WW}}_{\mathcal{G}}(x)$. First, note that if $T\xrightarrow{{\mathsf{WW}}_{\mathcal{G}}(x)}S$, then $T,S\in{\sf{Writes}}_{x}$. By the inequation (A1)  we obtain that $T\xrightarrow{{\sf{AR}}}S$, so that $T\xrightarrow{{\mathsf{WW}}_{\mathcal{G}^{\prime}}(x)}S$ by definition of $\mathsf{graph}(\mathcal{P})$.

If $T\xrightarrow{{\mathsf{WW}}_{\mathcal{G}^{\prime}}(x)}S$, then it has to be the case that $T\xrightarrow{{\sf{AR}}}S$, $T,S\in{\sf{Writes}}_{x}$. Since ${\mathsf{WW}}_{\mathcal{G}}(x)$ is total over ${\sf{Writes}}_{x}$, then either $T=S,S\xrightarrow{{\mathsf{WW}}_{\mathcal{G}}(x)}T$ or $T\xrightarrow{{\mathsf{WW}}_{\mathcal{G}}(x)}S$. However, the first case is not possible because it would imply $T\xrightarrow{{\sf{AR}}}T$, contradicting the assumption that ${\sf{AR}}\cap\mathsf{Id}\subseteq\emptyset$. The second case is not possible either, because by the inequality (A1)  we would get that $S\xrightarrow{{\sf{AR}}}T\xrightarrow{{\sf{AR}}}S$, and by the inequality (A4)  $S\xrightarrow{{\sf{AR}}}S$, again contradicting the assumption that ${\sf{AR}}\cap\mathsf{Id}\subseteq\emptyset$. We are left with $T\xrightarrow{{\mathsf{WW}}_{\mathcal{G}}(x)}S$, as we wanted to prove.

The fact that ${\mathsf{RW}}_{\mathcal{G}}={\mathsf{RW}}_{\mathcal{G}^{\prime}}$ follows from the observation that, for any object $x\in\mathsf{Obj}$, ${\mathsf{RW}}_{\mathcal{G}}(x)={\mathsf{WR}}_{\mathcal{G}}^{-1}(x)\mathrel{;}{\mathsf{WW}}_{\mathcal{G}}(x)={\mathsf{WR}}_{\mathcal{G}^{\prime}}^{-1}(x)\mathrel{;}{\mathsf{WW}}_{\mathcal{G}^{\prime}}(x)={\mathsf{RW}}_{\mathcal{G}^{\prime}}(x)$. ∎

D.2. Proof of Proposition 5.5

In the following, we let $\mathcal{G}=(\mathcal{T},{\mathsf{WR}},{\mathsf{WW}},{\mathsf{RW}})$, and we assume that $(X_{V}={\mathsf{VIS}},X_{A}={\sf{AR}},X_{N}=\mathsf{AntiVIS})$ is a solution of $\mathsf{System}_{\Sigma(\mathcal{G})}$ such that ${\sf{AR}}\cap\mathsf{Id}=\emptyset$. Also, we assume that there exist two transactions $T,S$ such that $T\neq S$, $\neg(T\xrightarrow{{\sf{AR}}}S)$, and $\neg(S\xrightarrow{{\sf{AR}}}T)$. The proof of Proposition 5.5 is a direct consequence of the following result, which we will prove in this section:

Proposition D.3**.**

*Define the following relations: *

• •

$\partial A=\{(T,S)\}$,

• •

$\Delta A={\sf{AR}}?\mathrel{;}\partial A\mathrel{;}{\sf{AR}}?$,

• •

${\sf{AR}}_{\nu}={\sf{AR}}\cup\Delta{\sf{AR}}$,

• •

$\partial V=\rho({\mathsf{VIS}})\mathrel{;}\Delta A\mathrel{;}\pi({\mathsf{VIS}})$,

• •

$\Delta V={\mathsf{VIS}}?\mathrel{;}\partial V\mathrel{;}{\mathsf{VIS}}?$,

• •

${\mathsf{VIS}}_{\nu}={\mathsf{VIS}}\cup\Delta V$,

• •

$\mathsf{AntiVIS}_{\nu}={\mathsf{VIS}}_{\nu}?\mathrel{;}{\mathsf{RW}}\mathrel{;}{\mathsf{VIS}}_{\nu}?$.

Then $(X_{V}={\mathsf{VIS}}_{\nu},X_{A}={\sf{AR}}_{\nu},X_{N}=\mathsf{AntiVIS}_{\nu})$ is a solution to $\mathsf{System}_{\Sigma}(\mathcal{G})$. Furthermore, it is the smallest solution for which the relation corresponding to the unknown $X_{A}$ contains the relation $({\sf{AR}}\cup\partial A)$.

Before proving Proposition D.3, we need to prove several technical lemmas.

Lemma D.4** ($\partial$-Cut).**

For any relations $R,P,Q\subseteq\mathcal{T}\times\mathcal{T}$ we have that $(R\mathrel{;}\partial A\mathrel{;}Q\mathrel{;}\partial A\mathrel{;}P)\subseteq(R\mathrel{;}\partial A\mathrel{;}P)$, and $(R\mathrel{;}\partial V\mathrel{;}Q\mathrel{;}\partial V\mathrel{;}P)\subseteq(R\mathrel{;}\partial V\mathrel{;}P)$.

Proof. Recall that $\partial A=\{(T,S)\}$, where $T,S$ are not related by ${\sf{AR}}$. That is, whenever $T^{\prime\prime}\xrightarrow{\partial A}S^{\prime\prime}$, for some $T^{\prime\prime},S^{\prime\prime}\in\mathcal{T}$, then $T^{\prime\prime}=T,S^{\prime\prime}=S$. It follows that $(T^{\prime},S^{\prime})\in(R\mathrel{;}\partial A\mathrel{;}Q\mathrel{;}\partial A\mathrel{;}P)$ if and only if $T^{\prime}\xrightarrow{R}T\xrightarrow{\partial A}S\xrightarrow{Q}T\xrightarrow{\partial A}S\xrightarrow{P}S^{\prime}$. As a consequence, $T^{\prime}\xrightarrow{R}T\xrightarrow{\partial A}S\xrightarrow{P}S^{\prime}$, as we wanted to prove.

Next, recall that $\partial V=\rho({\mathsf{VIS}})\mathrel{;}\Delta A\mathrel{;}\pi({\mathsf{VIS}})$, where $\Delta A={\sf{AR}}?\mathrel{;}\partial A\mathrel{;}{\sf{AR}}?$. That is, $\partial V=\rho({\mathsf{VIS}})\mathrel{;}{\sf{AR}}?\mathrel{;}\partial A\mathrel{;}{\sf{AR}}?\mathrel{;}\pi({\mathsf{VIS}})$. If we apply the statement above to the relations $R^{\prime}:=(R\mathrel{;}\rho({\mathsf{VIS}})\mathrel{;}{\sf{AR}}?)$, $Q^{\prime}:=({\sf{AR}}?\mathrel{;}\pi({\mathsf{VIS}})\mathrel{;}Q\mathrel{;}\rho({\mathsf{VIS}})\mathrel{;}{\sf{AR}}?)$, $P^{\prime}:=({\sf{AR}}?\mathrel{;}\pi({\mathsf{VIS}})\mathrel{;}P)$, we obtain that

[TABLE]

Corollary D.5**.**

*The relations ${\sf{AR}}_{\nu}$ and ${\mathsf{VIS}}_{\nu}$ are transitive. *

Proof. We only show the result for ${\sf{AR}}_{\nu}$. The statement relative to ${\mathsf{VIS}}_{\nu}$ can be proved analogously.

It suffices to show that ${\sf{AR}}_{\nu}\mathrel{;}{\sf{AR}}_{\nu}=({\sf{AR}}\cup\Delta A)\mathrel{;}({\sf{AR}}\cup\Delta A)\subseteq({\sf{AR}}\cup\Delta{\sf{AR}})$. By distributivity of $\mathrel{;}$ with respect to $\cup$, this reduces to prove the following four inclusions:

• •

$({\sf{AR}}\mathrel{;}{\sf{AR}})\subseteq({\sf{AR}}\cup\Delta{\sf{AR}})$. Recall that $(X_{V}={\mathsf{VIS}},X_{A}={\sf{AR}},X_{N}=\mathsf{AntiVIS})$ is a solution of $\mathsf{System}_{\Sigma}(\mathcal{G})$, hence by the inequation (A4)  ${\sf{AR}}\mathrel{;}{\sf{AR}}\subseteq{\sf{AR}}$. It follows immediately that ${\sf{AR}}\mathrel{;}{\sf{AR}}\subseteq{\sf{AR}}\cup\Delta{\sf{AR}}$.

• •

$({\sf{AR}}\mathrel{;}\Delta A)\subseteq({\sf{AR}}\cup\Delta A)$: recall that $\Delta A={\sf{AR}}?\mathrel{;}\partial A\mathrel{;}{\sf{AR}}?$. Because of the inequation (A4), we have that ${\sf{AR}}\mathrel{;}{\sf{AR}}?\subseteq{\sf{AR}}?$, Therefore

[TABLE]

• •

$\Delta A\mathrel{;}{\sf{AR}}\subseteq({\sf{AR}}\cup\Delta A)$: This case is symmetric to the previous one.

• •

$(\Delta A\mathrel{;}\Delta A)\subseteq({\sf{AR}}\cup\Delta A)$:

[TABLE]

where the inequation above has been obtained by applying a $\partial$-cut (Lemma D.4). ∎

Lemma D.6** ($\Delta$-extraction ($\rho$ case)).**

[TABLE]

We refer to the first inequality as right $\Delta$-extraction, and to the second inequality as left $\Delta$-extraction.

Lemma D.7** ($\Delta$-extraction ($\pi$ case)).**

[TABLE]

Proof. We only show how to prove the first inequation of Lemma D.6. The proof of the second inequation of Lemma D.6, and the proof of Lemma D.7, are similar.

Recall that ${\mathsf{VIS}}_{\nu}={\mathsf{VIS}}\cup\Delta V$. By Proposition C.1(iii), we have that

[TABLE]

by unfolding the definition of specification function to the RHS, and by applying the distributivity of $\cap$ over $\cup$, we get

[TABLE]

Note that for any relation $R_{1},R_{2}$, $R_{1}?\cup R_{2}?=R_{1}?\cup R_{2}$, hence we can elide the reflexive closure in the term $(\Delta V)?$ of the equality above

[TABLE]

By applying the distributivity of $\cap$ over $\cup$, and then by applying the definition of specification function, we get

[TABLE]

Because $(X_{V}={\mathsf{VIS}},X_{A}={\sf{AR}},X_{N}=\mathsf{AntiVIS})$ is a solution of $\mathsf{System}_{\Sigma}(\mathcal{G})$, by Equation (A2)  we obtain that ${\mathsf{VIS}}?\subseteq{\sf{AR}}?$. Also, by Proposition C.1(i) we have that $\pi({\mathsf{VIS}})\subseteq{\mathsf{VIS}}?\subseteq{\sf{AR}}?$. Finally, the inequation (A4)states that ${\sf{AR}}\mathrel{;}{\sf{AR}}\subseteq{\sf{AR}}$, from which ${\sf{AR}}?\mathrel{;}AR?\subseteq{\sf{AR}}?$ follows. By putting all these together, we get

[TABLE]

as we wanted to prove. ∎

Lemma D.8**.**

[TABLE]

Proof. Recall that $\partial V=\rho({\mathsf{VIS}})\mathrel{;}\Delta A\mathrel{;}\pi({\mathsf{VIS}})$. We prove the first inequality as follows:

[TABLE]

where we have used the fact that $\rho({\mathsf{VIS}})=\rho(\mathcal{T}\times\mathcal{T})\cap{\mathsf{VIS}}?\subseteq{\mathsf{VIS}}?\subseteq{\sf{AR}}?$, because of the definition of specification function and because of Inequation (A2). ∎

The next step needed to prove Proposition D.3 is that of verifying that by substituting ${\sf{AR}}_{\nu}$ for $X_{A}$, ${\mathsf{VIS}}_{\nu}$ for $X_{V}$, and $\mathsf{AntiVIS}_{\nu}$ for $X_{N}$, each of the inequations in $\mathsf{System}_{\Sigma}(\mathcal{G})$ is satisfied. The next propositions show that this is indeed the case.

Proposition D.9**.**

[TABLE]

Proof. Recall that ${\mathsf{VIS}}_{\nu}={\mathsf{VIS}}\cup\Delta V$, ${\sf{AR}}_{\nu}={\sf{AR}}\cup\Delta A$. To prove that ${\mathsf{VIS}}_{\nu}\subseteq{\sf{AR}}_{\nu}$, it suffices to show that ${\mathsf{VIS}}\subseteq({\sf{AR}}\cup\Delta A)$, and $\Delta V\subseteq({\sf{AR}}\cup\Delta A)$.

The inequation ${\mathsf{VIS}}\subseteq{\sf{AR}}\cup\Delta A$ follows immediately the fact that $(X_{V}={\mathsf{VIS}},X_{A}={\sf{AR}},X_{N}=\mathsf{AntiVIS})$ is a solution of $\mathsf{System}_{\Sigma}(\mathcal{G})$, and from the inequation (A2)  - ${\mathsf{VIS}}\subseteq{\sf{AR}}$.

It remains to prove that $\Delta V\subseteq{\sf{AR}}\cup\Delta A$. In fact, we prove a stronger result, namely $\Delta V\subseteq\Delta A$. This is done as follows:

[TABLE]

Proposition D.10**.**

[TABLE]

Proof. First, we perform a right $\Delta$-extraction (Lemma D.6) of $\rho({\mathsf{VIS}}_{\nu})$, and a left $\Delta$-extraction (Lemma D.7) of $\pi({\mathsf{VIS}}_{\nu})$. This gives us the following inequation:

[TABLE]

and we rewrite the RHS of the above by applying the distributivity of $\cup$ over ${}\mathrel{;}{}$.

[TABLE]

We show that each of the components of the union of the RHS of the inequation above is included in ${\mathsf{VIS}}_{\nu}$, from which we get the desired result $\rho({\mathsf{VIS}})\mathrel{;}{\sf{AR}}_{\nu}\mathrel{;}\pi({\mathsf{VIS}})\subseteq{\mathsf{VIS}}_{\nu}$.

• •

$\rho({\mathsf{VIS}})\mathrel{;}{\sf{AR}}_{\nu}\mathrel{;}\pi({\mathsf{VIS}})\subseteq{\mathsf{VIS}}_{\nu}$. Recall that ${\sf{AR}}_{\nu}={\sf{AR}}\cup\Delta A$, from which we get that

[TABLE]

We prove that each of the components of the union in the RHS above are included in ${\mathsf{VIS}}_{\nu}$. First, observe that

[TABLE]

because of Inequation (V4). Also, we have that

[TABLE]

and in this case there is nothing left to prove.

• •

$\rho({\mathsf{VIS}})\mathrel{;}{\sf{AR}}_{\nu}\mathrel{;}(\Delta A\mathrel{;}\pi({\mathsf{VIS}})\mathrel{;}{\mathsf{VIS}}?)\subseteq{\mathsf{VIS}}_{\nu}$. Again, by unfolding the definition of ${\sf{AR}}_{\nu}$ and by applying the distributivity of $\cup$ over ${}\mathrel{;}{}$, we obtain that

[TABLE]

We prove that each of the components of the union in the RHS above is included in ${\mathsf{VIS}}_{\nu}$.

[TABLE]

• •

${\mathsf{VIS}}?\mathrel{;}\rho({\mathsf{VIS}})\mathrel{;}\Delta A\mathrel{;}{\sf{AR}}_{\nu}\mathrel{;}\pi({\mathsf{VIS}})\subseteq{\mathsf{VIS}}_{\nu}$. As for the two cases above, we unfold ${\sf{AR}}_{\nu}$ and distribute the resulting union over ${}\mathrel{;}{}$: this leads to

[TABLE]

Then we prove that each of the two terms in the union on the RHS above is included in ${\mathsf{VIS}}_{\nu}$:

[TABLE]

• •

${\mathsf{VIS}}?\mathrel{;}\rho({\mathsf{VIS}})\mathrel{;}\Delta A\mathrel{;}{\sf{AR}}_{\nu}\mathrel{;}\Delta A\mathrel{;}\pi({\mathsf{VIS}})\mathrel{;}{\mathsf{VIS}}?$ in this case we have the following:

[TABLE]

Proposition D.11**.**

[TABLE]

Proof. Recall that $\mathsf{AntiVIS}_{\nu}={\mathsf{VIS}}_{\nu}?\mathrel{;}{\mathsf{RW}}\mathrel{;}{\mathsf{VIS}}_{\nu?}$. Thus, we need to prove that

[TABLE]

We start by performing a $\Delta$-extraction both for the specification functions $\pi$ and $\rho$:

[TABLE]

We prove that each of the four terms of the union above is included in ${\sf{AR}}_{\nu}$. To this end, it suffices to prove the following:

[TABLE]

In fact, if the inequation (30) is satisfied, we obtain that

• •

$(\pi({\mathsf{VIS}})\mathrel{;}{\mathsf{VIS}}_{\nu}\mathrel{;}{\mathsf{RW}}\mathrel{;}{\mathsf{VIS}}_{\nu}?\mathrel{;}\rho({\mathsf{VIS}}))\setminus\mathsf{Id}\subseteq{\sf{AR}}_{\nu}$:

[TABLE]

• •

$(\Delta A\mathrel{;}\pi({\mathsf{VIS}})\mathrel{;}{\mathsf{VIS}}?\mathrel{;}{\mathsf{VIS}}_{\nu}?\mathrel{;}{\mathsf{RW}}\mathrel{;}{\mathsf{VIS}}_{\nu}?\mathrel{;}\rho({\mathsf{VIS}}))\setminus\mathsf{Id}\subseteq{\sf{AR}}_{\nu}$:

[TABLE]

• •

$(\pi({\mathsf{VIS}})\mathrel{;}{\mathsf{VIS}}_{\nu}?\mathrel{;}{\mathsf{RW}}\mathrel{;}{\mathsf{VIS}}_{\nu}?\mathrel{;}{\mathsf{VIS}}?\mathrel{;}\rho({\mathsf{VIS}})\mathrel{;}\Delta A)\setminus\mathsf{Id}\subseteq{\sf{AR}}_{\nu}$:

[TABLE]

• •

$(\Delta A\mathrel{;}\pi({\mathsf{VIS}})\mathrel{;}{\mathsf{VIS}}?\mathrel{;}{\mathsf{VIS}}_{\nu}?\mathrel{;}{\mathsf{RW}}\mathrel{;}{\mathsf{VIS}}_{\nu}?\mathrel{;}{\mathsf{VIS}}?\mathrel{;}\rho({\mathsf{VIS}})\mathrel{;}\Delta A)\setminus\mathsf{Id}\subseteq{\sf{AR}}_{\nu}$: here it suffices to apply a $\partial$-cut (Lemma D.4) to obtain the result:

[TABLE]

Let then prove the inequality (30): we have that

[TABLE]

We prove that each of the terms in the union above is included in ${\sf{AR}}_{\nu}?$.

• •

[TABLE]

[TABLE]

• •

$\pi({\mathsf{VIS}})\mathrel{;}\Delta V\mathrel{;}{\mathsf{RW}}\mathrel{;}{\mathsf{VIS}}?\mathrel{;}\rho({\mathsf{VIS}})\subseteq{\sf{AR}}_{\nu}?$:

[TABLE]

• •

$\pi({\mathsf{VIS}})\mathrel{;}{\mathsf{VIS}}?\mathrel{;}{\mathsf{RW}}\mathrel{;}\Delta V\mathrel{;}\rho({\mathsf{VIS}})\subseteq{\sf{AR}}_{\nu}?$:

[TABLE]

• •

$\pi({\mathsf{VIS}})\mathrel{;}\Delta V\mathrel{;}{\mathsf{RW}}\mathrel{;}\Delta V\mathrel{;}\rho({\mathsf{VIS}})\subseteq{\sf{AR}}_{\nu}?$:

[TABLE]

Proposition D.12**.**

[TABLE]

Proof. Let $T^{\prime},U,S^{\prime}$ be such that $T^{\prime}\in{\sf{Writes}}_{x}$, $T^{\prime}\xrightarrow{{\mathsf{VIS}}_{\nu}}U\xrightarrow{{\mathsf{RW}}(x)}S^{\prime}$ for some object $x\in\mathsf{Obj}$. We need to show that $T^{\prime}\xrightarrow{{\sf{AR}}_{\nu}}S^{\prime}$. By definition, ${\mathsf{VIS}}_{\nu}={\mathsf{VIS}}\cup\Delta V$. Thus, $T^{\prime}\xrightarrow{{\mathsf{VIS}}}U$ or $T^{\prime}\xrightarrow{\Delta V}U$. If $T^{\prime}\xrightarrow{{\mathsf{VIS}}}U$, then $T^{\prime}\xrightarrow{{\mathsf{VIS}}}U\xrightarrow{{\mathsf{RW}}(x)}S^{\prime}$ and $T^{\prime}\in{\sf{Writes}}_{x}$. By the inequation (A3)  we have that $T^{\prime}\xrightarrow{{\sf{AR}}}S^{\prime}$, which implies the desired $T^{\prime}\xrightarrow{{\sf{AR}}_{\nu}}S^{\prime}$.

Suppose then that $T^{\prime}\xrightarrow{\Delta V}U$. By unfolding the definition of $\Delta V$, we have that

[TABLE]

Recall that by definition of $\partial A$, the transactions $T$ and $S$ are not related by ${\sf{AR}}$. Note that, since $U\xrightarrow{{\mathsf{RW}}(x)}S^{\prime}$, then $U\in{\sf{Reads}}_{x},S^{\prime}\in{\sf{Writes}}_{x}$. Recall that ${\mathsf{WW}}(x)$ is a total order over ${\sf{Writes}}_{x}$. Therefore, we have three possible cases: $T^{\prime}\xrightarrow{{\mathsf{WW}}(x)}S^{\prime}$, $T^{\prime}=S^{\prime}$ or $T^{\prime}\xrightarrow{{\mathsf{WW}}(x)}S^{\prime}$. These cases are analysed separately.

• •

$T^{\prime}\xrightarrow{{\mathsf{WW}}(x)}S^{\prime}$: by the inequality (A1)we have that $T^{\prime}\xrightarrow{{\sf{AR}}}S^{\prime}$. Thus, $T^{\prime}\xrightarrow{{\sf{AR}}_{\nu}}S^{\prime}$.

• •

$T^{\prime}=S^{\prime}$: this case is not possible. We first prove that $U^{\prime}\neq T^{\prime\prime}$. Suppose $U^{\prime}=T^{\prime\prime}$. Then $S\xrightarrow{{\sf{AR}}?}U^{\prime}=T^{\prime\prime}\xrightarrow{{\sf{AR}}?}T$, that is $S\xrightarrow{{\sf{AR}}?}T$. But by hypothesis, $T$ and $S$ are not related by ${\sf{AR}}$, hence we get a contradiction.

Let then $U^{\prime}\neq T^{\prime\prime}$. Since we have

[TABLE]

we have that $U^{\prime}\xrightarrow{{\sf{AR}}}T^{\prime\prime}$ by the inequality (A5). Thus, $S\xrightarrow{{\sf{AR}}?}U^{\prime}\xrightarrow{{\sf{AR}}}T^{\prime\prime}\xrightarrow{{\sf{AR}}?}T$, or equivalently $S\xrightarrow{{\sf{AR}}}T$. Again, this contradict the assumption that $S$ and $T$ are not related by ${\sf{AR}}$.

• •

$S^{\prime}\xrightarrow{{\mathsf{WW}}(x)}T^{\prime}$: this case is also not possible. Recall that $U\xrightarrow{{\mathsf{RW}}(x)}S^{\prime}$; that is, there exists an entity $U^{\prime\prime}$ such that $U^{\prime\prime}\xrightarrow{{\mathsf{WR}}(x)}U$, $U^{\prime\prime}\xrightarrow{{\mathsf{WW}}(x)}S^{\prime}$. By the transitivity of ${\mathsf{WW}}(x)$, we have that $U^{\prime\prime}\xrightarrow{{\mathsf{WW}}(x)}T^{\prime}$. Thus, $U\xrightarrow{{\mathsf{RW}}(x)}T^{\prime}$. We can proceed as in the case above to show that this implies $S\xrightarrow{{\sf{AR}}}T$, contradicting the assumption that $T$ and $S$ are not related by ${\sf{AR}}$. ∎

Finally, we prove the following:

Proposition D.13**.**

The triple $(X_{V}={\mathsf{VIS}}_{\nu},X_{A}={\sf{AR}}_{\nu},X_{N}=\mathsf{AntiVIS}_{\nu})$ is included in the least solution to $\mathsf{System}_{\Sigma}(\mathcal{G})$ for which the relation corresponding to the unknown $X_{A}$ includes the relation ${\sf{AR}}\cup\partial A$.

Proof.. Let $(X_{V}={\mathsf{VIS}}^{\prime},X_{A}={\sf{AR}}^{\prime},X_{N}=\mathsf{AntiVIS}^{\prime})$ be a solution to $\mathsf{System}_{\Sigma}(\mathcal{G})$ such that $({\sf{AR}}\cup\partial A)\subseteq{\sf{AR}}^{\prime}$. We need to show that ${\sf{AR}}_{\nu}\subseteq{\sf{AR}}^{\prime}$, ${\mathsf{VIS}}_{\nu}\subseteq{\mathsf{VIS}}^{\prime}$, and $\mathsf{AntiVis}_{\nu}\subseteq\mathsf{AntiVIS}^{\prime}$.

• •

${\sf{AR}}_{\nu}\subseteq{\sf{AR}}^{\prime}$: note that we have that

[TABLE]

from which it follows that ${\sf{AR}}_{\nu}={\sf{AR}}\cup\Delta{\sf{AR}}\subseteq({\sf{AR}}^{\prime}\cup{\sf{AR}}^{\prime})={\sf{AR}}^{\prime}$.

• •

${\mathsf{VIS}}_{\nu}\subseteq{\mathsf{VIS}}^{\prime}$: Observe that for any solution $(X_{V}={\mathsf{VIS}}^{\prime\prime},X_{A}={\sf{AR}}^{\prime\prime},X_{N}=\mathsf{AntiVIS}^{\prime\prime})$ of $\mathsf{System}_{\Sigma}(\mathcal{G})$, the relation ${\mathsf{VIS}}^{\prime}$ is determined uniquely by ${\sf{AR}}^{\prime\prime}$: specifically, ${\mathsf{VIS}}^{\prime\prime}=\mu V.\mathcal{F}(V,{\sf{AR}}^{\prime\prime})$, where

[TABLE]

the functional $\mathcal{F}$ is monotone in its second argument, which means that the inequation ${\sf{AR}}_{\nu}\subseteq{\sf{AR}}^{\prime}$ also implies that ${\mathsf{VIS}}_{\nu}\subseteq{\mathsf{VIS}}^{\prime}$.

• •

$\mathsf{AntiVIS}_{\nu}\subseteq{\mathsf{VIS}}^{\prime}$. Observe that, for any solution $(X_{V}={\mathsf{VIS}}^{\prime\prime},X_{A}={\sf{AR}}^{\prime\prime},X_{N}=\mathsf{AntiVIS}^{\prime\prime})$, the relation $\mathsf{AntiVIS}^{\prime\prime}$ is determined uniquely by ${\mathsf{VIS}}^{\prime\prime}$. Specifically, we have that $\mathsf{AntiVIS}^{\prime\prime}=\mathcal{F}({\mathsf{VIS}}^{\prime\prime})$, where $\mathcal{F}({\mathsf{VIS}}^{\prime\prime})={\mathsf{VIS}}^{\prime\prime}?\mathrel{;}{\mathsf{RW}}\mathrel{;}{\mathsf{VIS}}^{\prime\prime}?$. The functional $\mathcal{F}$ is monotone, from which it follows that the inequation ${\mathsf{VIS}}_{\nu}\subseteq{\mathsf{VIS}}^{\prime}$, proved above, implies that $\mathsf{AntiVis}_{\nu}\subseteq\mathsf{AntiVIS}^{\prime}$.

∎

Proof of Proposition D.3. We need to show that $(X_{V}={\mathsf{VIS}}_{\nu},X_{A}={\sf{AR}}_{\nu},X_{N}=\mathsf{AntiVIS}_{\nu})$ is a solution of $\mathsf{System}_{\mathcal{G}}(\Sigma)$. By Proposition D.13, it follows that it is the smallest solution for which the relation corresponding to the unknown $X_{A}$ includes ${\sf{AR}}\cup\partial A$.

Obviously we have that ${\mathsf{WR}}\subseteq{\mathsf{VIS}}\subseteq{\mathsf{VIS}}_{\nu}$, and $\bigcup\{{\mathsf{WW}}(x)\mid(\rho_{x},\rho_{x})\in\Sigma\}\subseteq{\mathsf{VIS}}\subseteq{\mathsf{VIS}}_{\nu}$: the inequations (V1)and (V3)are satisfied. The validity of inequation (V2)  follows from Corollary D.5. The inequation (V4)  is also satisfied, as we have proved in Proposition D.10.

The inequality (A1)is satisfied because ${\mathsf{WW}}\subseteq{\sf{AR}}\subseteq{\sf{AR}}_{\nu}$, and the inequation (A2)  has been proved in Proposition D.9. The validity of the inequation (A4)  also follows from Corollary D.5. The inequation (A5)  and (A3)  are satisfied, as we have proved in propositions D.11 and D.12.

Finally, the inequation (N1)  is satisfied because ${\mathsf{RW}}\subseteq{\mathsf{VIS}}_{\nu}?\mathrel{;}{\mathsf{RW}}\mathrel{;}{\mathsf{VIS}}_{\nu}?=\mathsf{AntiVIS}_{\nu}$; the inequation (N2)  is satisfied because ${\mathsf{VIS}}_{\nu}\mathrel{;}\mathsf{AntiVIS}_{\nu}={\mathsf{VIS}}_{\nu}\mathrel{;}{\mathsf{VIS}}_{\nu}?\mathrel{;}{\mathsf{RW}}\mathrel{;}{\mathsf{VIS}}_{\nu}?\subseteq{\mathsf{VIS}}_{\nu}?\mathrel{;}{\mathsf{RW}}\mathrel{;}{\mathsf{VIS}}_{\nu}?=\mathsf{AntiVIS}_{\nu}$ (recall that ${\mathsf{VIS}}_{\nu}$ is transitive by Corollary D.5), and similarly we can prove that the inequation (N3)  is also satisfied. ∎

D.3. Proof of Theorem 3.5

Throughout this section we let $\mathcal{G}=(\mathcal{T},{\mathsf{WR}},{\mathsf{WW}},{\mathsf{RW}})$.

D.3.1. Proof of Theorem 3.5(1)

Recall that $\Sigma_{\mathsf{SER}}=\{(\rho_{S},\rho_{S})\}$, where $\rho_{S}(R)=\mathsf{Id}$. The instantiation of inequations (V4)  and (A5), in $\mathsf{System}_{\Sigma_{\mathsf{SER}}}(\mathcal{G})$ gives rise to the inequations $X_{A}\subseteq X_{V}$ and $X_{N}\setminus\mathsf{Id}\subseteq X_{A}$.

Let ${\mathsf{VIS}}={\sf{AR}}=\mathsf{AntiVIS}=({\mathsf{WR}}\cup{\mathsf{WW}}\cup{\mathsf{RW}})^{+}$. We prove that $(X_{V}={\mathsf{VIS}},X_{A}={\sf{AR}},X_{N}=\mathsf{AntiVIS})$ is a solution to $\mathsf{System}_{\Sigma_{\mathsf{SER}}}(\mathcal{G})$: to this end, we show that by substituting each of the unknowns for the relation $({\mathsf{WR}}\cup{\mathsf{WW}}\cup{\mathsf{RW}})^{+}$ in $\mathsf{System}_{\Sigma_{\mathsf{SER}}}(\mathcal{G})$, then each of the inequations of such a system is satisfied. Clearly ${\mathsf{WR}}\subseteq{\mathsf{VIS}}$, hence equation (V1)  is satisfied. Because there is no consistency guarantee of the form $(\rho_{x},\rho_{x})\in\Sigma_{\mathsf{SER}}$, the inequation (V3)  is trivially satisfied. Inequation (V2)  is also satisfied. ${\mathsf{VIS}}\mathrel{;}{\mathsf{VIS}}=({\mathsf{WR}}\cup{\mathsf{WW}}\cup{\mathsf{RW}})^{+}\mathrel{;}({\mathsf{WR}}\cup{\mathsf{WW}}\cup{\mathsf{RW}})^{+}=({\mathsf{WR}}\cup{\mathsf{WW}}\cup{\mathsf{RW}})^{+}={\mathsf{VIS}}$. Inequation (V4)  requires that ${\sf{AR}}\subseteq{\mathsf{VIS}}$: this is also satisfied, as ${\sf{AR}}=({\mathsf{WR}}\cup{\mathsf{WW}}\cup{\mathsf{RW}})^{+}={\mathsf{VIS}}$.

Inequation (A1)  is trivially satisfied: ${\mathsf{WW}}\subseteq({\mathsf{WR}}\cup{\mathsf{WW}}\cup{\mathsf{RW}})^{+}={\sf{AR}}$. Inequation (A2)  is also satisfied: ${\mathsf{VIS}}=({\sf{SO}}\cup{\mathsf{WR}}\cup{\mathsf{RW}})^{+}={\sf{AR}}$, hence ${\mathsf{VIS}}\subseteq{\sf{AR}}$. Inequation (A5)  is satisfied as well: $\mathsf{AntiVIS}\setminus\mathsf{Id}=({\mathsf{WR}}\cup{\mathsf{WW}}\cup{\mathsf{RW}})^{+}\setminus\mathsf{Id}\subseteq({\mathsf{WR}}\cup{\mathsf{WW}}\cup{\mathsf{RW}})^{+}={\sf{AR}}$. Inequation (A3)  is also satisfied: $\bigcup_{x\in\mathsf{Obj}}{[{\sf{Writes}}_{x}]}\mathrel{;}{\mathsf{VIS}}\mathrel{;}{\mathsf{RW}}(x)\subseteq{\mathsf{VIS}}\mathrel{;}{\mathsf{RW}}=({\mathsf{WR}}\cup{\mathsf{WW}}\cup{\mathsf{RW}})^{+}\mathrel{;}{\mathsf{RW}}\subseteq({\mathsf{WR}}\cup{\mathsf{WW}}\cup{\mathsf{RW}})^{+}={\sf{AR}}$.

Inequation (N1)  is obviously satisfied, as ${\mathsf{RW}}\subseteq({\mathsf{WR}}\cup{\mathsf{WW}}\cup{\mathsf{RW}})^{+}=\mathsf{AntiVIS}$. For inequation (N2) , note that ${\mathsf{VIS}}\mathrel{;}\mathsf{AntiVIS}=({\mathsf{WR}}\cup{\mathsf{WW}}\cup{\mathsf{RW}})^{+}\mathrel{;}({\mathsf{WR}}\cup{\mathsf{WW}}\cup{\mathsf{RW}})^{+}\subseteq({\mathsf{WR}}\cup{\mathsf{WW}}\cup{\mathsf{RW}})^{+}=\mathsf{AntiVIS}$, and it can be shown that Inequation (N3)  is satisfied in a similar way.

The proof that the solution $(X_{V}={\mathsf{VIS}},X_{A}={\sf{AR}},X_{N}=\mathsf{AntiVIS})$ is the smallest solution of $\mathsf{System}_{\Sigma_{\mathsf{SER}}}(\mathcal{G})$ can be obtained as in the proof of Theorem 4.1. ∎

D.3.2. Proof of Theorem 3.5(2).

Recall that $\Sigma_{\mathsf{SI}}=\{(\rho_{x},\rho_{x})\}_{x\in\mathsf{Obj}}\cup\{(\rho_{\mathsf{Id}},\rho_{\mathsf{SI}})\}$, where $\rho_{x}(R)={[{\sf{Writes}}_{x}]}$, $\rho_{\mathsf{SI}}(R)=R\setminus\mathsf{Id}$. By instantiating inequation (V3)  to $\Sigma_{\mathsf{SI}}$ we obtain ${\mathsf{WW}}\subseteq X_{V}$, while by instantiating inequations (V4)  and (A5)  to the consistency guarantee $(\rho_{\mathsf{Id}},\rho_{\mathsf{SI}})$, we obtain $X_{A}\mathrel{;}(X_{V}\setminus\mathsf{Id})\subseteq X_{V}$, and $((X_{V}\setminus\mathsf{Id})\mathrel{;}X_{N})\setminus\mathsf{Id}\subseteq X_{A}$.

Let ${\sf{AR}}=(({\mathsf{WR}}\cup{\mathsf{WW}})\mathrel{;}{\mathsf{RW}}?)^{+}$, ${\mathsf{VIS}}={\sf{AR}}?\mathrel{;}({\mathsf{WR}}\cup{\mathsf{WW}})$, $\mathsf{AntiVIS}={\mathsf{VIS}}?\mathrel{;}{\mathsf{RW}}\mathrel{;}{\mathsf{VIS}}?$. Then $(X_{V}={\mathsf{VIS}},X_{A}={\sf{AR}},X_{N}=\mathsf{AntiVIS})$ is a solution of $\mathsf{System}_{\Sigma_{\mathsf{SI}}}(\mathcal{G})$. We can prove that it is the smallest such solution in the same way as in Theorem C.16.

We need to show that, by substituting ${\mathsf{VIS}},{\sf{AR}},\mathsf{AntiVIS}$ for $X_{V},X_{A},X_{N}$ respectively, in

$\mathsf{System}_{\Sigma_{\mathsf{SI}}}(\mathcal{G})$, all the inequations are satisfied. Here we give the details only for the most important of them. A full proof of this statement can be found in [17].

• •

${\sf{AR}}\mathrel{;}({\mathsf{VIS}}\setminus\mathsf{Id})\subseteq{\mathsf{VIS}}$:

[TABLE]

• •

$(({\mathsf{VIS}}\setminus\mathsf{Id})\mathrel{;}\mathsf{AntiVIS})\setminus\mathsf{Id}\subseteq{\sf{AR}}$:

[TABLE]

where we have used the fact that ${\sf{AR}}\mathrel{;}{\mathsf{VIS}}\subseteq{\mathsf{VIS}}$, which we have proved previously.∎

D.3.3. Proof of Theorem 3.5(3).

Proposition D.14**.**

Let ${\mathsf{VIS}}=({\mathsf{WR}}\cup{\mathsf{WW}})^{+}$, ${\sf{AR}}={\mathsf{VIS}}\cup\bigcup_{x\in\mathsf{Obj}}\left({[{\sf{Writes}}_{x}]}\mathrel{;}{\mathsf{VIS}}?\mathrel{;}{\mathsf{RW}}(x)\right)^{+}$, $\mathsf{AntiVIS}={\mathsf{VIS}}?\mathrel{;}{\mathsf{RW}}\mathrel{;}{\mathsf{VIS}}?$. If ${\sf{AR}}$ is irreflexive, then $(X_{V}={\mathsf{VIS}},X_{A}={\sf{AR}},X_{N}=\mathsf{AntiVIS})$ is a solution of $\mathsf{System}_{\Sigma_{{\mathsf{PSI}}}}(\mathcal{G})$. Furthermore, it is the smallest such solution.

Proof. Recall that $\Sigma_{{\mathsf{PSI}}}=\{(\rho_{x},\rho_{x})\}_{x\in\mathsf{Obj}}$. Therefore, the system of inequations

$\mathsf{System}_{\Sigma_{{\mathsf{PSI}}}}(\mathcal{G})$ does not contain inequations (V4)  and (A5), and inequation (V3)  is instantiated to ${\mathsf{WW}}\subseteq{\mathsf{VIS}}$. We prove that, under the assumption that ${\sf{AR}}$ is irreflexive, the triple $(X_{V}={\mathsf{VIS}},X_{A}={\sf{AR}},X_{N}=\mathsf{AntiVIS})$ is a solution of $\mathsf{System}_{\Sigma_{{\mathsf{PSI}}}}(\mathcal{G})$ by showing that, by substituting ${\mathsf{VIS}},{\sf{AR}}$ and $\mathsf{AntiVIS}$ for $X_{V},X_{A}$ and $X_{N}$ in $\mathsf{System}_{\Sigma_{\mathsf{PSI}}}(\mathcal{G})$, respectively, all the inequations are satisfied. The fact that the triple $(X_{V}={\mathsf{VIS}},X_{A}={\sf{AR}},X_{N}=\mathsf{AntiVIS})$ is the smallest solution of $\mathsf{System}_{\Sigma_{{\mathsf{PSI}}}}(\mathcal{G})$ can be proved in the same way as in the proof of Theorem C.17.

First, we observe that if ${\sf{AR}}$ is irreflexive, then for any $x\in\mathsf{Obj}$, ${[{\sf{Writes}}_{x}]}\mathrel{;}{\mathsf{VIS}}?\mathrel{;}{\mathsf{RW}}(x)\subseteq{\mathsf{WW}}(x)$. To see why this is true, recall that ${\mathsf{WW}}(x)$ is a strict, total order over ${\sf{Writes}}_{x}$. Suppose that $T\ni{{\tt write}}\;x:\_$, $T\xrightarrow{{\mathsf{VIS}}?}S^{\prime}\xrightarrow{{\mathsf{RW}}(x)}S$. Note that, since ${[{\sf{Writes}}_{x}]}\mathrel{;}{\mathsf{VIS}}?\mathrel{;}{\mathsf{RW}}(x)\subseteq{\sf{AR}}$, and we are assuming that the latter is irreflexive, it cannot be $T=S$. By definition of ${\mathsf{RW}}(x)$, $S\ni{{\tt write}}\;x:\_$. Therefore, either $T\xrightarrow{{\mathsf{WW}}(x)}S$, or $S\xrightarrow{{\mathsf{WW}}(x)}T$. However, if it were $S\xrightarrow{{\mathsf{WW}}(x)}T$, we would have $S\ni\;{\sf{Writes}}_{x}$, $S\xrightarrow{{\mathsf{WW}}(x)}T\xrightarrow{{\mathsf{VIS}}?}S^{\prime}\xrightarrow{{\mathsf{RW}}(x)}S$: because ${\mathsf{VIS}}=({\mathsf{WR}}\cup{\mathsf{WW}})^{+}$, ${\mathsf{WW}}(x)\mathrel{;}{\mathsf{VIS}}?\subseteq{\mathsf{VIS}}?$, hence $S\xrightarrow{{\mathsf{VIS}}?}S^{\prime}\xrightarrow{{\mathsf{RW}}(x)}S$, and because $S\ni{{\tt write}}\;x:\_$, it would follow that $S\xrightarrow{{\sf{AR}}}S$, contradicting the hypothesis that ${\sf{AR}}$ is irreflexive. Therefore, it must be $T\xrightarrow{{\mathsf{WW}}(x)}S$.

We have proved that, if ${\sf{AR}}$ is irreflexive, then for any $x\in\mathsf{Obj}$, ${[{\sf{Writes}}_{x}]}\mathrel{;}{\mathsf{VIS}}?\mathrel{;}{\mathsf{RW}}(x)\subseteq{\mathsf{WW}}$. An immediate consequence of this fact is the following:

[TABLE]

Next, we prove that each of the inequations in $\mathsf{System}_{\Sigma_{{\mathsf{PSI}}}}$ are satisfied when ${\mathsf{VIS}},{\sf{AR}},\mathsf{AntiVIS}$ are substituted for $X_{V},X_{A},X_{N}$, respectively.

**Inequation (V1):: **

${\mathsf{WR}}\subseteq{\mathsf{VIS}}$. This is true, because ${\mathsf{WR}}\subseteq({\mathsf{WR}}\cup{\mathsf{WW}})^{+}={\mathsf{VIS}}$,

**Inequation (V2):: **

${\mathsf{VIS}}\mathrel{;}{\mathsf{VIS}}\subseteq{\mathsf{VIS}}$. This is trivially satisfied: ${\mathsf{VIS}}\mathrel{;}{\mathsf{VIS}}=({\mathsf{WR}}\cup{\mathsf{WW}})^{+}\mathrel{;}({\mathsf{WR}}\cup{\mathsf{WW}})^{+}\subseteq({\mathsf{WR}}\cup{\mathsf{WW}})^{+}={\mathsf{VIS}}$,

**Inequation (V3):: **

${\mathsf{WW}}\subseteq{\mathsf{VIS}}$. This can be proved as above: ${\mathsf{WW}}\subseteq({\mathsf{WR}}\cup{\mathsf{WW}})^{+}\subseteq{\mathsf{VIS}}$,

**Inequation (A1):: **

${\mathsf{WW}}\subseteq{\sf{AR}}$. We have already proved that ${\mathsf{WW}}\subseteq{\mathsf{VIS}}$, hence it suffices to show that ${\mathsf{VIS}}\subseteq{\sf{AR}}$; this is done below,

**Inequation (A2):: **

${\mathsf{VIS}}\subseteq{\sf{AR}}$. We have that

[TABLE]

**Inequation (A3):: **

$\bigcup_{x\in\mathsf{Obj}}{[{\sf{Writes}}_{x}]}\mathrel{;}{\mathsf{VIS}}\mathrel{;}{\mathsf{RW}}(x)\subseteq{\sf{AR}}$. This inequation is trivially satisfied by the definition of ${\sf{AR}}$:

[TABLE]

**Inequation (A4):: **

${\sf{AR}}\mathrel{;}{\sf{AR}}\subseteq{\sf{AR}}$. We have that

[TABLE]

**Inequation (N1):: **

${\mathsf{RW}}\subseteq\mathsf{AntiVIS}$. We have that ${\mathsf{RW}}\subseteq{\mathsf{VIS}}?\mathrel{;}{\mathsf{RW}}\mathrel{;}{\mathsf{VIS}}?=\mathsf{AntiVIS}$,

**Inequation (N2):: **

${\mathsf{VIS}}?\mathrel{;}{\mathsf{RW}}\subseteq\mathsf{AntiVIS}$: we have that ${\mathsf{VIS}}?\mathrel{;}{\mathsf{RW}}\subseteq{\mathsf{VIS}}?\mathrel{;}{\mathsf{RW}}\mathrel{;}{\mathsf{VIS}}?=\mathsf{AntiVIS}$. Inequation (N3)  can be proved similarly.

∎

Proof of Theorem 3.5(3). Let $\Delta_{{\mathsf{PSI}}}=\{\delta_{{\mathsf{PSI}}_{0}}\}\cup\{\delta_{{\mathsf{PSI}}(x)}\}_{x\in\mathsf{Obj}}$. Recall that

[TABLE]

We need to show that $\mathsf{modelOf}(\Sigma_{{\mathsf{PSI}}})=\mathsf{modelOf}(\Delta_{{\mathsf{PSI}}})$: for any execution $\mathcal{X}\in{\mathsf{Executions}}(\Sigma_{{\mathsf{PSI}}})$, $\mathsf{graph}(\mathcal{X})\in\mathsf{Graphs}(\Delta_{{\mathsf{PSI}}})$, and for any $\mathcal{G}\in\mathsf{Graphs}(\Delta_{{\mathsf{PSI}}})$, there exists an execution $\mathcal{X}\in{\mathsf{Executions}}(\Sigma_{{\mathsf{PSI}}})$ such that $\mathsf{graph}(\mathcal{X})=\mathcal{G}$.

We prove this result in several step. First, define

[TABLE]

We prove that $\mathsf{modelOf}(\Sigma_{{\mathsf{PSI}}})=\mathsf{modelOf}(\{\delta^{\prime}_{{\mathsf{PSI}}}\})$. By Theorem C.17 we have that, for any $\mathcal{X}\in{\mathsf{Executions}}({\mathsf{PSI}})$, the relation $\delta^{\prime}_{{\mathsf{PSI}}}(\mathcal{G})$ is irreflexive, hence $\mathsf{modelOf}(\Sigma_{{\mathsf{PSI}}})\subseteq\mathsf{modelOf}(\{\delta^{\prime}_{{\mathsf{PSI}}}\})$. Let then $\mathcal{G}\in\mathsf{modelOf}(\delta^{\prime}_{{\mathsf{PSI}}})$, that is the relation $\delta^{\prime}_{{\mathsf{PSI}}}(\mathcal{G})$ is irreflexive. By Proposition D.14 we have that $(X_{V}=\_,X_{A}=\delta^{\prime}_{{\mathsf{PSI}}}(\mathcal{G}),X_{N}=\_)$ is a solution to $\mathsf{System}_{{\mathsf{PSI}}}(\mathcal{G})$, and by Theorem 5.2 it follows that there exists a relation $\mathcal{X}\in{\mathsf{Executions}}(\Sigma_{{\mathsf{PSI}}})$ such that $\mathsf{graph}(\mathcal{X})=\mathcal{G}$. That is, $\mathsf{modelOf}(\{\delta^{\prime}_{{\mathsf{PSI}}}\})\subseteq\mathsf{modelOf}(\Sigma_{{\mathsf{PSI}}})$.

Next, for any object $x\in\mathsf{Obj}$, define $\delta^{\prime}_{{\mathsf{PSI}}(x)}(\mathcal{G})=({[{\sf{Writes}}_{x}]}\mathrel{;}({\mathsf{WR}}_{\mathcal{G}}\cup{\mathsf{WW}}_{\mathcal{G}})^{\ast}\mathrel{;}{\mathsf{RW}}_{\mathcal{G}}(x))^{+}$. It is immediate to observe that $\mathsf{modelOf}(\{\delta^{\prime}_{{\mathsf{PSI}}}\})=\mathsf{modelOf}(\{\delta_{{\mathsf{PSI}}_{0}}\}\cup\{\delta^{\prime}_{{\mathsf{PSI}}(x)}\mid x\in\mathsf{Obj}\})$. In fact, for any $\mathcal{G}\in\mathsf{Graphs}$, we have that $\delta^{\prime}_{{\mathsf{PSI}}}(\mathcal{G})=\delta_{{\mathsf{PSI}}_{0}}(\mathcal{G})\cup\bigcup_{x\in\mathsf{Obj}}\delta^{\prime}_{{\mathsf{PSI}}(x)}(\mathcal{G})$, hence $\delta^{\prime}_{{\mathsf{PSI}}}(\mathcal{G})\cap\mathsf{Id}=\emptyset$ if and only if $\delta_{{\mathsf{PSI}}_{0}}(\mathcal{G})\cap\mathsf{Id}=\emptyset$, and $\delta^{\prime}_{{\mathsf{PSI}}}(x)(\mathcal{G})\cap\mathsf{Id}=\emptyset$. At this point we have that $\mathsf{modelOf}(\Sigma_{{\mathsf{PSI}}})=\mathsf{modelOf}(\{\delta^{\prime}_{{\mathsf{PSI}}}\})=\mathsf{modelOf}(\{\delta_{{\mathsf{PSI}}_{0}}\}\cup\{\delta^{\prime}_{{\mathsf{PSI}}(x)\mid x\in\mathsf{Obj}}\})$.

As a last step, we show that for each dependency graph $\mathcal{G}$ and object $x$, the relation $\delta^{\prime}_{{\mathsf{PSI}}(x)}(\mathcal{G})$ is irreflexive if and only if the relation $\delta_{{\mathsf{PSI}}(x)}(\mathcal{G})$ is irreflexive, where we recall that $\delta_{{\mathsf{PSI}}(x)}(\mathcal{G})=(({\mathsf{WR}}_{\mathcal{G}}\cup{\mathsf{WW}}_{\mathcal{G}})^{\ast}\mathrel{;}{\mathsf{RW}}_{\mathcal{G}}(x))^{+}$. An immediate consequence of this fact is that $\mathsf{modelOf}(\Sigma_{{\mathsf{PSI}}})=\mathsf{modelOf}(\{\delta_{{\mathsf{PSI}}_{0}}\}\cup\{\delta_{{\mathsf{PSI}}(x)}\mid x\in\mathsf{Obj}\})=\mathsf{modelOf}(\Delta_{{\mathsf{PSI}}})$, which is exactly what we want to prove.

Note that $\delta^{\prime}_{{\mathsf{PSI}}(x)}(\mathcal{G})=({[{\sf{Writes}}_{x}]}\mathrel{;}({\mathsf{WR}}_{\mathcal{G}}\cup{\mathsf{WW}}_{\mathcal{G}})^{\ast}\mathrel{;}{\mathsf{RW}}_{\mathcal{G}}(x))^{+}\subseteq)({\mathsf{WR}}_{\mathcal{G}}\cup{\mathsf{WW}}_{\mathcal{G}})^{\ast}\mathrel{;}{\mathsf{RW}}_{\mathcal{G}}(x))^{+}=\delta_{{\mathsf{PSI}}(x)}(\mathcal{G})$: if $\delta_{{\mathsf{PSI}}(x)}(\mathcal{G})$ is irreflexive, then so if $\delta^{\prime}_{{\mathsf{PSI}}(x)}(\mathcal{G})$. Finally, suppose that $\delta^{\prime}_{{\mathsf{PSI}}(x)}(\mathcal{G})\cap\mathsf{Id}\subseteq\emptyset$. That is, $({[{\sf{Writes}}_{x}]}\mathrel{;}({\mathsf{WR}}_{\mathcal{G}}\cup{\mathsf{WW}}_{\mathcal{G}})^{\ast}\mathrel{;}{\mathsf{RW}}_{\mathcal{G}}(x))^{+}\cap\mathsf{Id}\subseteq\emptyset$. We apply the following Theorem from Kleene Algebra: for any relations $R_{1},R_{2}\subseteq\mathcal{T}_{\mathcal{G}}\times\mathcal{T}_{\mathcal{G}}$, $(R_{1}\mathrel{;}R_{2})^{+}=R_{1}\mathrel{;}(R_{2}\mathrel{;}R_{1})^{\ast}\mathrel{;}R_{2}$. This leads to the following:

[TABLE]

Also, by Proposition C.9, the latter can be rewritten as follows:

[TABLE]

which can be simplified into

[TABLE]

As a last step, note that ${\mathsf{RW}}_{\mathcal{G}}(x)\mathrel{;}{[{\sf{Writes}}_{x}]}\subseteq{\mathsf{RW}}_{\mathcal{G}}(x)$, hence we have

[TABLE]

which is exactly $\delta_{{\mathsf{PSI}}(x)}(\mathcal{G})\cap\mathsf{Id}\subseteq\emptyset$. ∎

D.4. Incompleteness for Arbitrary x-specifications of Consistency Models

One could ask whether Theorem 5.2 holds for non-simple x-specifications $\Sigma$, where $\mathsf{System}_{\Sigma}(\mathcal{G})$ is defined by including inequations of the form (V4), (A5), for each consistency guarantee $(\rho,\pi)\in\Sigma$. Unfortunately, this is not the case. Consider the x-specification $\Sigma=\{(\rho_{\mathsf{Id}},\rho_{\mathsf{SI}}),(\rho_{S},\rho_{S})\}$, and let $\mathcal{G}$ be the dependency graph depicted to the right. Recall that transactions with a double border are marked as serialisable.

We omitted from $\mathcal{G}$ a transaction $T_{0}$ which writes the value [math] for objects $x,v$, and which is seen by $T_{1},T_{3}$. For the dependency graph $\mathcal{G}$, the least solution of $\mathsf{System}_{\Sigma}(\mathcal{G})$ is $(X_{V}=\_,X_{A}={\sf{AR}}_{0},X_{N}=\_)$, where ${\sf{AR}}_{0}=\{(T_{2},T_{3}),(T_{4},T_{1})\}\cup\{(T_{0},T_{i})\}_{i=1}^{4}$. That is, ${\sf{AR}}_{0}$ is acyclic. However, there exists no abstract execution $\mathcal{X}\in{\mathsf{Executions}}(\Sigma)$ such that $\mathsf{graph}(\mathcal{X})=\mathcal{G}$. In fact, if such $\mathcal{X}$ existed, then $T_{1}$ and $T_{3}$ should be related by ${\sf{AR}}_{\mathcal{X}}$. However, it cannot be $T_{1}\xrightarrow{{\sf{AR}}_{\mathcal{X}}}T_{3}$: the axiom of the consistency guarantee $(\rho_{S},\rho_{S})$, ${[{{\tt SerTx}}]}\mathrel{;}{\sf{AR}}_{\mathcal{X}}\mathrel{;}{[{{\tt SerTx}}]}\subseteq{\mathsf{VIS}}_{\mathcal{X}}$, would imply $T_{1}\xrightarrow{{\mathsf{VIS}}_{\mathcal{X}}}T_{3}$; together with $T_{3}\xrightarrow{{\mathsf{RW}}_{\mathcal{X}}}T_{4}$ and the co-axiom induced by $(\rho_{\mathsf{Id}},\rho_{\mathsf{SI}})$, $({\mathsf{VIS}}_{\mathcal{X}}\mathrel{;}\overline{{\mathsf{VIS}}^{-1}_{\mathcal{X}}})\setminus\mathsf{Id}\subseteq{\sf{AR}}_{\mathcal{X}}$, this would mean that $T_{1}\xrightarrow{{\sf{AR}}_{\mathcal{X}}}T_{4}$. But we also have $T_{4}\xrightarrow{{\sf{AR}}_{\mathcal{X}}}T_{1}$, hence a contradiction. Similarly, we can prove $\neg(T_{3}\xrightarrow{{\sf{AR}}_{\mathcal{X}}}T_{1})$.