Distributed Transactional Systems Cannot Be Fast

TL;DR

This paper proves that fully transactional distributed systems cannot support fast read transactions if they also support multi-object writes, especially under causal or stronger consistency models, highlighting fundamental limitations.

Contribution

It establishes a formal impossibility result showing the incompatibility of fast read transactions with full transactional support in distributed systems under causal consistency and stronger models.

Findings

Fast read transactions require sacrificing multi-object transaction support.

Impossibility holds even with minimal object storage and partial replication.

Results justify current design choices in distributed transactional systems.

Abstract

We prove that no fully transactional system can provide fast read transactions (including read-only ones that are considered the most frequent in practice). Specifically, to achieve fast read transactions, the system has to give up support of transactions that write more than one object. We prove this impossibility result for distributed storage systems that are causally consistent, i.e., they do not require to ensure any strong form of consistency. Therefore, our result holds also for any system that ensures a consistency level stronger than causal consistency, e.g., strict serializability. The impossibility result holds even for systems that store only two objects (and support at least two servers and at least four clients). It also holds for systems that are partially replicated. Our result justifies the design choices of state-of-the-art distributed transactional systems and insists that system designers should not put more effort to design fully-functional systems that support both fast read transactions and ensure causal or any stronger form of consistency.

Figures

Tables

Table 1. Table 1 . Characterization of existing systems. Systems with a † rely on a different system model from the one we target.

System	Fast ROT			WTX	Consistency
	R	V	N
RAMP (Bailis et al., 2014)	$\le 2$	$\le 2$	yes	yes	Read Atomicity (Bailis et al., 2014)
COPS (Lloyd et al., 2011)	$\le 2$	$\le 2$	yes	no	Causal Consistency (Ahamad et al., 1995)
Orbe (Du et al., 2013)	2	1	no	no	Causal Consistency
GentleRain (Du et al., 2014)	2	1	no	no	Causal Consistency
ChainReaction (Almeida et al., 2013)	$\ge 1$	$\ge 1$	no	no	Causal Consistency
POCC (Kristina et al., 2017)	2	1	no	no	Causal Consistency
Contrarian (Didona et al., 2018)	2	1	yes	no	Causal Consistency
COPS-SNOW (Lu et al., 2016)	1	1	yes	no	Causal Consistency
Eiger (Lloyd et al., 2013)	$\le 3$	$\le 2$	yes	yes	Causal Consistency
Wren (Spirovska et al., 2018)	2	1	yes	yes	Causal Consistency
SwiftCloud† (Zawirski et al., 2015)	1	1	yes	yes	Causal Consistency
Cure  (Akkoorath et al., 2016)	2	1	no	yes	Causal Consistency
Yesquel (Aguilera et al., 2015)	1	1	no	yes	Snapshot Isolation (Berenson et al., 1995)
Occult (Mehdi et al., 2017)	$\ge 1$	$\ge 1$	yes	yes	Per Client Parallel SI (Mehdi et al., 2017)
Granola (Cowling and Liskov, 2012)	2	1	yes	yes	Serializability (Bernstein et al., 1987)
TAPIR (Zhang et al., 2015)	$\le 2$	1	yes	yes	Serializability
Eiger-PS† (Lu et al., 2016)	1	1	yes	yes	PO-Serializability (Lu et al., 2016)
Spanner† (Corbett et al., 2013)	1	1	no	yes	Strict Serializability (Papadimitriou, 1979)
DrTM (Wei et al., 2015)	$\ge 1$	$\ge 1$	no	yes	Strict Serializability
RoCoCo (Mu et al., 2014)	$\ge 1$	$\ge 1$	no	yes	Strict Serializability
RoCoCo-SNOW (Lu et al., 2016)	1	1	no	yes	Strict Serializability
Calvin (Thomson et al., 2012)	2	1	no	yes	Strict Serializability

Table 2. Table 2 . Table of symbols.

Symbol	Meaning	Used in
$X_i$	object $i$	System model and proofs
$x_i^{in}$	Initial, old value of object $x_i$	System model and proofs
$p_i$	Server that stores $x_i$	System model and proofs
$T_i^{in}$	Transaction that writes $x_i^{in}$	System model and proofs
$c_i^{in}$	Client that performs $T_i^{in}$	System model and proofs
$c_w$	Client that reads $x_0^{in}$ and $x_1^{in}$ and then performs a write transaction that writes new values $x_0$, $x_1$	System model and proofs
$T_r^{in}$	Read-only transaction issued by $c_w$ to read $X_0$, $X_1$	System model and proofs
$T_w$	Write-only transaction issued by $c_w$ that writes new values for $X_0$, $X_1$	All proofs
$x_i$	New value of $X_i$, written by $T_w$	All proofs
$c_r$	Client that invokes $T_r$ to read $X_0$, $Y_0$	System model and proofs
$m_{ji}$	j-th message sent by $p_i$	System model and proofs
$Q_{in}$	Initial configuration	Proof of Lemma 1 (See Figure 1)
$Q_0$	Configuration in which $x_0^{in}$, $x_1^{in}$ become visible	Proof of Lemma 1(See Figure 1)
$C_0$	Configuration in which $T_r^{in}$ has returned $x_0^{in}$, $x_1^{in}$ to $c_w$.	Proof of Lemma 1(See Figure 1)
$T_r$	Read-only transaction issued by $c_r$	All proofs
${\gamma }_{old}$	Execution in which $c_r$ reads $x_0^{in}$, $x_1^{in}$	Construction 1 (See Figure 2), Proof of Lemma 3
${\gamma }_{new}$	Execution in which $c_r$ reads $x_0$, $x_1$	Construction 2 (See Figure 2) Proof of Lemma 3
$\gamma$	Contradictory execution in which $c_r$ reads a mix of old and new values for $X_0$, $X_1$. $\gamma$ results from the mix of sub-executions of ${\gamma }_{old}$ and ${\gamma }_{new}$	Proof of claim 1 of Lemma 3 (see Figure 3)
$\beta$	Sub-sequence of $\gamma$	Proof of claim 1 of Lemma 3 (see Figure 3)
${\sigma }_{old}$	Sub-execution of ${\gamma }_{old}$ that leads $c_r$ to read $x_0^{in}$	Construction 1 (see Figure 2), Proof of claim 1 and 2 of Lemma 3
${\sigma }_{new}$	Sub-execution of ${\gamma }_{new}$ that leads $T_r$ of $c_r$ to read new values	Construction 1 (see Figure 2), Proof of claim 1 and 2 of Lemma 3
${\beta }_{new}$	Sequence of steps that brings the system to a configuration in which $x_0$, $x_1$ are visible	Proof of claim 1 and 2 of Lemma 3 (see Figure 3)
$\delta$	Contradictory execution in which $c_r$ reads a mix of old and new values for $X_0$, $X_1$. $\delta$ results from the mix of sub-executions of ${\gamma }_{old}$ and ${\gamma }_{new}$	Proof of claim 2 of Lemma 3
$\rho$	Subsequence of $\delta$ (similar to $\beta$)	Proof of claim 2 of Lemma 3
$\alpha$	Infinite execution that contains just one write-only transaction $T_w$ and such that the values written by $T_w$ never become visible	Proof of Lemma 3
${\alpha }_k$	Prefix of $\alpha$	Proof of Lemma 3

Full text

1. Introduction

Transactions represent a fundamental abstraction of distributed storage systems, as they facilitate the task of building correct applications. For this reason, distributed transactional storage systems are widely adopted in production environments (Azure, 2018; Stonebraker and Weisberg, 2013; Sikka et al., 2012; Labs, 2017; Oracle, 2018; MySQL, 2018; Qiao et al., 2013) and actively researched in academia (Corbett et al., 2013; Wei et al., 2015; Mu et al., 2014; Thomson et al., 2012; Zhang et al., 2015). Because many applications exhibit read-dominated workloads (Nishtala et al., 2013; Atikoglu et al., 2012; Bronson et al., 2013; Noghabi et al., 2016), read-only transactions are a particularly important building block of such systems. Hence, improving the performance of distributed read-only transactions has become a key requirement for modern such systems and a much investigated research topic (Corbett et al., 2013; Lu et al., 2016; Lloyd et al., 2013). To this end, the notion of fast read-only transactions has been introduced in (Lu et al., 2016) and studied in subsequent papers (Konwar et al., 2018; Tomsic et al., 2018; Didona et al., 2018). A fast read-only transaction satisfies the following three desirable properties (Lu et al., 2016): it completes in one round of communication (one-round), it does not rely on blocking mechanisms (nonblocking), and each server communicates to the client only one value for each object that it stores locally and is being read (one-value). Unfortunately, despite the huge effort put on designing efficient distributed transactional systems, read-only transactions in existing systems still suffer from performance limitations. For example, systems like Spanner (Corbett et al., 2013), DrTM (Wei et al., 2015), RoCoCo (Mu et al., 2014) implement read-only transactions that may require multiple rounds of communication, or rely on blocking mechanisms.

In systems that implement strong consistency, e.g., serializability (Bernstein et al., 1987), transactions facilitate the task of writing distributed applications by giving the illusion that concurrent operations take place sequentially. However, strong consistency comes at such a high cost (Bailis et al., 2013; Li et al., 2012) that, over the last years, a flurry of systems has abandoned strong consistency in favor of weaker consistency models (DeCandia et al., 2007; Cooper et al., 2008; Lloyd et al., 2011; Qiao et al., 2013). Among them, causal consistency (Ahamad et al., 1995) has garnered much attention, because it was expected to hit a sweet spot in the performance versus ease-of-programming trade-off. Causal consistency has intuitive semantics and eschews the synchronization that is needed to achieve strong consistency in the presence of replicas. It is also the strongest consistency level that can tolerate network partitions without blocking operations (Prince Mahajan and Dahlin, 2011; Attiya et al., 2015).

As expected, existing causally consistent storage systems achieve higher performance in comparison to strong consistency systems (Lloyd et al., 2011, 2013; Akkoorath et al., 2016; Du et al., 2014). However, causally consistent read-only transactions still suffer from latency overheads. In fact, state-of-the-art causally consistent storage systems either do not support fast read-only transactions (Du et al., 2014; Mehdi et al., 2017; Akkoorath et al., 2016; Spirovska et al., 2018) (i.e., they do not exhibit all three desirable properties) or they are of restricted functionality by not providing multi-object write transactions (Lu et al., 2016).

Contributions. In this paper, we present a result proving a fundamental limitation of transactional systems. Specifically, our impossibility result states that no fully-functional, causally consistent distributed transactional system can provide fast read-only transactions (and therefore also fast read transactions). Specifically, to achieve fast read transactions, the system has to give up support of multi-object write transactions, i.e., it can only support transactions that write at most one object. This result unveils an important trade-off between the latency attainable by read-only transactions and the functionality provided by a distributed storage system. It also shows that the inefficiency of the existing systems to achieve all the desirable properties (as described above) is not a coincidence.

Most theoretical results considered so far serializable transactions instead of causally consistent that we consider here, and this work includes a formalization of causally consistent transactional systems which is interesting in its own right. Our result holds for any system that ensures stronger consistency than causal consistency. Moreover, our result is relevant for the broad class of systems that use causal consistency as a building block to achieve their target consistency level (Balegas et al., 2015) or that implement hybrid consistency models which include causal consistency (Li et al., 2012, 2014; Ardekani and Terry, 2014; Terry et al., 2013). The impossibility result holds for any system that supports at least two servers and at least four clients. It holds even for systems that store only two objects (each in a different server). We prove that the impossibility result also holds for systems that are partially replicated.

To prove our impossibility result, we construct a troublesome infinite execution in which a write-only transaction that is executed solo never manages to make the values it writes visible. To do so, we inductively construct an infinite number of non-empty prefixes of the troublesome execution and prove that the written values are not yet visible after each prefix has been executed; specifically, some server has to send at least one more message before the values become visible. We argue this using indistinguishability arguments (Attiya and Welch, 2004; Lynch, 1996). The fact that, on the one hand, the constructed execution is infinite, and, on the other, that we focus on causal consistency which is a rather weak consistency condition, introduces complications that we have to cope with to get the proof.

In the case where the system has more than two servers, an extra challenge is to cope with the chains of messages through which information may be disseminated between the servers that store the written objects. This complicates the construction of the executions that we prove to be indistinguishable from the troublesome execution. To get the impossibility result for the case of a partially replicated system, an additional complication is that we have to construct an infinite sequence of server ids. These are the servers that send the necessary messages in each step for the induction to work. We also have to capture the fact that more than one servers may now respond to the same read request of a client. Due to lack of space, the general proof is provided in an attached appendix.

We study the limits of our impossibility result in all different premises. We show that if we relax any of the considered properties, then the impossibility result no longer holds.

Our impossibility result sheds light on some of the design decisions of recent systems and provides useful information to system designers. Specifically, they should not put more effort to devise a fully-functional system that supports both fast read transactions and ensures causal consistency (or any stronger consistency level).

Structure of the paper. Section 2 provides the model and useful definitions. Section 3 presents our impossibility result and discusses its limits in all different premises. Section 4 discusses related work. Section 5 provides some conclusions.

2. Model and Definitions

Storage system. We consider a distributed storage system which stores a finite number of objects. There are $m>1$ servers in the system. Each server stores a non-empty set of these objects. For simplicity, we assume that the set of objects stored in servers are disjoint. (Our result holds even if the system is partially replicated, i.e., if these sets are different but not disjoint, and none of them contains all the objects.)

Transactions. An arbitrarily large number of clients may read and/or write one or more objects by executing transactions. To prove our impossibility results, it is enough to focus on static transactions whose read-sets and write-sets are known from the beginning of the execution. (It follows that our impossibility result holds for systems of dynamic transactions as well.) A (static) transaction $T=(R_{T},W_{T})$ reads the objects in its read-set, $R_{T}$, and writes the objects in its write-set, $W_{T}$. If $W_{T}=\emptyset$, $T$ is called a read-only transaction, whereas if $R_{T}=\emptyset$, $T$ is a write-only transaction. We denote by $r(X)x$ a read on object $X$ which returns value $x$ and by $w(X)x$ a write of value $x$ to object $X$. Also, we denote by $r(X)*$ a read on object $X$ when the return value is unknown (with symbol $*$ as a place-holder). Reads and writes on objects are called object operations.

In typical deployments, there are many more clients than servers. Hence, allowing server-to-client out-of-band communication would result in nonnegligible overhead on the servers, which would suffer from reduced scalability and performance. For this reason, we naturally assume that to execute a transaction, a client can communicate with the servers (but not with other clients) and a server communicates with a client only to respond to a client’s read or write request. We find evidence of the relevance of this assumption in large-scale production systems, such as Facebook’s data platform (Nishtala et al., 2013), and in emerging systems (Lim et al., 2014; Jin et al., 2017; Didona and Zwaenepoel, 2019) and architectures (Li et al., 2015) for fast query processing, where no per-client states are maintained to avoid the corresponding overheads and to achieve the lowest latency.

System model. The system is asynchronous, i.e., the delay on message transmission can be arbitrarily large and the processes do not have access to a global clock. The system is modelled as an undirected graph in the standard way (Attiya and Welch, 2004; Lynch, 1996). Each node of the graph represents a process (i.e., a client or a server) whereas links connect every pair of processes. Each process is modelled as a state machine with its state containing a set of income and outcome buffers (Attiya and Welch, 2004, Ch. 2)111 There is one income and one outcome buffer for each link incident to each process. Income and outcome buffers store the messages that are sent or received through the corresponding link, respectively. . Links do not lose, modify, inject, or duplicate messages.

Operation executions. An implementation of a storage system provides algorithms, for each process, to execute reads and writes in the context of transactions. A configuration represents an instance of the system at some point in time. In an initial configuration $Q_{in}$, all processes are in initial states and all buffers are empty (i.e., no message is in transit). There are two kinds of events in the system: (1) a computation step taken by a process, in which the process reads all messages residing in its income buffers, performs some local computation and may send (at most) one message to each of its neighboring processes, and (2) a delivery event, where a message is removed from the outcome buffer of the source and is placed in the income buffer of the destination. An execution is a sequence of events (we assume that an execution also includes the invocations and responses of transactions, as well as the invocations and responses of object operations). An execution $\alpha$ is legal starting from a configuration $C$, if, for every process $p$, every computation step taken by $p$ in $\alpha$ is compatible to $p$’s state machine (given $p$’s state in $C$) and all messages sent are eventually received. Since the system is asynchronous, the order in which the events appear in an execution is assumed to be controlled by an adversary. A reachable configuration is a configuration that results from the application of a legal finite execution starting from an initial configuration. Given a reachable configuration $C$, we say that a computation step $s$ by a process $p$ eventually occurs, if in every legal execution starting from $C$ (in which $p$ takes a sufficient number of steps), $p$ executes $s$. For every reachable configuration $C$ and every legal execution $\alpha$ from $C$, we denote by $RC(C,\alpha)$ the configuration that results from the execution of $\alpha$ starting from $C$. Two executions are indistinguishable to a process $p$, if $p$ executes the same steps in each of them. Two configurations are indistinguishable to $p$, if $p$ is in the same state in both configurations. Given two executions $\alpha_{1}$ and $\alpha_{2}$, we denote by $\alpha_{1}\cdot\alpha_{2}$ the concatenation of $\alpha_{1}$ with $\alpha_{2}$, i.e., $\alpha_{1}\cdot\alpha_{2}$ is an execution consisting of all events of $\alpha_{1}$ followed by all events of $\alpha_{2}$ (in order).

Each client that invokes a transaction $T$ may eventually return a response. The response consists of a value for each object in $R_{T}$, and an $ack$ for each write $T$ performs. We say that $T$ has completed (or is complete), if the client $c$ that invoked $T$ has issued all read or write requests for $T$, and has received responses by the servers for all these requests. A transaction $T$ is active in some configuration $C$ if it has been invoked before $C$ and has not yet completed. We say that a configuration $C$ is quiescent if no transaction is active at $C$. Let $C$ be any reachable configuration that is either quiescent or only a single transaction $T$, invoked by a client $c$, is active at $C$. We say that $T$ executes solo starting from $C$, if only $c$ and the servers take steps after $C$ and $c$ does not invoke any transaction other than $T$ after $C$. We say that a value $x$ is written in an execution $\alpha$ if there exists some transaction $T$ in $\alpha$ that issues $w(X)x$ for some object $X$. For convenience, every execution we consider, starts with the execution of two initial transactions, $T_{0}^{in}=(w(X_{0})x_{0}^{in})$ (invoked by a client $c_{0}^{in}$) and $T_{1}^{in}=(w(X_{1})x_{1}^{in})$ (invoked by a client $c_{1}^{in}$) that write the initial values $x_{0}^{in}$ and $x_{1}^{in}$ in objects $X_{0}$ and $X_{1}$, respectively.

Causal Consistency. We consider an implementation of a transactional storage system that is causally consistent (Ahamad et al., 1995; Raynal et al., 1997). Informally, causal consistency ensures that causally-related transactions should appear, to all processes, like if they have been executed in the same order. The formal definitions below closely follow those presented for causally consistent transactional memory systems in (Dziuma et al., 2015).

The history $H(\alpha)$ of an execution $\alpha$ is the subsequence of $\alpha$ which contains only the invocations and responses of object operations (we omit $\alpha$ whenever it is clear from the context). A transaction $T$ is in $H$, if $H$ contains at least one invocation of an object operation by $T$. A transaction is complete in $H$ if it is complete in $\alpha$. For each client $c$, we denote by $H_{c}$ the subsequence of $H$ containing all invocations and responses of object operations issued or received by $c$. Given two executions $\alpha$ and $\alpha^{\prime}$, the histories $H(\alpha)$ and $H(\alpha^{\prime})$ are equivalent, if for each client $c$, $H_{c}(\alpha)=H_{c}(\alpha^{\prime})$. For each client $c$, the program-order, denoted by $<_{H|c}$, is a relation on transactions in $H_{c}$ such that for any two transactions $T_{1},T_{2}$, $T_{1}<_{H|c}T_{2}$ if and only if $T_{1}$ precedes $T_{2}$ in $H_{c}$.

We denote by $complete(H)$ the subsequence of all events in $H$ issued and received by complete transactions222We assume that in a system that supports causal or any weaker form of consistency, all transactions commit (Bailis et al., 2014; Lloyd et al., 2013).. We denote by $comm(H)$ a history that extends $H$: (1) $comm(H)=H\cdot H^{\prime\prime}$, i.e., $H$ is a prefix of $comm(H)$, (2) $H^{\prime\prime}$ contains only the responses for those write operations in $H$ for which there is no response.

A transaction $T_{1}$ precedes another transaction $T_{2}$ in $\alpha$ (or in $H(\alpha)$), if $T_{1}$ completes before $T_{2}$ is invoked. Similarly, an object operation $op_{1}$ precedes another object operation $op_{2}$ in $\alpha$ (or in $H(\alpha)$), if the response of $op_{1}$ precedes the invocation of $op_{2}$. An execution $\sigma$ is sequential if for every two transactions $T_{1}$, $T_{2}$ in $\sigma$, either $T_{1}$ precedes $T_{2}$ or vice versa. We define a sequential history in a similar way.

Consider a sequential execution $\sigma$ (legal from $Q_{in}$) and a transaction $T$ in $\sigma$. We say that $T$ is legal in $\sigma$, if for every invocation $r(X)v$ of a read operation on any object $X$ that $T$ performs, the following hold: (1) if there is an invocation of a write operation by $T$ that precedes $r(X)v$ in $\sigma$ then $v$ is the value argument of the last such invocation, (2) otherwise, if there are no transactions preceding $T$ in $\sigma$ which invoke write for object $X$, then $v$ is the initial value for $X$, (3) otherwise, $v$ is the value argument of the last invocation of a write operation to $X$, by any transaction that precedes $T$ in $\sigma$.

Consider any sequential history $S$ that is equivalent to $H$. We define a binary relation with respect to $S$, called reads-from and denoted by $<^{r}_{S}$, on transactions in $H$ such that, for any two distinct transactions $T_{1},T_{2}$ in $H$, $T_{1}<^{r}_{S}T_{2}$ if and only if: (1) $T_{2}$ executes a read operation $op$ that reads some object $X$ and returns a value $v$ for it, and (2) $T_{1}$ is the transaction in $S$ which executes the last write operation that writes $v$ for $X$ and precedes $T_{2}$. Each sequential history $S$ that is equivalent to $H$, induces a reads-from relation for $H$. Let ${\bf R}_{H}$ be the set of all reads-from relations that can be induced for $H$ (by considering all equivalent to $H$ sequential histories).

We say that a sequential history $S$ respects some relation $<$ on the set of transactions in $H$ if it holds that for any two transactions $T_{1}$, $T_{2}$ in $S$, if $T_{1}<T_{2}$, then $T_{1}$ precedes $T_{2}$ in $S$.

For each $<^{r}$ in ${\bf R}_{H}$, we define the causal relation for $<^{r}$ on transactions in $H$ to be the transitive closure of $\bigcup_{c}\left(<_{H|c}\right)\cup<^{r}$. We denote by ${\bf C}_{H}$ the set of all causal relations in $H$.

Definition 0 (Causal consistency).

An execution $\alpha$ is causally consistent if for history $H^{\prime}=comm(H(\alpha))$, there exists a causal relation $<^{c}$ in ${\bf C}_{complete(H^{\prime})}$ such that, for each client $c_{i}$, there exists a sequential execution $\sigma_{i}$ such that:

• •

$H(\sigma_{i})$ is equivalent to $complete(H^{\prime})$,

• •

$H(\sigma_{i})$ respects the causality order $<^{c}$, and

• •

every transaction executed by $c_{i}$ in $H(\sigma_{i})$ is legal.

An implementation is causally consistent if each execution $\alpha$ it produces is causally consistent.

Intuitively, a causally consistent distributed transactional system produces executions that respect the causality order. For simplicity, assume that all values written in an execution $\alpha$ are distinct. Then, if a client $c$ reads $x_{0}$ and $x_{1}$ for two objects $X_{0}$ and $X_{1}$, and $x_{0}<^{c}x_{1}$, then there is no $x^{\prime}_{0}$ such that $x_{0}<^{c}x^{\prime}_{0}<^{c}x_{1}$. The necessity to talk about sets of reads-from relations and sets of causal relations above comes from the fact that the values written in an execution $\alpha$ are not necessarily distinct.

Progress. To avoid trivial implementations in which every read-only transaction invoked by any client always returns $\bot$ or values written by the same client, we introduce the concept of value visibility.

Definition 0 (Value visibility).

Consider any object $X$ and let $C$ be any reachable configuration which is either quiescent or just a write-only transaction (by a client $c_{w}$) writing a value $x$ into $X$ (and possibly performing additional writes) is active in $C$.

Value $x$ is visible in $C$, if and only if: in every legal execution starting from $C$ which contains just a read-only transaction $T_{r}$ (invoked by a client $c\not\in\{c_{w},c_{0}^{in},c_{1}^{in}\}$) that reads $X$, $x$ is returned as $X$’s value for $T_{r}$.

We focus on storage systems that ensure minimal progress for write-only transactions. This is a weak progress property ensured even by systems in which write transactions are blocking. So, our impossibility result holds also for systems that ensure any stronger progress properties for write-only transactions (and without any restriction on progress for transactions that both read and write).

Definition 0 (Minimal Progress for write-only transactions).

Let $T_{w}$ be any write-only transaction which writes a value $x$ into an object $X$ ($T_{w}$ may also write other objects). If $T_{w}$ executes solo, starting from any reachable quiescent configuration $C$, then there exists a later configuration $C^{\prime}$ such that $x$ is visible in $C^{\prime}$.

We denote by $Q_{0}$ a reachable configuration in which both values $x_{0}^{in}$ and $x_{1}^{in}$, written by the transactions $T_{0}^{in}$ and $T_{1}^{in}$ discussed earlier, are visible. Definition 3 implies that $Q_{0}$ is well-defined.

We next present the definition of fast read-only transactions. Definition 4 expresses the exact same properties as in the original definition which was introduced in (Lu et al., 2016) and used in (Didona et al., 2018; Tomsic et al., 2018; Konwar et al., 2018).

Definition 0 (Fast read-only transaction).

We say that an implementation of a distributed storage system supports fast read-only transactions, if in each execution $\alpha$ it produces, the following hold for every read-only transaction $T$ executed in $\alpha$:

1. (1)

Non-blocking and One-Roundtrip Property. The client $c$ which invoked $T$ sends a message to all servers storing items that it wants to read and it does so in one computational step; moreover, each server performs at most one computational step to serve the request and respond to $c$. 2. (2)

One-value messages. Each message sent from a server to a client contains only one value that has been written by some write transaction in $\alpha$ into an object that is stored in the server and is read by the client333We remark that the message may also contain some metadata (e.g., a timestamp), as long as these metadata do not reveal any information about other transactions and additional written values to the client..

3. The Impossibility Result

In this section, we prove the impossibility result:

Theorem 1.

No causally consistent implementation of a transactional storage system supports transactions that write to multiple objects and fast read-only transactions.

The impossibility result holds even for systems that store just two objects $X_{0}$ and $X_{1}$. For ease of presentation, we prove it for a system with two servers $p_{0}$ and $p_{1}$. However, it can easily be extended to hold for the general case, where the system has any number of servers and is partially-replicated (see the appendix for the general proof). We assume that $p_{0}$ stores $X_{0}$ and $p_{1}$ stores $X_{1}$.

3.1. Outline of the Proof

We prove Theorem 1 by the way of contradiction. Table 2 in Appendix reports the list of the main symbols used throughout the proof. Assume that there exists a causally consistent implementation $\Pi$ which supports fast read-only transactions and transactions that write multiple objects. Assume also that $\Pi$ guarantees minimal progress for write-only transactions. We derive a contradiction by showing that there exists a troublesome execution which breaks minimal progress. Specifically, we construct an infinite execution $\alpha$ which contains just a write-only transaction $T_{w}=(w(X_{0})x_{0},w(X_{1})x_{1})$, invoked by some client $c_{w}\notin\{c_{0}^{in},c_{1}^{in}\}$, and we show that the values $x_{0}$ and $x_{1}$ written by $T_{w}$ never become visible. Intuitively, to do so, we inductively construct an infinite number of non-empty distinct prefixes of $\alpha$ and prove that the written values are not yet visible after each prefix has been executed. Specifically, we use indistinguishability arguments (Attiya and Welch, 2004; Lynch, 1996) to prove that after the execution of each such prefix, some server has to still send at least one message before the values become visible.

We now provide an informal, high-level outline of the proof. We start with two simple lemmas. The first shows that a transaction which reads $X_{0}$ and $X_{1}$ cannot return a subset of the values written by $T_{w}$ (i.e., it returns either the new values for both objects or the initial values for both objects). The second lemma shows that if one of the values written by $T_{w}$ is not visible, then both values written by $T_{w}$ are not visible. We use these lemmas to determine the values read by read-only transactions in the executions that we use. Specifically, we present two execution constructions that are useful in the proof of Theorem 1. Construction 1 describes an execution in which a read-only transaction reads the initial values for $X_{0}$ and $X_{1}$, whereas Construction 2 describes an execution in which a read-only transaction reads the new values for $X_{0}$ and $X_{1}$.

The two constructions are used to build an execution $\gamma$ which allows us to derive a contradiction: In $\gamma$, a read-only transaction reads a mix of old and new values for $X_{0}$ and $X_{1}$. We use $\gamma$ to prove, in the induction, that the values written by $T_{w}$ are not yet visible. We also prove that to make them visible, $p_{0}$ and $p_{1}$ have to exchange more messages. Therefore, after any arbitrary but finite number of steps, $T_{w}$ has not yet completed and the values written by it has not yet become visible, which contradicts eventual visibility.

3.2. Useful Constructions and Lemmas

To enforce a causal relation between the values written by $c_{w}$ in $T_{w}$ and $x_{0}^{in}$, $x_{1}^{in}$, the troublesome execution starts with the execution of a read-only transaction $T_{r}^{in}=(r(X_{0})*,r(X_{1})*)$ by $c_{w}$ (applied from $Q_{0}$). Since $T_{r}^{in}$ is a fast read-only transaction, $T_{r}^{in}$ completes; since $x_{0}^{in}$ and $x_{1}^{in}$ are visible in $Q_{0}$ (by definition), $c_{w}$ returns $(x_{0}^{in},x_{1}^{in})$ for $T_{r}^{in}$. Let $C_{0}$ be the configuration in which $T_{r}^{in}$ has completed and no message is in transit. The configurations $Q_{in}$, $Q_{0}$, $C_{0}$ are shown in Figure 1. All executions we refer to below start from $C_{0}$.

We now present the two lemmas that will be useful for the constructions and the proof of Theorem 1. The first states that in an execution in which a write transaction writes new values to a set of objects, a read transaction which reads these objects, cannot see only a subset of the new values. The proof comes as an immediate consequence of the fact that $\Pi$ ensures causal consistency.

Lemma 0.

Let $\tau$ be any legal execution of $\Pi$ starting from $C_{0}$ which contains two transactions: client $c_{w}$ invokes a write-only transaction $T_{w}=(w(X_{0})x_{0},w(X_{1})x_{1})$, and a client $c_{r}\neq c_{w}$ invokes a read-only transaction $T_{r}=(r(X_{0})*,r(X_{1})*)$ which completes in $\tau$. Let $v_{0}$ and $v_{1}$ be the two values which $c_{r}$ returns for $T_{r}$, i.e., $T_{r}=(r(X_{0})v_{0},r(X_{1})v_{1})$. Then, either $v_{0}=x_{0}$ and $v_{1}=x_{1}$, or $v_{0}=x_{0}^{in}$ and $v_{1}=x_{1}^{in}$.

Proof of Lemma 2.

To derive a contradiction, assume that there exists some execution $\tau$ of $\Pi$ starting from $C_{0}$ and some $i\in\{0,1\}$ for which $c_{r}$ returns the values $v_{i}=x_{i},v_{1-i}=x_{1-i}^{in}$ for $T_{r}$.

By causal consistency, $c_{r}$’s local history in $\tau$ respects causality. So, we can totally order $T_{1-i}^{in}$, $T_{w}$ and $T_{r}$ such that (1) $T_{1-i}^{in}$ is the last transaction which writes to $X_{1-i}$ and precedes $T_{r}$, so $T_{w}$ (which also writes $X_{1-i}$) precedes $T_{1-i}^{in}$; (2) $T_{w}$ is the last transaction which writes on $X_{i}$ and precedes $T_{r}$, so $T_{w}$ is ordered before $T_{r}$; and (3) $T_{1-i}^{in}$ is ordered before $T_{w}$ because $c_{w}$ reads the value written in $T^{in}_{1-i}$ before it initiates $T_{w}$ (as shown in Figure 1). A contradiction. ∎

The next lemma states that in an execution in which a write transaction $T_{w}$ writes new values in a set of objects, if one of the values written by $T_{w}$ is not visible at some configuration, then both values written by $T_{w}$ are not visible in that configuration.

Lemma 0.

Let $\tau$ be any legal execution starting from $C_{0}$ which contains just one transaction: client $c_{w}$ executes a write-only transaction $T_{w}=(w(X_{0})x_{0},w(X_{1})x_{1})$. Let $C$ be any reachable configuration when $\tau$ is applied from $C_{0}$. If either $x_{0}$ or $x_{1}$ is not visible in $C$, then there exists at least one client $c_{r}\not\in\{c_{w},c_{0}^{in},c_{1}^{in}\}$ such that if, starting from $C$, $c_{r}$ executes a fast read-only transaction $T_{r}=(r(X_{0})*,r(X_{1})*)$, then $c_{r}$ returns $(x_{0}^{in},x_{1}^{in})$ for $T_{r}$.

Proof of Lemma 3.

To derive a contradiction, consider some configuration $C$, reachable when $\tau$ is applied from $C_{0}$, in which at least one of the values $x_{0}$ and $x_{1}$ is not visible, and assume that for every client $c_{r}\not\in\{c_{w},c_{0}^{in},c_{1}^{in}\}$, if $c_{r}$ invokes $T_{r}$ starting from $C$, then $c_{r}$ does not return $(x_{0}^{in},x_{1}^{in})$ for $T_{r}$. Notice that since $\Pi$ ensures that read-only transactions are fast, $T_{r}$ completes. Then by Lemma 2, $c_{r}$ returns $(x_{0},x_{1})$. Since this holds for every client $c_{r}$ not in $\{c_{w},c_{0}^{in},c_{1}^{in}\}$, Definition 2 implies that at $C$ both $x_{0}$ and $x_{1}$ are visible. This contradicts the hypothesis that at least one of the two values is not visible in $C$. ∎

Notice that Lemma 3 holds for $C=C_{0}$, i.e., when $\tau$ is empty.

We now present Constructions 1 and 2 which are illustrated in Figure 2. Roughly speaking, the constructions illustrate two executions in which a write-only transaction $T_{w}$ writes values $x_{0}$ and $x_{1}$ to objects $X_{0}$ and $X_{1}$, respectively, and a read-only transaction $T_{r}$ reads $X_{0}$ and $X_{1}$. The executions are constructed so that $T_{r}$ returns $(x_{0}^{in},x_{1}^{in})$ in the first execution, whereas it returns $(x_{0},x_{1})$ in the second. Based on these constructions, we construct, in the proof of Theorem 1, an execution where $T_{r}$ returns a mix of initial and new values, allowing us to derive a contradiction. The constructions are based on a fixed $i\in\{0,1\}$ and a client $c_{r}$ that executes transaction $T_{r}$. Each time the construction is employed in the proof of Theorem 1 these parameters can be different. Although these executions are similar, we present both of them for ease of presentation.

We start with an intuitive description of Construction 1 which is depicted in Figure 2(a). Assume, without loss of generality, that $i=0$. (The construction when $i=1$ is symmetric.) The construction produces an execution in which $T_{w}$ starts executing from $C_{0}$ and runs solo up to any configuration $C$ in which $x_{0}$ is not yet visible. Next, $T_{r}$ is initiated from $C$ and takes steps until it sends a message to both servers. The adversary schedules the receipt of these messages so that $p_{0}$ receives the message first and sends a response. Then, $p_{1}$ receives the message sent by $c_{r}$ and sends back a response. Finally, $c_{r}$ takes steps to collect these responses and return. We call $\sigma_{old}$ the part of the execution starting from $C$ until the point that $p_{0}$ sends a response, and $\gamma_{old}$ the suffix of the execution starting from $C$. Lemma 3 allows us to argue that $c_{r}$ returns $(x_{0}^{in},x_{1}^{in})$ in $\gamma_{old}$. We next present the formalism of the construction.

Construction 1 (Construction of execution $\gamma_{old}(C,p_{i},c_{r})$ and execution $\sigma_{old}(C,p_{i},c_{r})$).

Let $\tau$ be any arbitrary legal execution starting from $C_{0}$ which contains just one transaction: client $c_{w}$ executes a write-only transaction $T_{w}=(w(X_{0})x_{0},w(X_{1})x_{1})$. Fix any $i\in\{0,1\}$. For every configuration $C$ that is reached when $\tau$ is applied from $C_{0}$ in which the value $x_{i}$ is not visible, Lemma 3 implies that there exists at least one client $c_{r}\not\in\{c_{w},c_{0}^{in},c_{1}^{in}\}$ such that if, starting from $C$, $c_{r}$ executes a fast read-only transaction $T_{r}=(r(X_{0})*,r(X_{1})*)$, then $c_{r}$ returns $(x_{0}^{in},x_{1}^{in})$ for $T_{r}$. For every such client $c_{r}$, we define $\gamma_{old}(C,p_{i},c_{r})$ to be the execution containing all of the events described below. In $\gamma_{old}(C,p_{i},c_{r})$, first $c_{r}$ invokes $T_{r}$ starting from $C$. So, $c_{r}$ takes steps and since it reads $X_{0}$ and $X_{1}$, $c_{r}$ sends a message $mo_{0}(C,p_{i},c_{r})$ to $p_{0}$ and a message $mo_{1}(C,p_{i},c_{r})$ to $p_{1}$. Next, the adversary schedules the delivery of $mo_{i}(C,p_{i},c_{r})$ and let $p_{i}$ take a step and receive $mo_{i}(C,p_{i},c_{r})$. Since $T_{r}$ is a fast transaction, once $p_{i}$ receives $mo_{i}(C,p_{i},c_{r})$, $p_{i}$ sends a response $mo_{i}^{\prime}(C,p_{i},c_{r})$ to $c_{r}$. Denote by $\sigma_{old}(C,p_{i},c_{r})$ the prefix of $\gamma_{old}(C,p_{i},c_{r})$ up until the step in which $p_{i}$ sends the response. After $\sigma_{old}(C,p_{i},c_{r})$ has been applied from $C$, the adversary schedules the delivery of $mo_{1-i}(C,p_{i},c_{r})$, and lets $p_{1-i}$ take steps to receive $mo_{1-i}(C,p_{i},c_{r})$ and send a response to $c_{r}$. Finally, $c_{r}$ take steps to receive the responses from $p_{0}$ and $p_{1}$ and return a response for $T_{r}$.

By the way $\gamma_{old}(C,p_{i},c_{r})$ is constructed and by Lemma 3, we get the following.

Observation 1.

The following claims hold:

1. (1)

*Execution $\gamma_{old}(C,p_{i},c_{r})$ is legal from $C$.

---

2. (2)

Only processes $p_{i}$ and $c_{r}$ take steps in $\sigma_{old}(C,p_{i},c_{r})$, so configurations $C$ and $RC(C,\sigma_{old}(C,p_{i},c_{r}))$ are indistinguishable to $c_{w}$ and $p_{1-i}$. 3. (3)

The return value for $T_{r}$ in $\gamma_{old}(C,p_{i},c_{r})$ is ($x_{0}^{in},x_{1}^{in}$).

Construction 2 is depicted in Figure 2(b). Again, assume, without loss of generality, that $i=0$. (The construction for the case where $i=1$ is symmetric.) The construction produces an execution in which $T_{w}$ starts its execution from $C_{0}$ and runs solo up to any configuration $C$ in which $x_{1}$ is visible. Then, $T_{r}$ is initiated from $C$ and $c_{r}$ takes steps until it sends a message to each of the servers. The adversary schedules the delivery of these messages so that $p_{1}$ receives the message first and sends back a response. Then, $p_{0}$ receives the message sent by $c_{r}$ and sends back a response. Finally, $c_{r}$ takes steps to collect these responses and return. We call $\sigma_{new}$ the part of this construction starting from $C$ until the point that $p_{1}$ sends a response, and $\gamma_{new}$ the suffix of this execution starting from $C$. We later argue (in Observation 2) that $c_{r}$ returns $(x_{0},x_{1})$ in $\gamma_{old}$. We next present the formalism of the construction.

Construction 2 (Construction of execution $\gamma_{new}(C,p_{i},c_{r})$ and execution $\sigma_{new}(C,p_{i},c_{r})$).

Let $\tau$ be any legal execution starting from $C_{0}$ which contains just one transaction: client $c_{w}$ executes a write-only transaction $T_{w}=(w(X_{0})x_{0},w(X_{1})x_{1})$. Fix any $i\in\{0,1\}$ and let $c_{r}$ be any client not in $\{c_{w},c_{0}^{in},c_{1}^{in}\}$. For every reachable configuration $C$ when $\tau$ is applied from $C_{0}$ in which $x_{i}$* is visible*, we define $\gamma_{new}(C,p_{i},c_{r})$ to be the execution containing all of the events described below. In $\gamma_{new}$, $c_{r}$ invokes $T_{r}$ starting from $C$ and takes steps until it sends a message $mn_{0}(C,p_{i},c_{r})$ to $p_{0}$ and a message $mn_{1}(C,p_{i},c_{r})$ to $p_{1}$. Let $C_{new}(C,p_{i},c_{r})$ be the resulting configuration. Next, the adversary schedules the delivery of $mn_{1-i}(C,p_{i},c_{r})$ and let $p_{1-i}$ take a step to receive $mn_{1-i}(C,p_{i},c_{r})$. Since $T_{r}$ is a fast transaction, once $p_{1-i}$ receives $mn_{1-i}(C,p_{i},c_{r})$, it sends a response $mn_{1-i}^{\prime}(C,p_{i},c_{r})$ to $c_{r}$. This sequence of steps starting from $C_{new}(C,p_{i},c_{r})$ to the step in which $p_{1-i}$ sends the response is denoted by $\sigma_{new}(C,p_{i},c_{r})$. Next, the adversary schedules the delivery of $mn_{i}(C,p_{i},c_{r})$ and lets $p_{i}$ take steps until it receives $mn_{i}(C,p_{i},c_{r})$ and sends a response to $c_{r}$. Finally, $c_{r}$ takes steps to receive the responses from $p_{0}$ and $p_{1}$ and return a response for $T_{r}$.

By the way $\gamma_{new}(C,p_{i},c_{r})$ is constructed, by Definition 2 and by Lemma 2, we get the following.

Observation 2.

The following claims hold for $\gamma_{new}(C,p_{i},c_{r})$:

1. (1)

*Execution $\gamma_{new}(C,p_{i},c_{r})$ is legal from $C$.

---

2. (2)

Configurations $C$ and $RC(C,\gamma_{new}(C,p_{i},c_{r}))$ are indistinguishable to $c_{w}$ and $p_{i}$. 3. (3)

The return value for $T_{r}$ in $\gamma_{new}(C,p_{i},c_{r})$ is $(x_{0},x_{1})$.

3.3. The Infinite Execution

Recall that we prove Theorem 1 by constructing an infinite execution $\alpha$ which contains just one write-only transaction $T_{w}$ and by proving that in $\alpha$, the values written by $T_{w}$ never becomes visible. We construct $\alpha$ in Lemma 4 using induction . Specifically, the lemma shows that there is an infinite sequence of executions $\alpha_{1},\alpha_{2},\ldots$ such that, all of them are distinct prefixes of $\alpha$ (we let $\alpha_{0}$ be the empty execution). Lemma 4 is comprised of two claims which hold for every integer $k\geq 0$. The first, shows that $\alpha_{k}$ contains the transmission of at least one message which is sent after the execution of $\alpha_{k-1}$ from $C_{0}$ (and thus, $\alpha_{k-1}$ is a prefix of $\alpha_{k}$ and $\alpha_{k-1}\neq\alpha_{k}$). The second shows that after $\alpha_{k}$ has been performed from $C_{0}$, the two values written by $T_{w}$ have not yet become visible. Although the proofs of the two claims exhibit many similarities, for clarity of presentation, we have decided not to merge them into one proof.

Lemma 0.

For any integer $k\geq 1$, there exists an execution $\alpha_{k}$, legal from $C_{0}$, in which only one transaction $T_{w}=(w(X_{0})x_{0},w(X_{1})x_{1})$ is executed by client $c_{w}$. Let $C_{k}$ be the configuration that results when $\alpha_{k}$ is applied from $C_{0}$. Then, the following hold:

1. (1)

$\alpha_{k}=\alpha_{k-1}\cdot\alpha_{k}^{\prime}$, where in $\alpha_{k}^{\prime}$ ** at least** one of the following occurs:

• •

a message is sent by $p_{k\%2}$ to $p_{(k-1)\%2}$, or

• •

a message is sent by $p_{k\%2}$ to $c_{w}$ and it holds that after $c_{w}$ receives this message, $c_{w}$ sends a message to $p_{(k-1)\%2}$. 2. (2)

In $C_{k}$, $x_{0}$ and $x_{1}$ are not visible ** and $T_{w}$ is still active*.*

Proof of Lemma 4.

By induction on $k$. We prove the base case together with the induction step, yet we clearly state the difference when the proof diverges. To prove the induction step, fix an integer $k>1$ and assume that the claim holds for any $j$, $1\leq j<k$.

Proof of claim 1. We start with claim 1. We start with a high-level description of the claim’s proof. The proof is by contradiction. We come up with two executions that have the following properties. In the first execution, a read-only transaction $T_{r}=(r(X_{0})*,r(X_{1})*)$ (initiated by a client $c^{k}_{r}\not\in\{c_{0}^{in},c_{1}^{in},c_{w}\}$) is executed starting from $C_{k-1}$. Since $x_{0}$ and $x_{1}$ are not visible neither in $C_{0}$ (since $T_{w}$ has not yet started its execution in $C_{0}$), nor in $C_{k-1}$ if $k>1$ (by induction hypothesis), the response for $T_{r}$ in this execution is $(x_{0}^{in},x_{1}^{in})$. This execution is constructed based on Construction 1. In the second execution, $c^{k}_{r}$ invokes $T_{r}$ after $T_{w}$ has executed solo long enough so that both values $x_{0}$ and $x_{1}$ are visible (minimal progress for write-only transactions implies that visibility of $x_{0}$ and $x_{1}$ will eventually happen). So, $c^{k}_{r}$ returns $(x_{0},x_{1})$ for $T_{r}$ in this execution. The second execution is constructed based on Construction 2. We then combine parts of these two executions to get a third execution, $\gamma$. Execution $\gamma$ is constructed so that we can prove that in it, $c^{k}_{r}$ will return the same value for $X_{k\%2}$ as $c^{k}_{r}$ does in the first execution, and the same value for $X_{(k-1)\%2}$ as $c^{k}_{r}$ does in the second execution. Therefore, in $\gamma$, $c^{k}_{r}$ returns $(x_{k\%2}^{in},x_{(k-1)\%2})$ for $T_{r}$. This contradicts Lemma 2.

We continue with the details of the proof of claim 1. To derive a contradiction, assume that the claim does not hold, i.e., we let $c_{w},p_{0},p_{1}$ take steps starting from $C_{k-1}$ and assume the following:

• •

$p_{k\%2}$ sends no message to $p_{(k-1)\%2}$;

• •

$p_{k\%2}$ sends no message to $c_{w}$ for which it holds that after $c_{w}$ receives it, $p_{k\%2}$ sends a message to $p_{(k-1)\%2}$.

Since $x_{0}$ and $x_{1}$ are not visible neither in $C_{0}$ nor in $C_{k-1}$, Lemma 3 implies that there exists at least one client $c_{r}^{k}\not\in\{c_{w},c_{0}^{in},c_{1}^{in}\}$ such that if, starting from $C_{k-1}$, $c_{r}^{k}$ executes a read-only transaction $T_{r}=(r(X_{0})*,r(X_{1})*)$, then $c_{r}^{k}$ returns $(x_{0}^{in},x_{1}^{in})$ for $T_{r}$. We derive the contradiction by constructing the execution $\gamma$, in which, in addition to $T_{w}$, $c_{r}^{k}$ executes such a read-only transaction $T_{r}$, and by showing that $\gamma$ contradicts Lemma 2.

To construct $\gamma$, we need to define an execution $\beta$ and a subsequence $\beta_{new}$ of it. Specifically, $\beta_{new}$ is utilized as part of execution $\gamma$. Roughly speaking, $\gamma$ starts with $\sigma_{old}(C_{k-1},p_{k\%2},c_{r}^{k})$ (see Construction 1) up to the point that $p_{k\%2}$ reports $x_{k\%2}^{in}$ for $X_{k\%2}$ to $c_{r}^{k}$ (see Observation 1). Recall that only processes $c_{r}^{k}$ and $p_{k\%2}$ take steps in $\sigma_{old}(C_{k-1},p_{k\%2},c_{r}^{k})$ (by Observation 1). Then, the events of $\beta_{new}$ are executed to take the system in a configuration where $x_{0}$ and $x_{1}$ are visible. The assumption we made above to derive a contradiction, allows us to design $\beta_{new}$ so that, $c_{r}^{k}$ and $p_{k\%2}$ do not take any steps in it, and the values written by $T_{w}$ are visible after $\beta_{new}$ is applied starting from $C_{k-1}$ (as well as from $RC(C_{k-1},\sigma_{old}(C_{k-1},p_{k\%2},c_{r}^{k}))$). Afterwards, an execution $\gamma_{new}$, which is derived based on Construction 2, is applied from the resulting configuration. In $\gamma_{new}$ only process $p_{(k-1)\%2}$ take steps (see Observation 2). Execution $\beta_{new}$ has been designed so that $p_{(k-1)\%2}$ is ”unaware” of $p_{k\%2}$’s decision on what to report to $c_{r}^{k}$ as the current value of the object that $p_{k\%2}$ stores. So, $p_{(k-1)\%2}$ reports $x_{(k-1)\%2}$ for $X_{(k-1)\%2}$ as it does in Construction 2 (Observation 2). The construction of $\gamma$ concludes with $c_{r}^{k}$ taking steps until $T_{r}$ responds. We argue (below) that $c_{r}^{k}$ receives in $\gamma$ the same message regarding the value of $X_{k\%2}$ as in $\gamma_{old}(C_{k-1},p_{k\%2},c_{r}^{k})$, so it returns $x_{k\%2}^{in}$ for $X_{k\%2}$ (by Observation 1). We also argue that $c_{r}^{k}$ receives in $\gamma$ the same message regarding the value of $X_{(k-1)\%2}$ as in $\gamma_{new}$, so it returns $x_{(k-1)\%2}$ for $X_{(k-1)\%2}$ (by Observation 2). This contradicts Lemma 2.

We first define $\beta$. For the base case (where $k=1$), $c_{w}$ invokes $T_{w}$ starting from $C_{0}$ and executes solo (i.e., only $c_{w},p_{0},p_{1}$ take steps) until $x_{0}$ and $x_{1}$ are visible; since $T_{w}$ has not yet been invoked in $C_{0}$, $x_{0}$ and $x_{1}$ are not visible in $C_{0}$. For the induction step, the induction hypothesis (claim 2) implies that in $C_{k-1}$, $x_{0}$ and $x_{1}$ are not visible. Again, we let $c_{w}$ execute solo, starting from $C_{k-1}$, until $x_{0}$ and $x_{1}$ are visible (minimal progress implies that this will eventually happen). In either case, let $C_{v}$ be the first configuration after $C_{k-1}$ in which $x_{0}$ and $x_{1}$ are visible. Let $\beta$ be the sequence of steps taken from $C_{k-1}$ to $C_{v}$ (all of them are by $c_{w}$ and the servers).

In this and the next two paragraphs, we define $\beta_{new}$ and show that it is legal from $C_{k-1}$. Let $\beta^{\prime}_{p}$ be the shortest prefix of $\beta$ which contains all messages sent by $c_{w}$ to $p_{(k-1)\%2}$, and let $\beta^{\prime}_{s}$ be the remaining suffix of $\beta$. Let $\beta_{p}$ be the subsequence of $\beta^{\prime}_{p}$ in which all steps taken by $p_{k\%2}$ have been removed. Let $\beta_{s}$ be the subsequence of $\beta^{\prime}_{s}$ containing only steps by $p_{(k-1)\%2}$. Let $\beta_{new}$ be $\beta_{p}\cdot\beta_{s}$. Note that $\beta_{new}$ does not contain any step by $p_{k\%2}$. Executions $\beta$, $\beta_{p}$ and $\beta_{s}$ are illustrated in Figure 3(a). In the figure, symbols $i,1-i\in\{0,1\}$ refer to $k\%2$ and $(k-1)\%2$ respectively.

To show that $\beta_{new}$ is legal from $C_{k-1}$, we first argue that $\beta_{p}$ is legal from $C_{k-1}$. Because $\beta^{\prime}_{p}$ is a prefix of $\beta$, $\beta^{\prime}_{p}$ is legal from $C_{k-1}$. By assumption, $p_{k\%2}$ sends no message to $p_{(k-1)\%2}$, so if $p_{(k-1)\%2}$ receives any message from $p_{k\%2}$ in $\beta^{\prime}_{p}$, then the message must have been sent before $C_{k-1}$ (and must have been received after it), i.e., the message is not sent in $\beta^{\prime}_{p}$. (For the base case, since no message is in transit in $C_{0}$, $p_{(k-1)\%2}$ receives no message from $p_{k\%2}$ in $\beta^{\prime}_{p}$.) Moreover, by assumption, after $\alpha_{k-1}$, $p_{k\%2}$ sends no message to $c_{w}$ for which it holds that after $c_{w}$ receives it, $c_{w}$ sends a message to $p_{(k-1)\%2}$. Since, by definition, $\beta^{\prime}_{p}$ ends with a message sent by $c_{w}$ to $p_{(k-1)\%2}$ (if $\beta^{\prime}_{p}$ is not empty), it follows that: for the base case, $c_{w}$ receives no message from $p_{k\%2}$ in $\beta^{\prime}_{p}$; for the induction step, if $c_{w}$ receives any message from $p_{k\%2}$ in $\beta^{\prime}_{p}$, then the message has been sent before $C_{k-1}$. Thus, $\beta_{p}$, which results from the removal of all steps taken by $p_{k\%2}$ from $\beta^{\prime}_{p}$, is legal from $C_{k-1}$. Moreover, $RC(C_{k-1},\beta^{\prime}_{p})$ and $RC(C_{k-1},\beta_{p})$ (i.e., the configurations that result when $\beta^{\prime}_{p}$ and $\beta_{p}$, respectively, are applied from $C_{k-1}$) are indistinguishable to $p_{(k-1)\%2}$ and $c_{w}$.

To complete the argument that $\beta_{new}$ is legal from $C_{k-1}$, it remains to prove that $\beta_{s}$ is legal from $RC(C_{k-1},\beta_{p})$. By definition, only $p_{(k-1)\%2}$ takes steps in $\beta_{s}$. Note that, because $RC(C_{k-1},\beta^{\prime}_{p})$ and $RC(C_{k-1},\beta_{p})$ are indistinguishable to $p_{(k-1)\%2}$, by proving that $\beta_{s}$ is legal from $RC(C_{k-1},\beta_{p}^{\prime})$, it follows that $\beta_{s}$ is legal from $RC(C_{k-1},\beta_{p})$. We next argue that $\beta_{s}$ is indeed legal from configuration $RC(C_{k-1},\beta_{p}^{\prime})$. By assumption, if $p_{(k-1)\%2}$ receives any message from $p_{k\%2}$ in $\beta_{s}$, then the message has been sent before $C_{k-1}$ (i.e., the message has not been sent in $\beta$). For the base case, since no message is in transit in $C_{0}$, $p_{(k-1)\%2}$ receives no message from $p_{k\%2}$ in $\beta_{s}$. Recall that, by definition of $\beta^{\prime}_{p}$, all messages from $c_{w}$ to $p_{(k-1)\%2}$ are sent by the end of $\beta_{p}^{\prime}$. Therefore, $c_{w}$ does not send any message to $p_{(k-1)\%2}$ in $\beta^{\prime}_{s}$. So, any message that $p_{(k-1)\%2}$ receives from $c_{w}$ in $\beta_{s}$ has been sent by the end of $\beta_{p}^{\prime}$. Thus, $\beta_{s}$ is legal from $RC(C_{k-1},\beta_{p}^{\prime})$, and since $RC(C_{k-1},\beta^{\prime}_{p})$ and $RC(C_{k-1},\beta_{p})$ are indistinguishable to $p_{(k-1)\%2}$, $\beta_{s}$ is also legal from $RC(C_{k-1},\beta_{p})$. Therefore, $\beta_{new}=\beta_{p}\cdot\beta_{s}$ is legal from $C_{k-1}$.

From the arguments above, it also follows that $RC(C_{k-1},\beta_{p}\cdot\beta_{s})$ and $C_{v}=RC(C_{k-1},\beta_{p}^{\prime}\cdot\beta_{s}^{\prime})$ are indistinguishable to $p_{(k-1)\%2}$. Therefore, $RC(C_{k-1},\beta_{new})$ and $C_{v}$ are indistinguishable to $p_{(k-1)\%2}$.

We continue to construct $\gamma$. To do so, we use $\sigma_{old}(C_{k-1},p_{k\%2},c_{r}^{k})$ (Construction 1), $\beta_{new}$, and $\sigma_{new}(C_{v},p_{k\%2},c_{r}^{k})$ (Construction 2). We also refer to configuration $C_{new}(C_{v},p_{k\%2},c_{r}^{k})$ (Construction 2). Figure 3(b) illustrates the construction of $\gamma$, where symbols $i,1-i\in\{0,1\}$ refer to $k\%2$ and $(k-1)\%2$ respectively. (For simplicity, we omit $(C_{k-1},p_{k\%2},c_{r}^{k})$ and $(C_{v},p_{k\%2},c_{r}^{k})$ from the notations below.)

Recall that in $\gamma$, a client starts a read-only transaction from $C_{k-1}$. One server responds to the client first (i.e., $\sigma_{old}$ is applied from $C_{k-1}$). Then the write-only transaction makes progress and the values written turn to be visible (specifically, $\beta_{new}$ is applied after $\sigma_{old}$). Then the other server receives the request of the read-only transaction and responds to the client (specifically, $\sigma_{new}$ is applied). Recall that (as we argue below) to one server, $\gamma$ is indistinguishable from $\gamma_{old}$ (i.e., the execution illustrated in Figure 3(b) is indistinguishable from that in Figure 2(a)) and thus the server returns an old value, while to the other server, $\gamma$ is indistinguishable from $\gamma_{new}$ (i.e., the execution illustrated in Figure 3(b) is indistinguishable from that in Figure 2(b)) and thus the other server returns a new value. This then leads to the contradiction.

We are now ready to formally define $\gamma$. Starting from $C_{k-1}$, the adversary applies $\sigma_{old}(C_{k-1},p_{k\%2},c_{r}^{k})\cdot\beta_{new}\cdot\sigma_{new}(C_{v},p_{k\%2},c_{r}^{k}))$ (we later prove that the application of these steps from $C_{k-1}$ is legal). By Construction 1, in the last step of $\sigma_{old}$, $p_{k\%2}$ sends a message $mo_{k\%2}^{\prime}$ to $c_{r}^{k}$. Similarly, by Construction 2, in the last step of $\sigma_{new}$, $p_{(k-1)\%2}$ sends a message $mn_{(k-1)\%2}^{\prime}$ to $c_{r}^{k}$. The adversary next schedules the delivery of $mo_{k\%2}^{\prime}$ and $mn_{(k-1)\%2}^{\prime}$, and lets $c_{r}^{k}$ take steps until $T_{r}$ completes (this will happen because $T_{r}$ is a fast transaction). This concludes the construction of $\gamma$.

We now argue that $\gamma$ is legal. By construction, only processes $c_{r}^{k}$ and $p_{k\%2}$ take steps in $\sigma_{old}$. By Observation 1 (claim 2), $C_{k-1}$ and $RC(C_{k-1},\sigma_{old})$ are indistinguishable to $c_{w}$ and $p_{(k-1)\%2}$. Since only $c_{w}$ and $p_{(k-1)\%2}$ take steps in $\beta_{new}$, it follows that $\beta_{new}$ is legal from $RC(C_{k-1},\sigma_{old})$. Since the processes that take steps in $\sigma_{old}$ and $\beta_{new}$ are disjoint, then $RC(C_{k-1},\sigma_{old}\cdot\beta_{new})$ and $RC(C_{k-1},\beta_{new}\cdot\sigma_{old})$ are indistinguishable to all processes. Recall that $RC(C_{k-1},\beta_{new})$ and $C_{v}$ are indistinguishable to $p_{(k-1)\%2}$. Since $\sigma_{old}$ is composed of a sequence of steps in which only $c_{r}^{k}$ and $p_{k\%2}$ take steps, $RC(C_{v},\sigma_{old})$ and $C_{new}(C_{v},p_{k\%2},c_{r}^{k})$ are indistinguishable to $p_{(k-1)\%2}$. It follows that $RC(C_{k-1},\beta_{new}\cdot\sigma_{old})$ and $C_{new}(C_{v},p_{k\%2},c_{r}^{k})$ are indistinguishable to $p_{(k-1)\%2}$. Because only $p_{(k-1)\%2}$ takes steps in $\sigma_{new}$ and $\sigma_{new}$ is legal from $C_{new}$ (by definition), it follows that $\sigma_{new}$ is legal from $RC(C_{k-1},\sigma_{old}\cdot\beta_{new})$. Therefore, $\gamma$ is legal.

We now focus on the values returned by $c_{r}^{k}$ for $T_{r}$ in $\gamma$. In $\gamma$, $c_{r}^{k}$ executes only transaction $T_{r}$. Thus, $c_{r}^{k}$ decides the response for $T_{r}$ based solely on the values included in $mo_{k\%2}^{\prime}$ (sent by $p_{k\%2}$ in $\sigma_{old}$) and $mn_{(k-1)\%2}^{\prime}$ (sent by $p_{(k-1)\%2}$ in $\sigma_{new}$). For the base case, $mo_{k\%2}^{\prime}$ is sent before $c_{w}$ takes any step, so $mo_{k\%2}^{\prime}$ contains neither $x_{0}$ nor $x_{1}$. For the induction step, since $mo_{k\%2}^{\prime}$ is sent in $\gamma_{old}$, by Observation 1 and the one-value messages property, $mo_{k\%2}^{\prime}$ contains neither $x_{0}$ nor $x_{1}$. Recall that $mn_{(k-1)\%2}^{\prime}$ is sent in $\gamma_{new}$. By Observation 2 and the one-value messages property, $mn_{(k-1)\%2}^{\prime}$ contains the value $x_{(k-1)\%2}$. Recall that (by assumption) $c_{r}^{k}$ does not receive any other messages from $p_{0}$ and $p_{1}$. Thus, $c_{r}^{k}$ receives for $X_{k\%2}$ just one value, namely, the same value it receives for it in $\gamma_{old}$. Similarly, it receives for $X_{(k-1)\%2}$ just one value, namely, the same value it receives for it in $\gamma_{new}$. It follows that in $\gamma$, the values that $c_{r}^{k}$ returns are $x_{k\%2}^{in}$ for $X_{k\%2}$ and $x_{(k-1)\%2}$ for $X_{(k-1)\%2}$. This contradicts Lemma 2. (Note that $\gamma$ is an execution utilized just for proving claim 1; for every $k>1$, we build it from scratch to prove the induction step for $k$.)

Definition of $\alpha_{k}$ and $C_{k}$. We now define $\alpha_{k}$ and $C_{k}$. By claim 1, it follows that in any legal execution starting from $C_{k-1}$ in which $c_{w}$ executes solo, at least one of the following two statements hold: (1) $p_{k\%2}$ sends a message to $p_{(k-1)\%2}$; (2) $p_{k\%2}$ sends a message to $c_{w}$ so that after $c_{w}$ receives this message, $c_{w}$ sends a message to $p_{(k-1)\%2}$. Let $ms_{k}$ be the first message that satisfies any of the two statements above. We construct execution $\alpha_{k}^{\prime}$ as follows. In $\alpha_{k}^{\prime}$, $T_{w}$ executes solo starting from $C_{k-1}$ until $ms_{k}$ is sent444Clearly, in $\alpha_{k}^{\prime}$, $p_{k\%2}$ must take at least one step. For the case where $k\geq 2$, we also require that in $\alpha_{k}^{\prime}$, in the first step which $p_{k\%2}$ takes, message $ms_{k-1}$ is delivered at $p_{k\%2}$ (in order to comply with our model of finite message delay).. Let $\alpha_{k}=\alpha_{k-1}\cdot\alpha_{k}^{\prime}$, and let $C_{k}$ be the configuration that results when $\alpha_{k}$ is applied from $C_{0}$.

Proof of claim 2. To prove claim 2, we use similar arguments as those in the proof of claim 1. We assume that claim 2 does not hold, i.e., we assume that in $C_{k}$, $x_{i}$ is visible for some $i\in\{0,1\}$. To derive a contradiction, we construct an execution $\delta$ (in a way similar to that we construct $\gamma$) and show that $\delta$ contradicts Lemma 2. We first define executions $\rho$ and $\rho_{new}$ in a way similar to $\beta$ and $\beta_{new}$ defined in the proof of claim 1. We finally define $\delta$ based on $\sigma_{old}(C_{k-1},p_{k\%2},c_{r}^{k})$, $\rho_{new}$, and $\sigma_{new}(C_{k},p_{k\%2},c_{r}^{k})$, and we argue that in $\delta$, $c_{r}^{k}$ returns a response for $T_{r}$ that contradicts Lemma 2.

We now present the details of the proof of claim 2. Assume that in $C_{k}$, $x_{i}$ is visible for some $i\in\{0,1\}$. We construct $\delta$ by utilizing executions $\sigma_{old}(C_{k-1},p_{k\%2},c_{r}^{k})$ and $\gamma_{old}(C_{k-1},p_{k\%2},c_{r}^{k})$ (Construction 1), as well as $\sigma_{new}(C_{k},p_{k\%2},c_{r}^{k})$ and $\gamma_{new}(C_{k},p_{k\%2},c_{r}^{k})$ (Construction 2). By Observation 1, $c_{r}^{k}$ returns $x_{(k-1)\%2}^{in}$ for $X_{(k-1)\%2}$ and $x_{k\%2}^{in}$ for $X_{k\%2}$ for $T_{r}$ in $\gamma_{old}(C_{k-1},p_{k\%2},c_{r}^{k})$. Because by assumption, $x_{i}$ is visible at $C_{k}$, Observation 2 implies that $c_{r}^{k}$ returns $x_{(k-1)\%2}$ for $X_{(k-1)\%2}$ and $x_{k\%2}$ for $X_{k\%2}$ for $T_{r}$ in $\gamma_{new}(C_{k},p_{k\%2},c_{r}^{k})$.

To construct $\delta$, we first define an execution $\rho$ and some subsequences of it, and we study their properties. (The construction of $\rho$ and its subsequences is similar to that of $\beta$ and its subsequences. Yet, the reasoning of why the construction is legal is different, and thus worth-presenting.) Let $\rho$ be the sequence of steps which are taken from $C_{k-1}$ to $C_{k}$, i.e., $\rho=\alpha_{k}^{\prime}$. Let $\rho^{\prime}_{p}$ be the shortest prefix of $\rho$ which contains all messages sent by $c_{w}$ to $p_{(k-1)\%2}$, and let $\rho^{\prime}_{s}$ be the remaining suffix of $\rho$. Let $\rho_{p}$ be the subsequence of $\rho^{\prime}_{p}$ in which all steps taken by $p_{k\%2}$ have been removed. Let $\rho_{s}$ be the subsequence of $\rho^{\prime}_{s}$ containing only steps by $p_{(k-1)\%2}$. Let $\rho_{new}$ be $\rho_{p}\cdot\rho_{s}$. We utilize $\rho_{new}$ as part of our construction of $\delta$ below ( as we did with $\beta_{new}$ and $\gamma$). In the next two paragraphs, we argue that $\rho_{new}$ is legal from $C_{k-1}$.

We first argue that $\rho_{p}$ is legal from $C_{k-1}$. Because $\rho^{\prime}_{p}$ is a prefix of $\rho$, $\rho^{\prime}_{p}$ is legal from $C_{k-1}$. For the base case ($k=1$), since no message is in transit in $C_{0}$, the definition of $\alpha_{k}$ implies that $p_{(k-1)\%2}$ receives no message from $p_{k\%2}$ in $\rho^{\prime}_{p}$. For the induction step, the definition of $\alpha_{k}$ implies that if $p_{(k-1)\%2}$ receives any message from $p_{k\%2}$ in $\rho^{\prime}_{p}$, then the message has been sent before $C_{k-1}$, i.e., the message is not sent in $\rho^{\prime}_{p}$. Moreover, by definition of $\alpha_{k}^{\prime}$, $p_{k\%2}$ sends no message to $c_{w}$ for which it holds that after the receipt of this message, $c_{w}$ sends a message to $p_{(k-1)\%2}$. Since, by definition, $\rho^{\prime}_{p}$ ends with a message sent by $c_{w}$ to $p_{(k-1)\%2}$ (if $\rho^{\prime}_{p}$ is not empty), it follows that: for the base case, $c_{w}$ receives no message from $p_{k\%2}$ in $\rho^{\prime}_{p}$; for the induction step, if $c_{w}$ receives any message from $p_{k\%2}$ in $\rho^{\prime}_{p}$, then the message has been sent before $C_{k-1}$. Thus, $\rho_{p}$, which results from the removal of all steps taken by $p_{k\%2}$ from $\rho^{\prime}_{p}$, is legal from $C_{k-1}$. Moreover, $RC(C_{k-1},\rho^{\prime}_{p})$ and $RC(C_{k-1},\rho_{p})$ are indistinguishable to $p_{(k-1)\%2}$ and $c_{w}$.

To complete the argument that $\rho_{new}$ is legal from $C_{k-1}$, it remains to argue that $\rho_{s}$ is legal from $RC(C_{k-1},\rho_{p})$. By definition, only $p_{(k-1)\%2}$ takes steps in $\rho_{s}$. note that, because $RC(C_{k-1},\rho^{\prime}_{p})$ and $RC(C_{k-1},\rho_{p})$ are indistinguishable to $p_{(k-1)\%2}$, by proving that $\rho_{s}$ is legal from $RC(C_{k-1},\rho_{p}^{\prime})$, it follows that $\rho_{s}$ is legal from $RC(C_{k-1},\rho_{p})$. We next argue that $\rho_{s}$ is indeed legal from configuration $RC(C_{k-1},\rho_{p}^{\prime})$. By the definition of $\alpha_{k}$, if $p_{(k-1)\%2}$ receives any message from $p_{k\%2}$ in $\rho_{s}$, then the message has been sent before $C_{k-1}$ (i.e., the message has not been sent in $\rho$). For the base case, since no message is in transit in $C_{0}$, the definition of $\alpha_{k}$ implies that $p_{(k-1)\%2}$ receives no message from $p_{k\%2}$ in $\rho_{s}$. Recall that by definition of $\rho_{s}^{\prime}$, all messages from $c_{w}$ to $p_{(k-1)\%2}$ are sent by the end of $\rho_{p}^{\prime}$). Thus, $\rho_{s}$ is legal from $RC(C_{k-1},\rho_{p}^{\prime})$, and since $RC(C_{k-1},\rho_{p}^{\prime})$ and $RC(C_{k-1},\rho_{p})$ are indistinguishable to $p_{(k-1)\%2}$, $\rho_{s}$ is also legal from $RC(C_{k-1},\rho_{p})$. Therefore, $\rho_{new}=\rho_{p}\cdot\rho_{s}$ is legal from $C_{k-1}$.

From the arguments above, it also follows that $RC(C_{k-1},\rho_{p}\cdot\rho_{s})$ and $C_{k}=RC(C_{k-1},\rho_{p}^{\prime}\cdot\rho_{s}^{\prime})$ are indistinguishable to $p_{(k-1)\%2}$. Because $RC(C_{k-1},\rho^{\prime}_{p})$ and $RC(C_{k-1},\rho_{p})$ are indistinguishable to $p_{(k-1)\%2}$, it follows that $RC(C_{k-1},\rho_{new})$ and $C_{k}$ are indistinguishable to $p_{(k-1)\%2}$.

We are now ready to formally define $\delta$. To do so, we use executions $\sigma_{old}(C_{k-1},p_{k\%2},c_{r}^{k})$ (Construction 1), $\sigma_{new}(C_{k},p_{k\%2},c_{r}^{k})$ (Construction 2) and $\rho_{new}$. We also refer to $C_{new}(C_{k},p_{k\%2},c_{r}^{k})$ (Construction 2).

Starting from $C_{k-1}$, the adversary applies the step sequence $\sigma_{old}(C_{k-1},p_{k\%2},c_{r}^{k})\cdot\rho_{new}\cdot\sigma_{new}(C_{v},p_{k\%2},c_{r}^{k}))$ (we later prove that the application of these steps from $C_{k-1}$ is legal). For simplicity, we omit $(C_{k-1},p_{k\%2},c_{r}^{k})$ and $(C_{v},p_{k\%2},c_{r}^{k})$ from the notations below (thus abusing notations $\sigma_{new}$ and $C_{new}$ which were also used in the proof of claim 1.) By Construction 1, in the last step of $\sigma_{old}$, $p_{k\%2}$ sends a message $mo_{k\%2}^{\prime}$ to $c_{r}^{k}$. Similarly, by Construction 2, in the last step of $\sigma_{new}$, $p_{(k-1)\%2}$ sends a message $mn_{(k-1)\%2}^{\prime}$ to $c_{r}^{k}$. The adversary next schedules the delivery of $mo_{k\%2}^{\prime}$ and $mn_{(k-1)\%2}^{\prime}$, and lets $c_{r}^{k}$ take steps until $T_{r}$ completes (this will happen because $T_{r}$ is a fast transaction). This concludes the construction of $\delta$.

We now argue that $\delta$ is legal. By construction, only processes $c_{r}^{k}$ and $p_{k\%2}$ take steps in $\sigma_{old}$. By Observation 1 (claim 2), $C_{k-1}$ and $RC(C_{k-1},\sigma_{old})$ are indistinguishable to $c_{w}$ and $p_{(k-1)\%2}$. Since only $c_{w}$ and $p_{(k-1)\%2}$ take steps in $\rho_{new}$, it follows that $\rho_{new}$ is legal from $RC(C_{k-1},\sigma_{old})$. Since the processes that take steps in $\sigma_{old}$ and $\rho_{new}$ are disjoint, then $RC(C_{k-1},\sigma_{old}\cdot\rho_{new})$ and $RC(C_{k-1},\rho_{new}\cdot\sigma_{old})$ are indistinguishable to all processes. Recall that $RC(C_{k-1},\rho_{new})$ and $C_{k}$ are indistinguishable to $p_{(k-1)\%2}$. Since $\sigma_{old}$ is a composed of sequence of steps in which only $c_{r}^{k}$ and $p_{k\%2}$ take steps, $RC(C_{k},\sigma_{old})$ and $C_{new}(C_{k},p_{k\%2},c_{r}^{k})$ are indistinguishable to $p_{(k-1)\%2}$. It follows that $RC(C_{k-1},\rho_{new}\cdot\sigma_{old})$ and $C_{new}(C_{v},p_{k\%2},c_{r}^{k})$ are indistinguishable to $p_{(k-1)\%2}$. Because only $p_{(k-1)\%2}$ takes steps in $\sigma_{new}$ and $\sigma_{new}$ is legal from $C_{new}$ (by definition), it follows that $\sigma_{new}$ is legal from $RC(C_{k-1},\sigma_{old}\cdot\rho_{new})$. Therefore, $\delta$ is legal.

We now focus on the values returned by $c_{r}^{k}$ for $T_{r}$ in $\delta$. In $\delta$, $c_{r}^{k}$ executes only transaction $T_{r}$. Thus, $c_{r}^{k}$ decides the response for $T_{r}$ based solely on the values included in $mo_{k\%2}^{\prime}$ (sent by $p_{k\%2}$ in $\sigma_{old}$) and $mn_{(k-1)\%2}^{\prime}$ (sent by $p_{(k-1)\%2}$ in $\sigma_{new}$). For the base case, $mo_{k\%2}^{\prime}$ is sent before $c_{w}$ takes any step, so $mo_{k\%2}^{\prime}$ contains neither $x_{0}$ nor $x_{1}$. For the induction step, since $mo_{k\%2}^{\prime}$ is sent in $\sigma_{old}$, by Observation 1 and the one-value messages property, $mo_{k\%2}^{\prime}$ contains neither $x_{0}$ nor $x_{1}$. Recall that $mn_{(k-1)\%2}^{\prime}$ is sent in $\sigma_{new}$. By Observation 2 and the one-value messages property, $mn_{(k-1)\%2}^{\prime}$ contains the value $x_{(k-1)\%2}$. Recall that (by assumption) $c_{r}^{k}$ does not receive any other messages from $p_{0}$ and $p_{1}$. Thus, $c_{r}^{k}$ receives for $X_{k\%2}$ just one value, namely, the same value it receives for it in $\gamma_{old}$ (Construction 1). Similarly, it receives for $X_{(k-1)\%2}$ just one value, namely, the same value it receives for it in $\gamma_{new}$ (Construction 2). It follows that in $\delta$, the values that $c_{r}^{k}$ returns are $x_{k\%2}^{in}$ for $X_{k\%2}$ and $x_{(k-1)\%2}$ for $X_{(k-1)\%2}$. This contradicts Lemma 2. ∎

3.4. The Limits of the Impossibility Result

Theorem 1 shows that multi-object write transactions (W) are incompatible with nonblocking (N), one-roundtrip (O) and one-value (V) read-only transactions. In this section, we investigate the limits of our impossibility result. We show that it is sufficient to relax any of these properties to obtain a distributed storage system that satisfies the rest. To this end, we describe possible designs that achieve combinations of three out of the four properties.

N + R + V. This combination supports fast read-only transactions and is implemented by COPS-SNOW (Lu et al., 2016). When a client $c$ writes a new value $x_{1}$ of object $X_{1}$, $c$ piggybacks the information about its causal dependencies.Before making $x_{1}$ visible, the server $p_{1}$ storing $X_{1}$ contacts all servers that store objects listed in such dependency list. For each such object $X$, $p_{1}$ collects the identifiers of the read-only transactions that have read a value of $X$ that is not the last written. Then $p_{1}$ enforces that $x_{1}$ is invisible to these read-only transactions. This prevents a read-only transaction from reading $x_{1}$ and then $x_{0}$, if in the meanwhile $x^{\prime}_{0}$ has been created such that $x_{0}<^{c}x^{\prime}_{0}<^{c}x_{1}$. Recall that COPS-SNOW does not ensure the W property, i.e., it does not support multi-object write transactions.

N + V + W. This design is implemented by Wren (Spirovska et al., 2018). In this system, the servers periodically exchange information about the minimum timestamp among those of complete transactions. This cutoff timestamp is such that there does not exist any non-complete (or future) transaction with a lower timestamp. The cutoff timestamp is used to identify a snapshot of the data storage system from which a read-only transaction can read without blocking. A new object written by a client is assigned a timestamp higher than the cutoff timestamp, so as to reflect the causal dependencies of the object. Therefore, each client caches locally the values of the objects it writes, as long as their timestamps are smaller than the cutoff. This mechanism allows a client to read its own writes that are not included yet in the snapshot identified by the cutoff timestamp. Thus, each read-only transaction undergoes a first round of communication to get informed about the cutoff timestamp (we remark that this timestamp can be provided by any server) and then executes a second round of communication to actually read the objects.

N + R + W. Although we are not aware of any system that implements this design, we briefly discuss a modification of the COPS system (Lloyd et al., 2011) to achieve this combination of properties. COPS does not implement multi-object write transactions and implements read-only transactions that are nonblocking but may require two rounds of communication, each communicating just one value of the object to be read. We can augment COPS to achieve R and W as follows. Each write operation within a transaction must carry a) the values of the other objects written in the same transaction and b) information about all objects on which the transaction causally depends (including their values). This additional meta-data is stored with each written object. Hence, $c$ executes a read-only transaction as follows. First, for each object $o$ to read, $c$ retrieves the value of $o$ and the additional meta-data from the corresponding server. Then, once $c$ has received a reply from each involved partition, $c$ identifies, for each object, the last written value, which is returned to the application. This protocol is not efficient, as it requires to store and communicate a prohibitively big amount of data. It is an open problem whether a more efficient N+R+W protocol exists.

R + V + W. This design is implemented by RoCoCo-SNOW (Lu et al., 2016) and Spanner (Corbett et al., 2013), which achieve strict serializability, and hence satisfy causal consistency. RoCoCo-SNOW implements a mechanism similar to COPS-SNOW, but assumes the a priori knowledge of the data accessed by transactions, which are executed as stored procedures. Spanner assumes tightly synchronized physical clocks and leverages the known bound on clock drift to order transactions. It is an open problem whether a R + V + W implementation exists that does not rely on such assumptions.

4. Related Work

Existing systems. Table 1 characterizes existing systems from the point of view of the sub-properties of fast read-only transactions that they achieve, their support for multi-object write transactions, and their target consistency level. Consistently with our theorem, none among the systems that target the system model described in Section 2 implements multi-object write transactions and fast read-only transactions. Several systems achieve three out of the four properties we consider, and COPS-SNOW is the only one that implements fast read-only-transactions while complying with our system model. Our theorem implies that the design of these systems cannot be improved with respect to the properties we consider.

SwiftCloud and Eiger-PS implement fast read-only transactions and support multi-object write transactions, but assume a system model that differs from the one we target. Although they eventually complete all writes, the values they write may be invisible to some clients for an indefinitely long time. Hence, read-only transactions may see very old values of some objects, even the initial ones. To improve the freshness of the data seen by the clients, servers can communicate with clients out of the scope of transactional operations. This requires that the servers maintain a view of the connected clients. Typically, there are far more clients than servers, so this design choice results in reduced performance and scalability and is avoided by state-of-the-art data platforms. Furthermore, SwiftCloud assumes only a single partition that stores the whole data set (potentially fully replicated across multiple sites).

Impossibility results. Existing impossibility results on storage systems typically rely on stronger consistency or progress properties. Brewer (Brewer, 2010) conjectured the CAP theorem, according to which no implementation guarantees consistency, availability, and network partition tolerance. Gilbert and Lynch (Gilbert and Lynch, 2002) formalized and proved this conjecture. Specifically, they formalized consistency by using the notion of atomic objects (Lamport, 1986) (i.e., by assuming linearizability (Herlihy and Wing, 1990), which is stronger than causal consistency). Roohitavaf et al. (Roohitavaf et al., 2017) considered a replicated storage system implemented using data centers (i.e., clusters of servers), and a model in which any value written is immediately visible to the reads initiated in the same data center. They proved that it is impossible to ensure causal consistency, availability and network partition tolerance across data centers. Their proof (as well as the proof of the CAP Theorem) rely on message losses, whereas in our model no message can be lost.

Mahajan et al. (Prince Mahajan and Dahlin, 2011) proved that no implementation guarantees one-way convergence (a progress condition stating that if processes communicate appropriately, then they eventually converge on the values they read for objects), availability, and any consistency stronger than real time causal consistency (Prince Mahajan and Dahlin, 2011) assuming that messages may be lost. In their model, communication may occur among any pair of processes. On the contrary, in our model, communication cannot occur directly between clients, the progress property we assume is simpler (and decoupled from the underlying communication), and no message may be lost.

Variants of causal consistency motivated by replicated systems have been presented in (Attiya et al., 2017; Xiang and Vaidya, 2017). Their definitions are based on the events that are executed at the servers (and not on the histories of operations executed in the transactions issued by the clients). Attiya et al. (Attiya et al., 2017) proved that a (non-transactional) replicated storage system implementing multi-valued registers (i.e., registers for which a read returns the set of values written by conflicting writes) cannot satisfy any consistency strictly stronger than observable causal consistency. Xiang and Vaidya (Xiang and Vaidya, 2017) defined the notion of replica-centric causal consistency, and they proved that (non-transactional) replicated distributed storage systems ensuring this consistency property have to track writes. These works are in different avenues than our work and focus on other models than that in our paper.

Lu et al. (Lu et al., 2016) proved the SNOW theorem, which shows that no fully-functional distributed transactional system can support fast strictly serializable read-only transactions. Lu et al. also showed that any fully-functional distributed transactional system that achieves a consistency level weaker than or equal to process-ordered serializability (Lu et al., 2016) (and hence causal consistency) can support fast read-only transactions. Tomsic et al. (Tomsic et al., 2018) further showed that implementing fast read-only transactions with an order-preserving consistency level (as is the case for causal consistency) is possible only by allowing read-only transactions to read possibly stale values of the objects being accessed. These results may seem at odds with our impossibility result. However, these results rest on very weak assumptions on the progress guarantees of write operations. Although they assume that all writes eventually complete, the values they write may be invisible to clients for an indefinitely long time. Such a weak assumption allows the design of trivial algorithms in which read-only transactions can return arbitrarily old values –even the initial ones– for the objects they read.

Recently, Didona et. al (Didona et al., 2018) showed a lower bound on the number of bits that must be communicated in order to support fast causally consistent read-only transactions in distributed storage systems. On the contrary, this paper focuses on the design implications of fast read transactions in distributed transactional such systems, showing that they are incompatible with multi-object write transactions.

Since the introduction of causal consistency by Ahamad et al. (Ahamad et al., 1995) for a shared memory system, other versions of causal consistency has been studied (Raynal et al., 1997; Lloyd et al., 2011). Our result holds if we replace our definition of causal consistency with those provided in these papers.

5. Conclusion

We present an impossibility result that establishes a fundamental trade-off in the design of distributed transactional storage systems: fast read transactions cannot be achieved by fully-functional transactional storage systems. The design of such systems must either sacrifice fast read transactions, or must settle for reduced functionality, i.e., support only single-object write transactions.

Unlike most previous work on distributed transactional systems, which target strong consistency, our result assumes only causal consistency. This broadens the scope of our result which applies also to systems that implement any consistency level stronger than causal consistency, or a hybrid consistency level that includes causal consistency. Proving our result under such weak consistency model is nontrivial and required us to devise a complex proof.

Our result sheds light on the design choices of state-of-the-art distributed transactional storage systems, and is useful for the architects of such systems because it identifies impossible designs.

Our result also opens several interesting research questions, such as investigating which is the weakest consistency condition for which our impossibility result holds. In addition, it is interesting to further investigate the design of systems that provide some of the combinations of the studied properties, as discussed in Section 3.4.

Acknowledgements

This research has been supported by the European Union’s H2020-FETHPC-2016 programme under grant agreement No 754337 (project EuroExa), by the European ERC Grant 339539-AOC, and by an EcoCloud post-doctoral research fellowship. Part of this work has been performed while P. Fatourou was working as a visiting professor at EPFL.

Appendix A The General Impossibility Result

We prove our impossibility result i.e., if a causally consistent implementation of a transactional storage system supports write-only transactions that write to more than one object, then it cannot also provide fast read-only transactions for the general case, where the system has any number of servers and the system is partially replicated. By partial replication, we mean that each server stores a different set of objects but these sets are not disjoint. In addition, no server stores all objects; i.e., for any server, there is an object such that the server does not store it. To access an object, the algorithm is allowed to access all servers that store the object. In this case, we need to revisit our definition of a fast read-only transaction.

Definition 0 (General fast read-only transaction).

We say that an implementation of a distributed storage system supports fast read-only transactions, if in each execution $\alpha$ it produces, the following hold for every read-only transaction executed in $\alpha$:

1. (1)

Non-blocking and One-Roundtrip Property. Same as in Definition 4; 2. (2)

General one-value messages. (a) Each message sent from a server to a client does not contain any value that has been written by some write transaction in $\alpha$ to an object $X$ if $X$ is not stored on the server; (b) Let $\Sigma_{X}$ be the set of servers which store an object $X$. For each object $X$ read by a client, only one server in $\Sigma_{X}$ sends a message to the client and the message contains only one value that has been written by some write transaction in $\alpha$ to $X$.

Theorem 2.

No causally consistent implementation of a transactional storage system that supports transactions which can concurrently read and write multiple objects, provides fast read-only transactions.

(The claim of Theorem 2 remains the same as that of Theorem 1. The only difference is that we now assume a partially replicated system.)

The proof is by contradiction. Assume that there exists a causally consistent implementation $\Pi$ which supports concurrent read-write transactions that access multiple objects and provides fast read-only transactions. We construct an infinite execution $\alpha$ which contains just a write-only transaction $T_{w}$, invoked by some client $c_{w}$, and we show that the values written by $T_{w}$ never become visible.

Let $N+1$ be the number of objects stored in the system. For convenience, every execution we consider in this paper, starts with the execution of $N+1$ initial transactions, starting from $Q_{in}$. Each transaction is denoted by $T_{i}^{in}$ (invoked by $c_{i}^{in}$) that writes some initial value $x_{i}^{in}$ in $X_{i}$. We denote by $QE_{0}$ a reachable configuration in which all values $x_{0}^{in},x_{1}^{in},\ldots,x_{N}^{in}$ are visible and all buffers are empty.555If such reachable configuration does not exist, it is already shown that for $x_{0}^{in},x_{1}^{in},\ldots,x_{N}^{in}$ to be visible, there are always messages in buffers, which contradicts the progress condition. We also revisit the definition of value visibility to exclude from later executions, these clients $c_{0}^{in},c_{1}^{in},$ $\ldots,$ $c_{N}^{in}$ whose sole purpose is to initialize values for each object.

Definition 0 (General value visibility).

Consider any object $X$ and let $C$ be any reachable configuration which is either quiescent or just a write-only transaction (by a client $c_{w}$) writing a value $x$ into $X$ is active in $C$. Value $x$ is visible in $C$, if and only if the following holds: in every legal execution starting from $C$ which contains just a read-only transaction $T_{r}$ (invoked by any client $c\not\in\{c_{w},c_{0}^{in},c_{1}^{in},\ldots,c_{N}^{in}\}$) that reads $X$, $x$ is returned as the value of $X$ for $T_{r}$.

For convenience, every execution we construct hereafter, starts with the execution of a read-only transaction $T_{r}^{in}=(r(X_{0})*,r(X_{1})*,$ $\ldots,r(X_{N})*)$ by a client $c_{w},c_{w}\notin\{c_{0}^{in},c_{1}^{in},\ldots,c_{N}^{in}\}$ (starting from $QE_{0}$). Since $T_{r}^{in}$ is a fast read-only transaction, $T_{r}^{in}$ completes; since $x_{0}^{in},x_{1}^{in},\ldots,x_{N}^{in}$ are visible in $QE_{0}$, $c_{w}$ returns $(x_{0}^{in},x_{1}^{in},\ldots,x_{N}^{in})$ for $T_{r}^{in}$. We denote by $CE_{0}$ a reachable configuration starting from the configuration in which $T_{r}^{in}$ completes, in which all buffers are empty (i.e., no message is in transit).

For every reachable configuration $C$ (starting from $CE_{0}$) and every legal execution $\gamma$ from $C$, we denote by $RC(C,\gamma)$ the configuration that results from the execution of $\gamma$ starting from $C$. Given two executions $\gamma_{1}$ and $\gamma_{2}$, we denote by $\gamma_{1}\cdot\gamma_{2}$ the concatenation of $\gamma_{1}$ with $\gamma_{2}$, i.e., $\gamma_{1}\cdot\gamma_{2}$ is an execution consisting of all events of $\gamma_{1}$ followed by all events of $\gamma_{2}$ (in order).

A.1. Preliminary Observations and Lemmas

We start with some useful observations. The first is an immediate consequence of the fact that $\Pi$ ensures causal consistency.

Observation 3.

Let $\gamma$ be any legal execution of $\Pi$ starting from $CE_{0}$ which contains two transactions: client $c_{w}$ invokes a write-only transaction $T_{w}=(w(X_{0})x_{0},w(X_{1})x_{1},\ldots,w(X_{N})x_{N})$, and a different client $c_{r}$ invokes a read-only transaction $T_{r}=(r(X_{0})*,r(X_{1})*,\ldots,$ $r(X_{N})*)$ which completes in $\gamma$. Let $v_{i}$ be the value which $c_{r}$ returns for $T_{r}$, i.e., $T_{r}=(r(X_{0})v_{0},r(X_{1})v_{1},\ldots,r(X_{N})v_{N})$. Then, either $v_{i}=x_{i},\forall i\in\{0,1,\ldots,N\}$, or $v_{i}=x_{i}^{in}\forall i\in\{0,1,\ldots,N\}$.

Observation 4.

Let $\tau$ be any arbitrary legal execution starting from $CE_{0}$ which contains just one transaction: client $c_{w}$ executes a write-only transaction $T_{w}=(w(X_{0})x_{0},w(X_{1})x_{1},\ldots,w(X_{N})x_{N}$ (i.e., $c_{w}$ and the servers take steps to execute $T_{w}$). Let $C$ be any reachable configuration when $\tau$ is applied from $CE_{0}$. If $\exists i,x_{i}$ is not visible in $C$, then there exists at least one client $c_{r}\notin\{c_{w},c_{0}^{in},c_{1}^{in},\ldots,c_{N}^{in}\}$ such that if, starting from $C$, $c_{r}$ executes a read-only transaction $T_{r}=(r(X_{0})*,$ $r(X_{1})*,\ldots,r(X_{N})*)$, then $c_{r}$ returns $(x_{0}^{in},x_{1}^{in},\ldots,x_{N}^{in})$ for $T_{r}$.

Proof.

To derive a contradiction, assume that for any client $c_{r}\not\in\{c_{w},c_{0}^{in},c_{1}^{in},\ldots,c_{N}^{in}\}$ $c_{r}$ invokes $T_{r}$ and $c_{r}$ does not return $(x_{0}^{in},x_{1}^{in},\ldots,x_{N}^{in})$. Notice that by convention, as $\tau$ starts from $CE_{0}$, $v_{i}=\bot$ for any $i\in\{0,1,\ldots,N\}$ is not an option. (Notice also that since $\Pi$ ensures that read-only transactions are fast, $T_{r}$ completes.) Then by Observation 3, $c_{r}$ returns $(x_{0},x_{1},\ldots,x_{N})$. Since $c_{r}$ is chosen to be an arbitrary client not in $\{c_{w},c_{0}^{in},c_{1}^{in},\ldots,c_{N}^{in}\}$, Definition 3 implies that at $C$, $x_{i},\forall i\in\{0,1,\ldots,N\}$ is visible. This contradicts the hypothesis that at least one of the values is not visible. ∎

Notice that if $C=CE_{0}$, then Observation 4 holds for all clients not in $\{c_{w},c_{0}^{in},c_{1}^{in},\ldots,c_{N}^{in}\}$.

In the rest of the proof, we will repeatedly employ the two executions we present in Constructions 3 and 4 (each time using different parameters for the construction).

Construction 3 (Construction of execution $\gamma_{old}(C,p,c_{r})$ and execution $\sigma_{old}(C,p,c_{r})$).

Let $\tau$ be any arbitrary legal execution starting from $CE_{0}$ which contains just one transaction: client $c_{w}$ executes a write-only transaction $T_{w}=(w(X_{0})x_{0},w(X_{1})x_{1},\ldots,w(X_{N})x_{N})$. take steps to execute $T_{w}$). Fix any server $p$. For every reachable configuration $C$ when $\tau$ is applied from $CE_{0}$ in which the following holds: no value other than $x_{i}^{in}$ is visible for $X_{i}$ for at least one $i\in\{0,1,\ldots,N\}$, and for every client $c_{r}$ that satisfies Observation 4, we define execution $\gamma_{old}(C,p,c_{r})$ as follows. In $\gamma_{old}(C,p,c_{r})$, first $c_{r}$ invokes $T_{r}$ starting from $C$. So, $c_{r}$ takes steps and since it reads all objects, $c_{r}$ sends a message $mo_{q}(C,p,c_{r})$ to every server $q$. Next, $mo_{q}(C,p,c_{r})$ is delivered for every server $q,q\neq p$ and then each server $q,q\neq p$ takes a step and receives $mo_{q}(C,p,c_{r})$. Since $T_{r}$ is a fast transaction, once $q$ receives $mo_{q}(C,p,c_{r})$, either $q$ sends a response $mo_{q}^{\prime}(C,p,c_{r})$ to $c_{r}$ within the same step, or $q$ does not. Denote by $\sigma_{old}(C,p,c_{r})$ this sequence of steps starting from $C$ to the step in which every server $q,q\neq p$ has taken a step and sent the response (if $q$ sends it). Next, we let the remaining message, i.e., $mo_{p}(C,p,c_{r})$, be delivered, and let $p$ take a step to receive $mo_{p}(C,p,c_{r})$. By one-roundtrip property, once $p$ receives $mo_{p}(C,p,c_{r})$, either $p$ sends a response to $c_{r}$ within the same step, or $p$ does not. Finally, we let $c_{r}$ take steps, receive the responses from $p$ and every server $q,q\neq p$ (if they send a response), complete $T_{r}$, and return a response for it.

By the way $\gamma_{old}(C,p,c_{r})$ is constructed and by Observation 4, we get the following.

Observation 5.

The following claims hold:

1. (1)

Execution $\gamma_{old}(C,p,c_{r})$ is legal from $C$, and 2. (2)

The return value for $T_{r}$ in $\gamma_{old}(C,p,c_{r})$ is $(x_{0}^{in},x_{1}^{in},\ldots,x_{N}^{in})$.

Construction 4 (Construction of execution $\gamma_{new}(C,p,c_{r})$ and execution $\sigma_{new}(C,p,c_{r})$).

Let $\tau$ be any arbitrary legal execution starting from $CE_{0}$ which contains just one transaction: client $c_{w}$ executes a write-only transaction $T_{w}=(w(X_{0})x_{0},w(X_{1})x_{1},\ldots,w(X_{N})x_{N})$. Fix any server $p$ and let $c_{r}$ be any client not in $\{c_{w},c_{0}^{in},c_{1}^{in},\ldots,c_{N}^{in}\}$. For every reachable configuration $C$ when $\tau$ is applied from $CE_{0}$, in which $x_{i}$* is visible* for $X_{i}$ for at least one $i\in\{0,1,\ldots,N\}$, we define execution $\gamma_{new}(C,p,c_{r})$ as follows. In $\gamma_{new}$, starting from $C$, $c_{r}$ invokes $T_{r}$ and takes steps until it sends a message $mn_{q}(C,p,c_{r})$ to every server $q$. Let $C_{new}(C,p,c_{r})$ be the resulting configuration. Next, we let $mn_{p}(C,p,c_{r})$ be delivered. Then, $p$ takes a step and receives $mn_{p}(C,p,c_{r})$. Since $T_{r}$ is a fast transaction, once $p$ receives $mn_{p}(C,p,c_{r})$, either $p$ sends a response $mn_{p}^{\prime}(C,p,c_{r})$ to $c_{r}$ within the same step, or $p$ does not. This sequence of steps starting from $C_{new}(C,p,c_{r})$ to the step which $p$ takes (inclusive) is denoted by $\sigma_{new}(C,p,c_{r})$. Next, we let $mn_{q}(C,p,c_{r})$ be delivered for any server $q,q\neq p$, and let each $q$ take a step to receive $mn_{q}(C,p,c_{r})$; once $q$ receives $mn_{q}(C,p,c_{r})$, either $q$ sends a response $mn_{q}^{\prime}(C,p,c_{r})$ to $c_{r}$ within the same step, or $q$ does not. Finally, we let $c_{r}$ take steps. Since $T_{r}$ is a fast transaction, once $c_{r}$ receives the responses from $p$ and every server $q,q\neq p$ (if they send a response to $c_{r}$), $T_{r}$ completes and $c_{r}$ returns a response for $T_{r}$.

By the way $\gamma_{new}(C,p,c_{r})$ is constructed and by Definition 3, we get the following.

Observation 6.

The following claims hold for $\gamma_{new}(C,p,c_{r})$:

1. (1)

Execution $\gamma_{new}(C,p,c_{r})$ is legal from $C$, and 2. (2)

The return value for $T_{r}$ in $\gamma_{new}(C,p,c_{r})$ is $(x_{0},x_{1},\ldots,x_{N})$.

We are now ready to construct an execution $\alpha_{1}$ (that will be a prefix of $\alpha$) in which for at least one server $q$, $q$ sends at least one message.

Lemma 0.

In any arbitrary legal execution starting from $CE_{0}$ which contains just one transaction: client $c_{w}$ executes a write-only transaction $T_{w}=(w(X_{0})x_{0},w(X_{1})x_{1},\ldots,w(X_{N})x_{N})$, it holds that for at least one server $q$ in the system, at least one of the following two happens:

• •

$q$* sends a message to a server other than $q$ (i.e., $q$ sends an explicit message to a server);*

• •

$q$* sends a message to $c_{w}$ so that after $c_{w}$ receives this message, $c_{w}$ sends a message to a server other than $q$ (i.e., $q$ sends an implicit message to a server).*

Proof.

To derive a contradiction, assume that for every server $q$ in the system, the following hold:

• •

$q$ sends no message to any other server;

• •

$q$ sends no message to $c_{w}$ so that after $c_{w}$ receives the message, $c_{w}$ sends a message to a server other than $q$.

To derive a contradiction, we will construct an execution $\gamma$, where in addition to transaction $T_{w}$, a read-only transaction $T_{r}=(r(X_{0})*,r(X_{1})*,\ldots,r(X_{N})*)$ is invoked by a client $c_{r}$ not in $\{c_{w},c_{0}^{in},$ $c_{1}^{in},\ldots,c_{N}^{in}\}$ and $T_{r}$ completes in $\gamma$. We will show that $\gamma$ contradicts Observation 3.

To construct $\gamma$, we first define an execution $\beta$ and some subsequences of it, and we study their properties. Starting from $CE_{0}$, $c_{w}$ invokes $T_{w}$ and executes solo (i.e., only $c_{w}$ and all servers take steps) until $x_{i}$ is visible for any $i\in\{0,1,\ldots,N\}$ (minimal progress for write-only transactions implies that there is a configuration in which $x_{i}$ is indeed visible for any $i\in\{0,1,\ldots,N\}$). Let $C_{v}$ be the first configuration where $x_{i}$ is visible for any $i\in\{0,1,\ldots,N\}$. Let $\beta$ be the sequence of steps which are taken from $CE_{0}$ to $C_{v}$. For any server $p$, consider execution $\gamma_{new}(C_{v},p,c_{r})$. Because in $\gamma_{new}(C_{v},p,c_{r})$, starting from $C_{v}$, only the messages sent by $c_{w}$ are delivered before $c_{r}$ takes the steps to complete $T_{r}$, thus to any server $p$, $\gamma_{new}(C_{v},p,c_{r})$ and $\gamma_{new}(C_{v},s,c_{r})$ are indistinguishable for any server $s,s\neq p$. Thus when $c_{r}$ takes the steps to complete $T_{r}$, $c_{r}$ receives the same set of responses in $\gamma_{new}(C_{v},p,c_{r})$ for any server $p$. In order to exclude empty and garbage responses, let $M$ be the smallest set of non-empty responses where each response contains a value that has been written by some write transaction. As the system is partially replicated, the size of $M$ is at least two. W.l.o.g., we fix any server $p$ which sends a response included in $M$ and thus fix execution $\gamma_{new}(C_{v},p,c_{r})$. Then, Observation 6 implies that the response for $T_{r}$ in $\gamma_{new}(C_{v},p,c_{r})$ is $(x_{0},x_{1},\ldots,x_{N})$. For simplicity, we omit $(C_{v},p,c_{r})$ from the notation in the rest of the proof of this lemma.

Recall that $\beta$ is the sequence of steps which are taken from $CE_{0}$ to $C_{v}$. Let $\beta^{\prime}_{p}$ be the shortest prefix of $\beta$ which contains all messages sent by $c_{w}$ to $p$. Let $\beta_{p}$ be the subsequence of $\beta^{\prime}_{p}$ in which all steps taken by any server $q,q\neq p$ have been removed. Let $\beta^{\prime}_{s}$ be the suffix of $\beta$ after $\beta_{p}^{\prime}$. Let $\beta_{s}$ be the subsequence of $\beta^{\prime}_{s}$ containing only steps by $p$. Let $\beta_{new}$ be $\beta_{p}\cdot\beta_{s}$. We now argue that $\beta_{new}$ is legal from $CE_{0}$. Because $\beta^{\prime}_{p}$ is a prefix of $\beta$, $\beta^{\prime}_{p}$ is legal from $CE_{0}$. By assumption, $p$ does not receive any message from any server $q,q\neq p$ in $\beta^{\prime}_{p}$. Moreover, any server $q,q\neq p$ sends no message to $c_{w}$ so that after $c_{w}$ receives the message, $q$ sends a message to $p$. By definition, $\beta^{\prime}_{p}$ ends with a message sent by $c_{w}$ to $p$ (if it is not empty). It follows that $c_{w}$ does not receive any message from $q$ in $\beta^{\prime}_{p}$. Thus, $\beta_{p}$ is legal from $CE_{0}$. Moreover, $RC(CE_{0},\beta^{\prime}_{p})$ and $RC(CE_{0},\beta_{p})$ are indistinguishable to $p$ and $c_{w}$.

We next argue that $\beta_{s}$ is legal from $RC(CE_{0},\beta_{p}^{\prime})$. We notice that in $\beta_{s}$, only $p$ takes steps. Then because $RC(CE_{0},\beta^{\prime}_{p})$ and $RC(CE_{0},\beta_{p})$ are indistinguishable to $p$, by arguing that $\beta_{s}$ is legal from $RC(CE_{0},\beta_{p}^{\prime})$, we also argue that $\beta_{s}$ is legal from $RC(CE_{0},\beta_{p})$. Below we argue that $\beta_{s}$ is indeed legal from $RC(CE_{0},\beta_{p}^{\prime})$. By assumption, any server $q,q\neq p$ does not send any message to $p$ in $\beta$, so $p$ does not receive any message from any server $q,q\neq p$ in $\beta_{s}$. By definition of $\beta_{s}^{\prime}$, $c_{w}$ does not send any message to $p$ in $\beta^{\prime}_{s}$, (because all messages from $c_{w}$ to $p$ are sent in $\beta_{p}^{\prime}$), so any message $p$ receives from $c_{w}$ in $\beta_{s}$ has been sent in $\beta_{p}^{\prime}$. Thus $\beta_{s}$ is legal from $RC(CE_{0},\beta_{p}^{\prime})$, and $\beta_{s}$ is legal from $RC(CE_{0},\beta_{p})$. Moreover, by arguing that $\beta_{s}$ is legal from $RC(CE_{0},\beta_{p}^{\prime})$, we also show that $RC(CE_{0},\beta_{p}^{\prime}\cdot\beta_{s})$ and $C_{v}=RC(CE_{0},\beta_{p}^{\prime}\cdot\beta_{s}^{\prime})$ are indistinguishable to $p$. Because $RC(CE_{0},\beta^{\prime}_{p})$ and $RC(CE_{0},\beta_{p})$ are indistinguishable to $p$, it follows that $RC(CE_{0},\beta_{new})$ and $C_{v}$ are indistinguishable to $p$.

To construct $\gamma$, we have to utilize executions $\sigma_{old}(CE_{0},p,c_{r})$ and $\sigma_{new}(C_{v},p,c_{r})$ and refer to configuration $C_{new}(C_{v},p,c_{r})$. (For simplicity, we omit $(CE_{0},p,c_{r})$ and $(C_{v},p,c_{r})$ from the notations below.) Specifically, starting from $CE_{0}$, $\sigma_{old}$ is first applied. Recall that for any server $q,q\neq p$, in its last step of $\sigma_{old}$, $q$ sends at most one message $mo_{q}^{\prime}$ to $c_{r}$. Since $CE_{0}$ and $RC(CE_{0},\sigma_{old})$ are indistinguishable to $c_{w}$ and $p$, and since only $c_{w}$ and $p$ take steps in $\beta_{new}$, $\beta_{new}$ is legal from $RC(CE_{0},\sigma_{old})$. So, to construct $\gamma$, $\beta_{new}$ is applied from $RC(CE_{0},\sigma_{old})$. The resulting configuration is $RC(CE_{0},\sigma_{old}\cdot\beta_{new})$. Since the processes which take steps in $\sigma_{old}$ and $\beta_{new}$ are disjoint, then $RC(CE_{0},\sigma_{old}\cdot\beta_{new})$ and $RC(CE_{0},\beta_{new}\cdot\sigma_{old})$ are indistinguishable. Recall that to $p$, $RC(CE_{0},\beta_{new})$ and $C_{v}$ are indistinguishable. Therefore, to $p$, $RC(CE_{0},\beta_{new}\cdot\sigma_{old})$ and $C_{new}$ are indistinguishable. Because only $p$ takes steps in $\sigma_{new}$, $\sigma_{new}$ is therefore legal from $RC(CE_{0},\beta_{new}\cdot\sigma_{old})$ and also legal from $RC(CE_{0},\sigma_{old}\cdot\beta_{new})$. We apply it from $RC(CE_{0},\sigma_{old}\cdot\beta_{new})$. Recall that in the last step of $\sigma_{new}$, $p$ sends a message $mn_{p}^{\prime}$ to $c_{r}$. Finally, $mo_{q}^{\prime}$ for any server $q,q\neq p$ (if $q$ sends a response) and $mn_{p}^{\prime}$ are delivered in $\gamma$, and next, $c_{r}$ takes steps. Since $T_{r}$ is a fast transaction, $T_{r}$ completes. This concludes the construction of $\gamma$.

In $\gamma$, $c_{r}$ executes only transaction $T_{r}$. Thus, $c_{r}$ decides the response for $T_{r}$ based solely on the values included in $mo_{q}^{\prime}$ for any server $q,q\neq p$ (if $q$ sends a response) and $mn_{p}^{\prime}$. Since $mo_{q}^{\prime}$ for any server $q,q\neq p$ is sent before $c_{w}$ takes steps, $mo_{q}^{\prime}$ contains no value in $\{x_{0},x_{1},\ldots,x_{N}\}$. Recall that $mn_{p}^{\prime}$ is sent in $\gamma_{new}$. By the one-value messages property, $mn_{p}^{\prime}$ contains only values in $\{x_{0},x_{1},\ldots,x_{N}\}$. As the system is partially replicated, $mn_{p}^{\prime}$ cannot contain all values in $\{x_{0},x_{1},\ldots,x_{N}\}$. It follows that in $\gamma$, the return value of $c_{r}$ for $T_{r}$ can be neither $(x_{0},x_{1},\ldots,x_{N})$ nor $(x_{0}^{in},x_{1}^{in},\ldots,x_{N}^{in})$. This contradicts Observation 3. ∎

By Lemma 4, we have that for at least one server $q$ in the system, at least one of the following two happens in any arbitrary legal execution starting from $CE_{0}$ which contains just one transaction $T_{w}=(w(X_{0})x_{0},w(X_{1})x_{1},\ldots,w(X_{N})x_{N})$ executed by $c_{w}$: (1) $q$ sends a message to a server other than $q$; (2) $q$ sends a message to $c_{w}$ so that: after $c_{w}$ receives this message, $c_{w}$ sends a message to a server other than $q$. Let $m_{1}$ be the first message that satisfies any of the two claims above.

We are now ready to construct execution $\alpha_{1}$. In $\alpha_{1}$, $T_{w}$ executes solo starting from $CE_{0}$ until $m_{1}$ is sent. We denote by $C_{1}$ the configuration that results when $\alpha_{1}$ is applied from $CE_{0}$.

Lemma 0.

At $C_{1}$, $x_{0},x_{1},\ldots,x_{N}$ are not visible.

Proof.

Assume that at $C_{1}$, $x_{i}$ is visible for some $i\in\{0,1,2,\ldots,N\}$. To derive a contradiction, we will construct an execution $\gamma$ where in addition to $T_{w}$, a read-only transaction $T_{r}=(r(X_{0})*,r(X_{1})*,\ldots,$ $r(X_{N})*)$ is invoked by a client $c_{r}\not\in\{c_{w},c_{0}^{in},c_{1}^{in},\ldots,c_{N}^{in}\}$, and $c_{r}$ returns from $T_{r}$. We will show that $\gamma$ contradicts Observation 3.

We fix the server $p$ in a similar way as in the proof of Lemma 4 given execution $\gamma_{new}(C_{1},s,c_{r})$ for every server $s$. Then we construct $\gamma$ by utilizing $\gamma_{old}(CE_{0},p,c_{r})$ and $\gamma_{new}(C_{1},p,c_{r})$. By Observation 5, $c_{r}$ returns $(x_{0}^{in},x_{1}^{in},\ldots,x_{N}^{in})$ for $T_{r}$ in $\gamma_{old}(CE_{0},p,c_{r})$. Because by assumption, $x_{i}$ is visible at $C_{1}$, Observation 6 implies that $c_{r}$ returns $(x_{0},x_{1},\ldots,x_{N})$ for $T_{r}$ in $\gamma_{new}(C_{1},p,c_{r})$.

To construct $\gamma$, we first define an execution $\beta$ and some subsequences of it, and we study their properties. Let $\beta$ be the sequence of steps which are taken from $CE_{0}$ to $C_{1}$. Let $\beta^{\prime}_{p}$ be the shortest prefix of $\beta$ which contains all messages sent by $c_{w}$ to $p$. Let $\beta_{p}$ be the subsequence of $\beta^{\prime}_{p}$ in which all steps taken by any server $q,q\neq p$ have been removed. Let $\beta^{\prime}_{s}$ be the suffix of $\beta$ after $\beta_{p}^{\prime}$. Let $\beta_{s}$ be the subsequence of $\beta^{\prime}_{s}$ containing only steps by $p$. Let $\beta_{new}$ be $\beta_{p}\cdot\beta_{s}$. We now argue that $\beta_{new}$ is legal from $CE_{0}$. Because $\beta^{\prime}_{p}$ is a prefix of $\beta$, $\beta^{\prime}_{p}$ is legal from $CE_{0}$. By the definition of $\alpha_{1}$, $p$ does not receive any message from any server $q,q\neq p$ in $\beta^{\prime}_{p}$. Moreover, because $m_{1}$ is the first message sent by some server (implicitly or explicitly), $c_{w}$ receives no message from any server $q,q\neq p$ such that after the receipt of this message, $c_{w}$ sends a message to $p$. By definition, $\beta^{\prime}_{p}$ ends with a message sent by $c_{w}$ to $p$ (if it is not empty). It follows that $c_{w}$ does not receive any message from any server $q,q\neq p$ in $\beta^{\prime}_{p}$. Thus, $\beta_{p}$ is legal from $CE_{0}$. Moreover, $RC(CE_{0},\beta^{\prime}_{p})$ and $RC(CE_{0},\beta_{p})$ are indistinguishable to $p$ and $c_{w}$.

We next argue that $\beta_{s}$ is legal from $RC(CE_{0},\beta_{p}^{\prime})$. We notice that in $\beta_{s}$, only $p$ takes steps. Then because $RC(CE_{0},\beta^{\prime}_{p})$ and $RC(CE_{0},\beta_{p})$ are indistinguishable to $p$, by arguing that $\beta_{s}$ is legal from $RC(CE_{0},\beta_{p}^{\prime})$, we also argue that $\beta_{s}$ is legal from $RC(CE_{0},\beta_{p})$. Below we argue that $\beta_{s}$ is indeed legal from $RC(CE_{0},\beta_{p}^{\prime})$. By the definition of $\alpha_{1}$, $p$ does not receive any message from any server $q,q\neq p$ in $\beta$. By definition of $\beta_{s}^{\prime}$, $c_{w}$ does not send any message to $p$ in $\beta^{\prime}_{s}$, (because all messages from $c_{w}$ to $p$ are sent in $\beta_{p}^{\prime}$), so any message $p$ receives from $c_{w}$ in $\beta_{s}$ has been sent in $\beta_{p}^{\prime}$. Thus $\beta_{s}$ is legal from $RC(CE_{0},\beta_{p}^{\prime})$, and $\beta_{s}$ is legal from $RC(CE_{0},\beta_{p})$. Moreover, by arguing that $\beta_{s}$ is legal from $RC(CE_{0},\beta_{p}^{\prime})$, we also show that $RC(CE_{0},\beta_{p}^{\prime}\cdot\beta_{s})$ and $C_{1}=RC(CE_{0},\beta_{p}^{\prime}\cdot\beta_{s}^{\prime})$ are indistinguishable to $p$. Because $RC(CE_{0},\beta^{\prime}_{p})$ and $RC(CE_{0},\beta_{p})$ are indistinguishable to $p$, it follows that $RC(CE_{0},\beta_{new})$ and $C_{1}$ are indistinguishable to $p$.

Now we are ready to construct $\gamma$ using executions $\sigma_{old}(CE_{0},p,c_{r})$, $\sigma_{new}(C_{1},p,c_{r})$ and $\beta_{new}$ and referring to configuration $C_{new}(C_{1},p,$ $c_{r})$. (For simplicity, we omit $(CE_{0},p,c_{r})$ and $(C_{1},p,c_{r})$ from the notations below.) Starting from $CE_{0}$, $\sigma_{old}$ is first applied. Recall that for any server $q,q\neq p$, in its last step of $\sigma_{old}$, $q$ sends at most one message $mo_{q}^{\prime}$ to $c_{r}$. Since $CE_{0}$ and $RC(CE_{0},\sigma_{old})$ are indistinguishable to $c_{w}$ and $p$, and since only $c_{w}$ and $p$ take steps in $\beta_{new}$, $\beta_{new}$ is legal from $RC(CE_{0},\sigma_{old})$. The resulting configuration is $RC(CE_{0},\sigma_{old}\cdot\beta_{new})$. Since the processes which take steps in $\sigma_{old}$ and $\beta_{new}$ are disjoint, then $RC(CE_{0},\sigma_{old}\cdot\beta_{new})$ and $RC(CE_{0},\beta_{new}\cdot\sigma_{old})$ are indistinguishable. Recall that to $p$, $RC(CE_{0},\beta_{new})$ and $C_{1}$ are indistinguishable. Therefore, to $p$, $RC(C_{0},\beta_{new}\cdot\sigma_{old})$ and $C_{new}$ are indistinguishable. Because only $p$ takes steps in $\sigma_{new}$, $\sigma_{new}$ is therefore legal from $RC(CE_{0},\beta_{new}\cdot\sigma_{old})$ and also legal from $RC(CE_{0},\sigma_{old}\cdot\beta_{new})$. We apply it from $RC(CE_{0},\sigma_{old}\cdot\beta_{new})$. Recall that in the last step of $\sigma_{new}$, $p$ sends message $mn_{p}^{\prime}$ to $c_{r}$. Finally, $mo_{q}^{\prime}$ for any server $q,q\neq p$ (if $q$ sends a response) and $mn_{p}^{\prime}$ are delivered in $\gamma$, and next, $c_{r}$ takes steps. Since $T_{r}$ is a fast transaction, $T_{r}$ completes. This concludes the construction of $\gamma$.

In $\gamma$, $c_{r}$ executes only transaction $T_{r}$. Thus, $c_{r}$ decides the response for $T_{r}$ based solely on the values included in $mo_{q}^{\prime}$ for any server $q,q\neq p$ and $mn_{p}^{\prime}$. Since $mo_{q}^{\prime}$ for any server $q,q\neq p$ is sent before $c_{w}$ takes steps, $mo_{q}^{\prime}$ contains no value in $\{x_{0},x_{1},\ldots,x_{N}\}$. Recall that $mn_{p}^{\prime}$ is sent in $\gamma_{new}$. By the one-value messages property, $mn_{p}^{\prime}$ contains only values in $\{x_{0},x_{1},\ldots,x_{N}\}$. As the system is partially replicated, $mn_{p}^{\prime}$ cannot contain all values in $\{x_{0},x_{1},\ldots,x_{N}\}$. It follows that in $\gamma$, the return value of $c_{r}$ for $T_{r}$ can be neither $(x_{0},x_{1},\ldots,x_{N})$ nor $(x_{0}^{in},x_{1}^{in},\ldots,x_{N}^{in})$. This contradicts Observation 3. ∎

A.2. The Infinite Execution

We now continue to prove that $\alpha$ is infinite. We do so by proving that there is an infinite sequence of executions $\alpha_{1},\alpha_{2},\ldots$ such that, all of them are distinct prefixes of $\alpha$. Let $\alpha_{0}$ be an empty execution.

Lemma 0.

For any integer $k\geq 1$, there exists an execution $\alpha_{k}$, legal from $CE_{0}$, in which only one transaction $T_{w}=(w(X_{0})x_{0},w(X_{1})x_{1},\ldots,$ $w(X_{N})x_{N})$ is executed by client $c_{w}$. Let $C_{k}$ be the configuration that results when $\alpha_{k}$ is applied from $CE_{0}$. Then, the following hold:

1. (1)

$\alpha_{k}=\alpha_{k-1}\cdot\alpha_{k}^{\prime}$, where in $\alpha_{k}^{\prime}$, for at least one server $q$ in the system, at least one of the following occurs:

• •

a message is sent by $q$ to a server other than $q$, or

• •

a message is sent by $q$ to $c_{w}$ so that after $c_{w}$ receives this message, $c_{w}$ sends a message to a server other than $q$. 2. (2)

In $C_{k}$, $x_{0},x_{1},\ldots,x_{N}$ are not visible.

Proof of Lemma 6.

By induction on $k$. For the base case ($k=1$), let $\alpha_{0}$ be the empty execution and $\alpha_{1}^{\prime}=\alpha_{1}$. Then, Lemma 4 implies that claim 1 holds. Moreover, Lemma 5 implies that claim 2 holds.

For the induction hypothesis, fix any integer $k\geq 2$ and assume that the claim holds for any integer $j$, $1\leq j\leq k-1$. We prove that the claim holds for $k$.

The proof of claim 1 follows similar arguments as those in the proof of Lemma 4. We assume that the claim does not hold. We construct an execution $\gamma$ and show that $\gamma$ contradicts Observation 3. By the induction hypothesis (claim 2), $x_{0},x_{1},\ldots,x_{N}$ are not visible in $C_{k-1}$. By Observation 4, there exists some client $c_{r}^{k}$ not in $\{c_{w},c_{0}^{in},c_{1}^{in},\ldots,c_{N}^{in}\}$ such that if, starting from $C_{k-1}$, $c_{r}^{k}$ invokes $T_{r}=(r(X_{0})*,r(X_{1})*,\ldots,r(X_{N})*)$, then $c_{r}^{k}$ returns $(x_{0}^{in},x_{1}^{in},\ldots,x_{N}^{in})$. The construction of $\gamma$ utilizes execution $\sigma_{old}($ $C_{k-1},p,c_{r}^{k})$ in a way similar that $\sigma_{old}(C_{0},p,c_{r})$ has been utilized in the construction of $\gamma$ in Lemma 4. Starting from $C_{k-1}$, $c_{w}$ and all servers take steps until $x_{0},x_{1},\ldots,x_{N}$ are visible. We then define configuration $C_{v}$, and executions $\beta$ and $\beta_{new}$ in a way similar to that defined in the proof of Lemma 4 (but with $C_{k-1}$ playing the role of $CE_{0}$). We finally define $\gamma$ based on $\sigma_{old}(C_{k-1},p,c_{r}^{k})$, $\sigma_{new}(C_{v},p,c_{r}^{k})$ and $\beta_{new}$, and we argue that in $\gamma$, $c_{r}^{k}$ returns a response for $T_{r}$ that contradicts Observation 3.

We continue with the details of the proof. To derive a contradiction, assume that we let $c_{w}$ and all servers take steps starting from $C_{k-1}$ and the following holds: for every server $q$,

• •

$q$ sends no message to a server other than $q$;

• •

$q$ sends no message to $c_{w}$ so that after $c_{w}$ receives the message, $c_{w}$ sends a message to a server other than $q$.

In other words, $\alpha_{k}^{\prime}$ cannot be defined.

To derive a contradiction, we will construct an execution $\gamma$ where in addition to $T_{w}$, a read-only transaction $T_{r}=(r(X_{0})*,r(X_{1})*,\ldots,$ $r(X_{N})*)$ is invoked by a client $c_{r}^{k}$ not in $\{c_{w},c_{0}^{in},c_{1}^{in},\ldots,c_{N}^{in}\}$ and $c_{r}^{k}$ returns from $T_{r}$. We will show that $\gamma$ contradicts Observation 3.

To construct $\gamma$, we first define an execution $\beta$ and some subsequences of it, and we study their properties. Starting from $C_{k-1}$, $c_{w}$ invokes $T_{w}$ and executes solo (i.e., only $c_{w}$ and servers take steps) until $x_{0},x_{1},\ldots,x_{N}$ are visible (minimal progress for write-only transactions implies that there is a configuration in which $x_{0},x_{1},\ldots,x_{N}$ are indeed visible). Let $C_{v}$ be the first configuration where $x_{0},x_{1},\ldots,x_{N}$ are visible. Let $\beta$ be the sequence of steps which are taken from $C_{k-1}$ to $C_{v}$. For any server $p$, consider execution $\gamma_{new}(C_{v},p,c_{r}^{k})$. Because in $\gamma_{new}(C_{v},p,c_{r}^{k})$, starting from $C_{v}$, only the messages sent by $c_{w}$ are delivered before $c_{r}^{k}$ takes the steps to complete $T_{r}$, thus to any server $p$, $\gamma_{new}(C_{v},p,c_{r}^{k})$ and $\gamma_{new}(C_{v},s,c_{r}^{k})$ for any server $s,s\neq p$ are indistinguishable. Thus when $c_{r}^{k}$ takes the steps to complete $T_{r}$, $c_{r}^{k}$ receives the same set of responses in $\gamma_{new}(C_{v},p,c_{r}^{k})$ for any server $p$. In order to exclude empty and garbage responses, let $M$ be the smallest set of non-empty responses where each response contains a value that has been written by some write transaction. As the system is partially replicated, the size of $M$ is at least two. W.l.o.g., we fix any server $p$ which sends a response included in $M$ and thus fix execution $\gamma_{new}(C_{v},p,c_{r}^{k})$. Then, Observation 6 implies that the response for $T_{r}$ in $\gamma_{new}(C_{v},p,c_{r}^{k})$ is $(x_{0},x_{1},\ldots,x_{N})$. For simplicity, we omit $(C_{v},p,c_{r}^{k})$ from the notation in the rest of the proof of this lemma.

Let $\beta^{\prime}_{p}$ be the shortest prefix of $\beta$ which contains all messages sent by $c_{w}$ to $p$. Let $\beta_{p}$ be the subsequence of $\beta^{\prime}_{p}$ in which all steps taken by any server $q,q\neq p$ have been removed. Let $\beta^{\prime}_{s}$ be the suffix of $\beta$ after $\beta_{p}^{\prime}$. Let $\beta_{s}$ be the subsequence of $\beta^{\prime}_{s}$ containing only steps by $p$. Let $\beta_{new}$ be $\beta_{p}\cdot\beta_{s}$. We now argue that $\beta_{new}$ is legal from $C_{k-1}$. Because $\beta^{\prime}_{p}$ is a prefix of $\beta$, $\beta^{\prime}_{p}$ is legal from $C_{k-1}$. By assumption, if $p$ receives any message from any server $q,q\neq p$ in $\beta^{\prime}_{p}$, the message has been sent in $\alpha_{k-1}$, i.e., before the prefix $\beta^{\prime}_{p}$. Moreover, by assumption, after $\alpha_{k-1}$, any server $q,q\neq p$ sends no message to $c_{w}$ so that after $c_{w}$ receives the message, $c_{w}$ sends a message to $p$. By definition, $\beta^{\prime}_{p}$ ends with a message sent by $c_{w}$ to $p$ (if $\beta^{\prime}_{p}$ is not empty). It follows that if $c_{w}$ receives any message from any server $q,q\neq p$ in $\beta^{\prime}_{p}$, then the message has been sent in $\alpha_{k-1}$, i.e., before the prefix $\beta^{\prime}_{p}$. Thus, $\beta_{p}$ is legal from $C_{k-1}$. Moreover, $RC(C_{k-1},\beta^{\prime}_{p})$ and $RC(C_{k-1},\beta_{p})$ are indistinguishable to $p$ and $c_{w}$.

We next argue that $\beta_{s}$ is legal from $RC(C_{k-1},\beta_{p}^{\prime})$. We notice that in $\beta_{s}$, only $p$ takes steps. Then because $RC(C_{k-1},\beta^{\prime}_{p})$ and $RC(C_{k-1},\beta_{p})$ are indistinguishable to $p$, by arguing that $\beta_{s}$ is legal from $RC(C_{k-1},\beta_{p}^{\prime})$, we also argue that $\beta_{s}$ is legal from $RC(C_{k-1},\beta_{p})$. Below we argue that $\beta_{s}$ is indeed legal from $RC(C_{k-1},\beta_{p}^{\prime})$. By assumption, if $p$ receives any message from any server $q,q\neq p$ in $\beta_{s}$, then the message has been sent in $\alpha_{k-1}$, i.e., before $\beta$. By definition of $\beta_{s}^{\prime}$, $c_{w}$ does not send any message to $p$ in $\beta^{\prime}_{s}$, (because all messages from $c_{w}$ to $p$ are sent in or before $\beta_{p}^{\prime}$), so any message $p$ receives from $c_{w}$ in $\beta_{s}$ has been sent in or before $\beta_{p}^{\prime}$. Thus $\beta_{s}$ is legal from $RC(C_{k-1},\beta_{p}^{\prime})$, and $\beta_{s}$ is legal from $RC(C_{k-1},\beta_{p})$. Moreover, by arguing that $\beta_{s}$ is legal from $RC(C_{k-1},\beta_{p}^{\prime})$, we also show that $RC(C_{k-1},\beta_{p}^{\prime}\cdot\beta_{s})$ and $C_{v}=RC(C_{k-1},\beta_{p}^{\prime}\cdot\beta_{s}^{\prime})$ are indistinguishable to $p$. Because $RC(C_{k-1},\beta^{\prime}_{p})$ and $RC(C_{k-1},\beta_{p})$ are indistinguishable to $p$, it follows that $RC(C_{k-1},\beta_{new})$ and $C_{v}$ are indistinguishable to $p$.

To construct $\gamma$, we have to utilize executions $\sigma_{old}(C_{k-1},p,c_{r}^{k})$ and $\sigma_{new}(C_{v},p,c_{r}^{k})$and refer to configuration $C_{new}(C_{v},p,c_{r}^{k})$. (For simplicity, we omit $(C_{k-1},p,c_{r}^{k})$ and $(C_{v},p,c_{r}^{k})$ from the notations below.) Specifically, starting from $C_{k-1}$, $\sigma_{old}$ is first applied. Recall that for any server $q,q\neq p$, in its last step of $\sigma_{old}$, $q$ sends at most one message $mo_{q}^{\prime}$ to $c_{r}^{k}$. Since $C_{k-1}$ and $RC(C_{k-1},\sigma_{old})$ are indistinguishable to $c_{w}$ and $p$, and since only $c_{w}$ and $p$ take steps in $\beta_{new}$, $\beta_{new}$ is legal from $RC(C_{k-1},\sigma_{old})$. So, to construct $\gamma$, $\beta_{new}$ is applied from $RC(C_{k-1},\sigma_{old})$. The resulting configuration is $RC(C_{k-1},\sigma_{old}\cdot\beta_{new})$. Since the processes which take steps in $\sigma_{old}$ and $\beta_{new}$ are disjoint, then $RC(C_{k-1},\sigma_{old}\cdot\beta_{new})$ and $RC(C_{k-1},\beta_{new}\cdot\sigma_{old})$ are indistinguishable. Recall that to $p$, $RC(C_{k-1},\beta_{new})$ and $C_{v}$ are indistinguishable. Therefore, to $p$, $RC(C_{k-1},\beta_{new}\cdot\sigma_{old})$ and $C_{new}$ are indistinguishable. Because only $p$ takes steps in $\sigma_{new}$, $\sigma_{new}$ is therefore legal from $RC(C_{k-1},\beta_{new}\cdot\sigma_{old})$ and also legal from $RC(C_{k-1},\sigma_{old}\cdot\beta_{new})$. We apply it from $RC(C_{k-1},\sigma_{old}\cdot\beta_{new})$. Recall that in the last step of $\sigma_{new}$, $p$ sends a message $mn_{p}^{\prime}$ to $c_{r}^{k}$. Finally, $mo_{q}^{\prime}$ for any server $q,q\neq p$ (if $q$ sends a response) and $mn_{p}^{\prime}$ are delivered in $\gamma$, and next, $c_{r}^{k}$ takes steps. Since $T_{r}$ is a fast transaction, $T_{r}$ completes. This concludes the construction of $\gamma$.

In $\gamma$, $c_{r}^{k}$ executes only transaction $T_{r}$. Thus, $c_{r}^{k}$ decides the response for $T_{r}$ based solely on the values included in $mo_{q}^{\prime}$ for any server $q,q\neq p$ and $mn_{p}^{\prime}$. Since $mo_{q}^{\prime}$ for any server $q,q\neq p$ is sent in $\gamma_{old}(C_{k-1},p,c_{r}^{k})$, by Observation 5 and the one-value messages property, $mo_{q}^{\prime}$ for any server $q,q\neq p$ contains no value in $\{x_{0},x_{1},\ldots,x_{N}\}$. Recall that $mn_{p}^{\prime}$ is sent in $\gamma_{new}$. By Observation 6 and the one-value messages property, $mn_{p}^{\prime}$ contains values in $\{x_{0},x_{1},\ldots,x_{N}\}$. It follows that in $\gamma$, the return value of $c_{r}^{k}$ for $T_{r}$ can be neither $(x_{0}^{in},x_{1}^{in},\ldots,x_{N}^{in})$ nor $(x_{0},x_{1},\ldots,x_{N})$. This contradicts Observation 3.

To prove claim 2, we use similar arguments as those in the proof of Lemma 5 with configuration $C_{k-1}$ playing the role of $CE_{0}$ and configuration $C_{k}$ playing the role of $C_{1}$. We assume that the claim does not hold. We construct an execution $\delta$ and show that $\delta$ contradicts Observation 3. The construction of $\delta$ utilizes the same execution $\sigma_{old}(C_{k-1},p,c_{r}^{k})$ as in the proof of claim 1. Starting from $C_{k-1}$, $c_{w}$ and all servers take steps as defined in $\alpha_{k}^{\prime}$. We then define executions $\rho$ and $\rho_{new}$ in a way similar to $\beta$ and $\beta_{new}$ defined in the proof of Lemma 5 (but with $C_{k-1}$ playing the role of $CE_{0}$ and $C_{k}$ playing the role of $C_{1}$). We finally define $\delta$ based on $\sigma_{old}(C_{k-1},p,c_{r}^{k})$, $\sigma_{new}(C_{k},p,c_{r}^{k})$ and $\rho_{new}$, and we argue that in $\delta$, $c_{r}^{k}$ returns a response for $T_{r}$ that contradicts Observation 3.

We now present the details of the proof. Assume that in $C_{k}$, $x_{i}$ is visible for some $i\in\{0,1,\ldots,N\}$. We will derive a contradiction by constructing an execution $\delta$ where in addition to $T_{w}$, a read-only transaction $T_{r}=(r(X_{0})*,r(X_{1})*,\ldots,r(X_{N})*$ is invoked by a client $c_{r}^{k}$ not in $\{c_{w},c_{0}^{in},c_{1}^{in},\ldots,c_{N}^{in}\}$ and $c_{r}^{k}$ returns from $T_{r}$. We will show that $\delta$ contradicts Observation 3.

We construct $\delta$ by utilizing $\gamma_{old}(C_{k-1},p,c_{r}^{k})$ and $\gamma_{new}(C_{k},p,c_{r}^{k})$. By Observation 5, $c_{r}^{k}$ returns $(x_{0}^{in},x_{1}^{in},\ldots,x_{N}^{in})$ for $T_{r}$ in $\gamma_{old}(C_{k-1},$ $p,c_{r}^{k})$. Because by assumption, $x_{i}$ is visible at $C_{k}$, Observation 6 implies that $c_{r}^{k}$ returns $(x_{0},x_{1},\ldots,x_{N})$ for $T_{r}$ in $\gamma_{new}(C_{k},p_{k\%2},c_{r}^{k})$.

To construct $\delta$, we first define an execution $\rho$ and some subsequences of it, and we study their properties. Let $\rho$ be the sequence of steps which are taken from $C_{k-1}$ to $C_{k}$. Let $\rho^{\prime}_{p}$ be the shortest prefix of $\rho$ which contains all messages sent by $c_{w}$ to $p$. Let $\rho_{p}$ be the subsequence of $\rho^{\prime}_{p}$ in which all steps taken by any server $q,q\neq p$ have been removed. Let $\rho^{\prime}_{s}$ be the suffix of $\rho$ after $\rho_{p}^{\prime}$. Let $\rho_{s}$ be the subsequence of $\rho^{\prime}_{s}$ containing only steps by $p$. Let $\rho_{new}$ be $\rho_{p}\cdot\rho_{s}$. We now argue that $\rho_{new}$ is legal from $C_{k-1}$. Because $\rho^{\prime}_{p}$ is a prefix of $\rho$, $\rho^{\prime}_{p}$ is legal from $C_{k-1}$. By the definition of $\alpha_{k}$, if $p$ receives any message from any server $q,q\neq p$ in $\beta^{\prime}_{p}$, the message has been sent in $\alpha_{k-1}$, i.e., before the prefix $\beta^{\prime}_{p}$. Moreover, because $\alpha_{k}^{\prime}$ ends with the first message sent by some server to another server (implicitly or explicitly), $c_{w}$ receives no message from any server $q,q\neq p$ such that after the receipt of this message, $c_{w}$ sends a message to $p$. By definition, $\rho^{\prime}_{p}$ ends with a message sent by $c_{w}$ to $p$ (if $\rho^{\prime}_{p}$ is not empty). It follows that if $c_{w}$ receives any message from any server $q,q\neq p$ in $\rho^{\prime}_{p}$, then the message has been sent in $\alpha_{k-1}$, i.e., before the prefix $\rho^{\prime}_{p}$. Thus, $\rho_{p}$ is legal from $C_{k-1}$. Moreover, $RC(C_{k-1},\rho^{\prime}_{p})$ and $RC(C_{k-1},\rho_{p})$ are indistinguishable to $p$ and $c_{w}$.

We next argue that $\rho_{s}$ is legal from $RC(C_{k-1},\rho_{p}^{\prime})$. We notice that in $\rho_{s}$, only $p$ takes steps. Then because $RC(C_{k-1},\rho^{\prime}_{p})$ and $RC(C_{k-1},\rho_{p})$ are indistinguishable to $p$, by arguing that $\rho_{s}$ is legal from $RC(C_{k-1},\rho_{p}^{\prime})$, we also argue that $\rho_{s}$ is legal from $RC(C_{k-1},\rho_{p})$. Below we argue that $\rho_{s}$ is indeed legal from $RC(C_{k-1},\rho_{p}^{\prime})$. By the definition of $\alpha_{k}$, if $p$ receives any message from any server $q,q\neq p$ in $\rho_{s}$, then the message has been sent in $\alpha_{k-1}$, i.e., before $\rho$. By definition of $\rho_{s}^{\prime}$, $c_{w}$ does not send any message to $p$ in $\rho^{\prime}_{s}$, (because all messages from $c_{w}$ to $p$ are sent in or before $\rho_{p}^{\prime}$), so any message $p$ receives from $c_{w}$ in $\rho_{s}$ has been sent in or before $\rho_{p}^{\prime}$. Thus $\rho_{s}$ is legal from $RC(C_{k-1},\rho_{p}^{\prime})$, and $\rho_{s}$ is legal from $RC(C_{k-1},\rho_{p})$. Moreover, by arguing that $\rho_{s}$ is legal from $RC(C_{k-1},\rho_{p}^{\prime})$, we also show that $RC(C_{k-1},\rho_{p}^{\prime}\cdot\rho_{s})$ and $C_{k}=RC(C_{k-1},\rho_{p}^{\prime}\cdot\rho_{s}^{\prime})$ are indistinguishable to $p$. Because $RC(C_{k-1},\rho^{\prime}_{p})$ and $RC(C_{k-1},\rho_{p})$ are indistinguishable to $p$, it follows that $RC(C_{k-1},\rho_{new})$ and $C_{k}$ are indistinguishable to $p$.

Now we are ready to construct $\delta$ using executions $\sigma_{old}(C_{k-1},p,c_{r}^{k})$, $\sigma_{new}(C_{k},p,c_{r}^{k})$ and $\rho_{new}$, referring to configuration $C_{new}(C_{k},p,c_{r}^{k})$. (For simplicity, we omit $(C_{k-1},p,c_{r}^{k})$ and $(C_{k},p,c_{r}^{k})$ from the notations below, which abuses $\sigma_{new}$ and $C_{new}$.) Starting from $C_{k-1}$, $\sigma_{old}$ is first applied. Recall that in its last step of $\sigma_{old}$, any server $q,q\neq p$ sends at most one message $mo_{q}^{\prime}$ to $c_{r}^{k}$. Since $C_{k-1}$ and $RC(C_{k-1},\sigma_{old})$ are indistinguishable to $c_{w}$ and $p$, and since only $c_{w}$ and $p$ take steps in $\rho_{new}$, $\rho_{new}$ is legal from $RC(C_{k-1},\sigma_{old})$. The resulting configuration is $RC(C_{k-1},\sigma_{old}\cdot\rho_{new})$. Since the processes which take steps in $\sigma_{old}$ and $\rho_{new}$ are disjoint, then $RC(C_{k-1},\sigma_{old}\cdot\rho_{new})$ and $RC(C_{k-1},\rho_{new}\cdot\sigma_{old})$ are indistinguishable. Recall that to $p$, $RC(C_{k-1},\rho_{new})$ and $C_{k}$ are indistinguishable. Therefore, to $p$, $RC(C_{k-1},\rho_{new}\cdot\sigma_{old})$ and $C_{new}$ are indistinguishable. Because only $p$ takes steps in $\sigma_{new}$, $\sigma_{new}$ is therefore legal from $RC(C_{k-1},\rho_{new}\cdot\sigma_{old})$ and also legal from $RC(C_{k-1},\sigma_{old}\cdot\rho_{new})$. We apply it from $RC(C_{k-1},\sigma_{old}\cdot\rho_{new})$. Recall that in the last step of $\sigma_{new}$, $p$ sends message $mn_{p}^{\prime}$ to $c_{r}^{k}$. Finally, $mo_{q}^{\prime}$ for any server $q,q\neq p$ (if $q$ sends a response) and $mn_{p}^{\prime}$ are delivered in $\delta$, and next, $c_{r}^{k}$ takes steps. Since $T_{r}$ is a fast transaction, $T_{r}$ completes. This concludes the construction of $\delta$.

In $\delta$, $c_{r}^{k}$ executes only transaction $T_{r}$. Thus, $c_{r}^{k}$ decides the response for $T_{r}$ based solely on the values included in $mo_{q}^{\prime}$ for any server $q,q\neq p$ and $mn_{p}^{\prime}$. Since $mo_{q}^{\prime}$ for any server $q,q\neq p$ is sent in $\gamma_{old}(C_{k-1},p,c_{r}^{k})$, by Observation 5 and the one-value messages property, $mo_{q}^{\prime}$ for any server $q,q\neq p$ contains no value in $\{x_{0},x_{1},\ldots,x_{N}\}$. Recall that $mn_{p}^{\prime}$ is sent in $\delta_{new}$. By Observation 6 and the one-value messages property, $mn_{p}^{\prime}$ contains only values in $\{x_{0},x_{1},\ldots,x_{N}\}$. It follows that in $\delta$, the return value of $c_{r}^{k}$ for $T_{r}$ can be neither $(x_{0}^{in},x_{1}^{in},\ldots,x_{N}^{in})$ nor $(x_{0},x_{1},\ldots,x_{N})$. This contradicts Observation 3. It follows that claim 2 is true for $k$. ∎