Robustness Against Transactional Causal Consistency

TL;DR

This paper investigates whether transactional programs remain serializable under various causal consistency models in distributed databases, providing a polynomial-time verification method and insights into program robustness.

Contribution

It introduces a polynomial-time reduction of robustness verification to state reachability, enabling the use of existing tools for causal consistency analysis.

Findings

Programs without write-write races have identical behaviors across causal consistency variations.

Robustness checking reduces to a state reachability problem in transactional programs.

Robustness verification is decidable for finite-state programs.

Abstract

Distributed storage systems and databases are widely used by various types of applications. Transactional access to these storage systems is an important abstraction allowing application programmers to consider blocks of actions (i.e., transactions) as executing atomically. For performance reasons, the consistency models implemented by modern databases are weaker than the standard serializability model, which corresponds to the atomicity abstraction of transactions executing over a sequentially consistent memory. Causal consistency for instance is one such model that is widely used in practice. In this paper, we investigate application-specific relationships between several variations of causal consistency and we address the issue of verifying automatically if a given transactional program is robust against causal consistency, i.e., all its behaviors when executed over an arbitrary causally consistent database are serializable. We show that programs without write-write races have the same set of behaviors under all these variations, and we show that checking robustness is polynomial time reducible to a state reachability problem in transactional programs over a sequentially consistent shared memory. A surprising corollary of the latter result is that causal consistency variations which admit incomparable sets of behaviors admit comparable sets of robust programs. This reduction also opens the door to leveraging existing methods and tools for the verification of concurrent programs (assuming sequential consistency) for reasoning about programs running over causally consistent databases. Furthermore, it allows to establish that the problem of checking robustness is decidable when the programs executed at different sites are finite-state.

Equations

$$\displaystyle\mathbb{E}\mathsf{v}=\$$

$$\begin{array}[]{c}\scriptsize\dfrac{\text{$\text{$\mathtt{begin}$}\in{\mathsf{inst}}(\mathsf{ls}({p}).\mathsf{pc})$\quad$s=\mathsf{ls}({p})[\mathsf{log}\mapsto\epsilon,\mathsf{pc}\mapsto\mathsf{next}(\mathsf{pc})]$}}{\text{$(\mathsf{ls},\mathsf{msgs})\xrightarrow{\text{\tiny$\mathsf{begin}({p},{t})$}}(\mathsf{ls}[{p}\mapsto s],\mathsf{msgs})$}}\\[16.00003pt] \scriptsize\dfrac{\text{$r:=x\in{\mathsf{inst}}(\mathsf{ls}({p}).\mathsf{pc})$\quad$\mathit{eval}(\mathsf{ls}({p}),x)=v$ \quad$\mathit{rval}=\mathsf{ls}({p}).\mathsf{rval}[r\mapsto v]$\quad$s=\mathsf{ls}({p})[\mathsf{rval}\mapsto\mathit{rval},\mathsf{pc}\mapsto\mathsf{next}(\mathsf{pc})]$}}{\text{$(\mathsf{ls},\mathsf{msgs})\xrightarrow{\text{\tiny$\mathsf{ld}({p},{t},x,v)$}}(\mathsf{ls}[{p}\mapsto s],\mathsf{msgs})$}}\\[22.76219pt] \scriptsize\dfrac{\text{$x:=v\in{\mathsf{inst}}(\mathsf{ls}({p}).\mathsf{pc})$\quad$\mathit{log}=(\mathsf{ls}({p}).\mathsf{log})\cdot(x,v)$\quad$s=\mathsf{ls}({p})[\mathsf{log}\mapsto\mathit{log},\mathsf{pc}\mapsto\mathsf{next}(\mathsf{pc})]$}}{\text{$(\mathsf{ls},\mathsf{msgs})\xrightarrow{\text{\tiny$\mathsf{isu}({p},{t},x,v)$}}(\mathsf{ls}[{p}\mapsto s],\mathsf{msgs})$}}\\[16.00003pt] \scriptsize\dfrac{\text{$\text{$\mathtt{end}$}\in{\mathsf{inst}}(\mathsf{ls}({p}).\mathsf{pc})$\quad$s=\mathsf{ls}({p})[\mathsf{pc}\mapsto\mathsf{next}(\mathsf{pc})]$}}{\text{$(\mathsf{ls},\mathsf{msgs})\xrightarrow{\text{\tiny$\mathsf{end}({p},{t})$}}(\mathsf{ls}[{p}\mapsto s],\mathsf{msgs}\cup\{({t},\mathsf{ls}(p).\mathsf{log})\})$}}\\[22.76219pt] \scriptsize\dfrac{\text{$\left\langle t,\mathit{log}\right\rangle\in\mathsf{msgs}$\quad$\mathit{store}=\mathsf{ls}({p}).\mathsf{store}[x\mapsto\mathit{last}(\mathit{log},x):x\in\mathbb{V},\mathit{last}(\mathit{log},x)\neq\bot]$ \quad$s=\mathsf{ls}({p})[\mathsf{store}\mapsto\mathit{store}]$}}{\text{$(\mathsf{ls},\mathsf{msgs})\xrightarrow{\text{\tiny$\mathsf{del}({p},{t})$}}(\mathsf{ls}[{p}\mapsto s],\mathsf{msgs})$}}\end{array}$$

$$\begin{array}[]{c}\scriptsize\dfrac{\text{$\Phi_{1}$\quad$\mathsf{img}(\mathsf{ls}({p}).\mathsf{tstamp})<{t}$}}{\text{$(\mathsf{ls},\mathsf{lk},\mathsf{msgs})\xrightarrow{\text{\tiny$\mathsf{begin}({p},{t})$}}(\mathsf{ls}[{p}\mapsto s],\mathsf{lk},\mathsf{msgs})$}}\\[16.00003pt] \scriptsize\dfrac{\displaystyle\begin{multlined}\text{$\left\langle t,\mathit{log}\right\rangle\in\mathsf{msgs}$\quad$\mathit{store}=\mathsf{ls}({p}).\mathsf{store}[x\mapsto\mathit{last}(\mathit{log},x):x\in\mathbb{V},\mathit{last}(\mathit{log},x)\neq\bot,\mathsf{tstamp}(x)<t]$}\\ \text{$\mathit{tstamp}=\mathsf{ls}({p}).\mathsf{tstamp}[x\mapsto t:x\in\mathbb{V},\mathit{last}(\mathit{log},x)\neq\bot,\mathsf{tstamp}(x)<t]$\quad$s=\mathsf{ls}({p})[\mathsf{store}\mapsto\mathit{store},\mathsf{tstamp}\mapsto\mathit{tstamp}]$}\end{multlined}\text{$\left\langle t,\mathit{log}\right\rangle\in\mathsf{msgs}$\quad$\mathit{store}=\mathsf{ls}({p}).\mathsf{store}[x\mapsto\mathit{last}(\mathit{log},x):x\in\mathbb{V},\mathit{last}(\mathit{log},x)\neq\bot,\mathsf{tstamp}(x)<t]$}\\ \text{$\mathit{tstamp}=\mathsf{ls}({p}).\mathsf{tstamp}[x\mapsto t:x\in\mathbb{V},\mathit{last}(\mathit{log},x)\neq\bot,\mathsf{tstamp}(x)<t]$\quad$s=\mathsf{ls}({p})[\mathsf{store}\mapsto\mathit{store},\mathsf{tstamp}\mapsto\mathit{tstamp}]$}}{\text{$(\mathsf{ls},\mathsf{lk},\mathsf{msgs})\xrightarrow{\text{\tiny$\mathsf{del}({p},{t})$}}(\mathsf{ls}[{p}\mapsto s],\mathsf{lk},\mathsf{msgs})$}}\end{array}$$

$$\begin{array}[]{c}\dfrac{\displaystyle\begin{multlined}\text{$\text{$\mathtt{begin}$}\in{\mathsf{inst}}(\mathsf{ls}({p}).\mathsf{pc})$ \quad$\mathsf{img}(\mathsf{ls}(p).\mathsf{tstamp})<t$}\\ \text{$s=\mathsf{ls}({p})[\mathsf{log}\mapsto\epsilon,\mathsf{snapshot}\mapsto\mathsf{buildSnapshot}(\mathsf{store}),\mathsf{pc}\mapsto\mathsf{next}(\mathsf{pc})]$}\end{multlined}\text{$\text{$\mathtt{begin}$}\in{\mathsf{inst}}(\mathsf{ls}({p}).\mathsf{pc})$ \quad$\mathsf{img}(\mathsf{ls}(p).\mathsf{tstamp})<t$}\\ \text{$s=\mathsf{ls}({p})[\mathsf{log}\mapsto\epsilon,\mathsf{snapshot}\mapsto\mathsf{buildSnapshot}(\mathsf{store}),\mathsf{pc}\mapsto\mathsf{next}(\mathsf{pc})]$}}{\text{$(\mathsf{ls},\mathsf{msgs})\xrightarrow{\text{\tiny$\mathsf{begin}({p},{t})$}}(\mathsf{ls}[{p}\mapsto s],\mathsf{msgs})$}}\\[16.00003pt] \dfrac{\displaystyle\begin{multlined}\text{$r:=x\in{\mathsf{inst}}(\mathsf{ls}({p}).\mathsf{pc})$\quad$\mathit{cceval}(\mathsf{ls}({p}),x)=(v,{t}^{\prime})$ \quad$\mathit{rval}=\mathsf{ls}({p}).\mathsf{rval}[r\mapsto v]$}\\ \text{$s=\mathsf{ls}({p})[\mathsf{rval}\mapsto\mathit{rval},\mathsf{pc}\mapsto\mathsf{next}(\mathsf{pc})]$}\end{multlined}\text{$r:=x\in{\mathsf{inst}}(\mathsf{ls}({p}).\mathsf{pc})$\quad$\mathit{cceval}(\mathsf{ls}({p}),x)=(v,{t}^{\prime})$ \quad$\mathit{rval}=\mathsf{ls}({p}).\mathsf{rval}[r\mapsto v]$}\\ \text{$s=\mathsf{ls}({p})[\mathsf{rval}\mapsto\mathit{rval},\mathsf{pc}\mapsto\mathsf{next}(\mathsf{pc})]$}}{\text{$(\mathsf{ls},\mathsf{msgs})\xrightarrow{\text{\tiny$\mathsf{ld}({p},{t},x,v)$}}(\mathsf{ls}[{p}\mapsto s],\mathsf{msgs})$}}\\[16.00003pt] \dfrac{\text{$\text{$\mathtt{end}$}\in{\mathsf{inst}}(\mathsf{ls}({p}).\mathsf{pc})$\quad$s=\mathsf{ls}({p})[\mathsf{snapshot}\mapsto\epsilon,\mathsf{pc}\mapsto\mathsf{next}(\mathsf{pc})]$}}{\text{$(\mathsf{ls},\mathsf{msgs})\xrightarrow{\text{\tiny$\mathsf{end}({p},{t})$}}(\mathsf{ls}[{p}\mapsto s],\mathsf{msgs}\cup\{({t},\mathsf{ls}(p).\mathsf{log})\})$}}\\[16.00003pt] \dfrac{\displaystyle\begin{multlined}\text{$\left\langle t,\mathit{log}\right\rangle\in\mathsf{msgs}$\quad$\mathit{store}=\mathsf{ls}({p}).\mathsf{store}[x\mapsto\mathit{update}(\mathsf{ls}({p}),x,{t},\mathit{last}(\mathit{log},x)):x\in\mathbb{V}]$}\\ \text{ $s=\mathsf{ls}({p})[\mathsf{store}\mapsto\mathit{store},\mathsf{pc}\mapsto\mathsf{next}(\mathsf{pc})]$}\end{multlined}\text{$\left\langle t,\mathit{log}\right\rangle\in\mathsf{msgs}$\quad$\mathit{store}=\mathsf{ls}({p}).\mathsf{store}[x\mapsto\mathit{update}(\mathsf{ls}({p}),x,{t},\mathit{last}(\mathit{log},x)):x\in\mathbb{V}]$}\\ \text{ $s=\mathsf{ls}({p})[\mathsf{store}\mapsto\mathit{store},\mathsf{pc}\mapsto\mathsf{next}(\mathsf{pc})]$}}{\text{$(\mathsf{ls},\mathsf{msgs})\xrightarrow{\text{\tiny$\mathsf{del}({p},{t})$}}(\mathsf{ls}[{p}\mapsto s],\mathsf{msgs})$}}\end{array}$$

$$c_i{\to }_{{\mathsf{HB}}^1}{c}_{i+1}\text{ for all }i\in [0,n]$$

$$\#(\tau )=\sum _{\mathsf{isu}(p,t),\mathsf{del}(p^{\prime },t)\in \tau }{d}_{\tau }(\mathsf{isu}(p,t),\mathsf{del}(p^{\prime },t))$$

$$[[{\mathsf{l}}_1\text{lit}\ast :\mathsf{begin}\text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_2\text{lit}\ast ;]{]}_{\mathsf{A}}^{P2}=$$

$$\displaystyle\hskip 4.83691pt\mathsf{l}_{1}\lit*{:}\ \lit*{assume}\ \mathsf{HB}=\perp\land(p.a\neq\perp\lor a_{\mathsf{tr}_{\mathsf{A}}}=\perp)\lit*{;}\ \lit*{goto}\ \mathsf{l}_{x1}\lit*{;}\ \ \ \ \ \$$

$${\mathsf{l}}_{x1}\text{lit}\ast :\mathsf{begin}\text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_2\text{lit}\ast ;$$

$${\mathsf{l}}_1\text{lit}\ast :\text{lit}\ast assume\mathsf{HB}=\perp \wedge a_{{\mathsf{tr}}_{\mathsf{A}}}=\perp \text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_{x2}\text{lit}\ast ;$$

$${\mathsf{l}}_{x2}\text{lit}\ast :\mathsf{begin}\text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_{x3}\text{lit}\ast ;$$

$${\mathsf{l}}_{x3}\text{lit}\ast :p.a:=\mathsf{true}\text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_{x4}\text{lit}\ast ;$$

$${\mathsf{l}}_{x4}\text{lit}\ast :\text{lit}\ast Foreachx\in \mathbb{V}.x^{\prime }:=x\text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_{x5}\text{lit}\ast ;$$

$${\mathsf{l}}_{x5}\text{lit}\ast :a_{{\mathsf{tr}}_{\mathsf{A}}}:=\mathsf{true}\text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_2\text{lit}\ast ;$$

$$[[{\mathsf{l}}_1\text{lit}\ast :r:=x\text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_2\text{lit}\ast ;]{]}_{\mathsf{A}}^{P2}=$$

$${\mathsf{l}}_1\text{lit}\ast :\text{lit}\ast assume{a}_{{\mathsf{tr}}_{\mathsf{A}}}=\perp \text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_{x1}\text{lit}\ast ;$$

$${\mathsf{l}}_{x1}\text{lit}\ast :r:=x\text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_2\text{lit}\ast ;$$

$${\mathsf{l}}_1\text{lit}\ast :\text{lit}\ast assume{a}_{{\mathsf{tr}}_{\mathsf{A}}}\ne \perp \wedge p.a\ne \perp \text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_{x2}\text{lit}\ast ;$$

$${\mathsf{l}}_{x2}\text{lit}\ast :r:=x^{\prime }\text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_{x3}\text{lit}\ast ;$$

$${\mathsf{l}}_{x3}\text{lit}\ast :x^{\prime }.event:=\mathsf{ld}\text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_2\text{lit}\ast ;$$

$${\mathsf{l}}_1\text{lit}\ast :\text{lit}\ast assume{x}^{\prime }.event=\perp \wedge p.a\ne \perp \text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_{x4}\text{lit}\ast ;$$

$${\mathsf{l}}_{x4}\text{lit}\ast :r:=x^{\prime }\text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_{x5}\text{lit}\ast ;$$

$${\mathsf{l}}_{x5}\text{lit}\ast :\mathsf{HB}:=\mathsf{true}\text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_{x6}\text{lit}\ast ;$$

$${\mathsf{l}}_{x6}\text{lit}\ast :x.event:=\mathsf{ld}\text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_2\text{lit}\ast ;$$

$$[[{\mathsf{l}}_1\text{lit}\ast :x:=e\text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_2\text{lit}\ast ;]{]}_{\mathsf{A}}^{P2}=$$

$${\mathsf{l}}_1\text{lit}\ast :\text{lit}\ast assume{a}_{{\mathsf{tr}}_{\mathsf{A}}}=\perp \text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_{x1}\text{lit}\ast ;$$

$${\mathsf{l}}_{x1}\text{lit}\ast :x:=e\text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_2\text{lit}\ast ;$$

$${\mathsf{l}}_1\text{lit}\ast :\text{lit}\ast assume{a}_{{\mathsf{tr}}_{\mathsf{A}}}\ne \perp \wedge p.a\ne \perp \text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_{x2}\text{lit}\ast ;$$

$${\mathsf{l}}_{x2}\text{lit}\ast :x^{\prime }:=e\text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_{x3}\text{lit}\ast ;$$

$${\mathsf{l}}_{x3}\text{lit}\ast :x^{\prime }.event:=\mathsf{st}\text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_2\text{lit}\ast ;$$

$${\mathsf{l}}_1\text{lit}\ast :\text{lit}\ast assume{a}_{{\mathsf{st}}_{\mathsf{A}}}=x.event=\perp \wedge p.a\ne \perp \text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_{x4}\text{lit}\ast ;$$

$${\mathsf{l}}_{x4}\text{lit}\ast :x^{\prime }:=e\text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_{x5}\text{lit}\ast ;$$

$${\mathsf{l}}_{x5}\text{lit}\ast :a_{{\mathsf{st}}_{\mathsf{A}}}:=‘x‘\text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_{x6}\text{lit}\ast ;$$

$${\mathsf{l}}_{x6}\text{lit}\ast :x^{\prime }.event:=\mathsf{st}\text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_2\text{lit}\ast ;$$

$${\mathsf{l}}_1\text{lit}\ast :\text{lit}\ast assume{x}^{\prime }.event=\perp \wedge p.a\ne \perp \text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_{x7}\text{lit}\ast ;$$

$${\mathsf{l}}_{x7}\text{lit}\ast :x^{\prime }:=e\text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_{x8}\text{lit}\ast ;$$

$${\mathsf{l}}_{x8}\text{lit}\ast :\mathsf{HB}:=\mathsf{true}\text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_{x9}\text{lit}\ast ;$$

$${\mathsf{l}}_{x9}\text{lit}\ast :x.event:=\mathsf{ld}\text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_2\text{lit}\ast ;$$

$$[[{\mathsf{l}}_1\text{lit}\ast :\mathsf{end}\text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_2\text{lit}\ast ;]{]}_{\mathsf{A}}^{P2}=$$

$${\mathsf{l}}_1\text{lit}\ast :\text{lit}\ast assumep.a\ne \perp \wedge a_{{\mathsf{st}}_{\mathsf{A}}}=\perp \text{lit}\ast ;\text{lit}\ast assume\mathsf{false}\text{lit}\ast ;$$

$${\mathsf{l}}_1\text{lit}\ast :\mathsf{end}\text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_2\text{lit}\ast ;$$

$$[[{\mathsf{l}}_1\text{lit}\ast :\mathsf{begin}\text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_2\text{lit}\ast ;]{]}_{\mathsf{VH}}^{P2}=$$

$${\mathsf{l}}_1\text{lit}\ast :\text{lit}\ast assume\mathsf{HB}=\perp \wedge (a_{{\mathsf{tr}}_{\mathsf{A}}}=\perp \vee p.vh=\perp )\text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_{x1}\text{lit}\ast ;$$

$${\mathsf{l}}_{x1}\text{lit}\ast :\mathsf{begin}\text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_2\text{lit}\ast ;$$

$${\mathsf{l}}_1\text{lit}\ast :\text{lit}\ast assume\mathsf{HB}=p.vh=p.a=\perp \wedge a_{{\mathsf{tr}}_{\mathsf{A}}}\ne \perp \text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_{x2}\text{lit}\ast ;$$

$${\mathsf{l}}_{x2}\text{lit}\ast :\mathsf{begin}\text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_{x3}\text{lit}\ast ;$$

$${\mathsf{l}}_{x3}\text{lit}\ast :p.vh:=\mathsf{false}\text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_{x4}\text{lit}\ast ;$$

$${\mathsf{l}}_{x4}\text{lit}\ast :\text{lit}\ast Foreach{x}^{\prime }\in \mathbb{V}.x^{\prime }.even{t}^{\prime }:=x^{\prime }.event\text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_2\text{lit}\ast ;$$

$${\mathsf{l}}_1\text{lit}\ast :\text{lit}\ast assume\mathsf{HB}=\perp \wedge a_{{\mathsf{tr}}_{\mathsf{A}}}\ne \perp \wedge p.vh\text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_{x5}\text{lit}\ast ;$$

$${\mathsf{l}}_{x5}\text{lit}\ast :\mathsf{begin}\text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_2\text{lit}\ast ;$$

$$[[{\mathsf{l}}_1\text{lit}\ast :r:=x\text{lit}\ast ;\text{lit}\ast goto{\mathsf{l}}_2\text{lit}\ast ;]{]}_{\mathsf{VH}}^{P2}=$$

Full text

In this paper, we investigate application-specific relationships between several variations of causal consistency and we address the issue of verifying automatically if a given transactional program is robust against causal consistency, i.e., all its behaviors when executed over an arbitrary causally consistent database are serializable. We show that programs without write-write races have the same set of behaviors under all these variations, and we show that checking robustness is polynomial time reducible to a state reachability problem in transactional programs over a sequentially consistent shared memory. A surprising corollary of the latter result is that causal consistency variations which admit incomparable sets of behaviors admit comparable sets of robust programs. This reduction also opens the door to leveraging existing methods and tools for the verification of concurrent programs (assuming sequential consistency) for reasoning about programs running over causally consistent databases. Furthermore, it allows to establish that the problem of checking robustness is decidable when the programs executed at different sites are finite-state.

This work is supported in part by the European Research Council (ERC) under the European Union’s Horizon 2020 research and innovation programme (grant agreement No 678177).

1. Introduction

Distribution and replication are widely adopted in order to implement storage systems and databases offering performant and available services. The implementations of these systems must ensure consistency guarantees allowing to reason about their behaviors in an abstract and simple way. Ideally, programmers of applications using such systems would like to have strong consistency guarantees, i.e., all updates occurring anywhere in the system are seen immediately and executed in the same order by all sites. Moreover, application programmers also need an abstract mechanism such as transactions, ensuring that blocks of actions (writes and reads) of a site can be considered as executing atomically without interferences from actions of other sites. For transactional programs, the consistency model offering strong consistency is serializability [37], i.e., every computation of a program is equivalent to another one where transactions are executed serially one after another without interference. In the non-transactional case this model corresponds to sequential consistency (SC) [31]. However, while serializability and SC are easier to apprehend by application programmers, their enforcement (by storage systems implementors) requires the use of global synchronization between all sites, which is hard to achieve while ensuring availability and acceptable performances [23, 24]. For this reason, modern storage systems ensure weaker consistency guarantees. In this paper, we are interested in studying causal consistency [30].

Causal consistency is a fundamental consistency model implemented in several production databases, e.g., AntidoteDB, CockroachDB, and MongoDB, and extensively studied in the literature [7, 22, 33, 34, 39]. Basically, when defined at the level of actions, it guarantees that every two causally related actions, say $a_{1}$ is causally before (i.e., it has an influence on) $a_{2}$, are executed in that same order, i.e., $a_{1}$ before $a_{2}$, by all sites. The sets of updates visible to different sites may differ and read actions may return values that cannot be obtained in SC executions. The definition of causal consistency can be lifted to the level of transactions, assuming that transactions are visible to a site in their entirety (i.e., all their updates are visible at the same time), and they are executed by a site in isolation without interference from other transactions. In comparison to serializability, causal consistency allows that conflicting transactions, i.e., which read or write to a common location, be executed in different orders by different sites as long as they are not causally related. Actually, we consider three variations of causal consistency introduced in the literature, weak causal consistency (CC) [38, 13], causal memory (CM) [3, 38], and causal convergence (CCv) [17].

The weakest variation of causal consistency, namely CC, allows speculative executions and roll-backs of transactions which are not causally related (concurrent). For instance, the computation in Fig. 1(c) is only feasible under CC: the site on the right applies ${\tt t2}$ after ${\tt t1}$ before executing ${\tt t3}$ and roll-backs ${\tt t2}$ before executing ${\tt t4}$. CCv and CM offer more guarantees. CCv enforces a total arbitration order between all transactions which defines the order in which delivered concurrent transactions are executed by every site. This guarantees that all sites reach the same state when all transactions are delivered. CM ensures that all values read by a site can be explained by an interleaving of transactions consistent with the causal order, enforcing thus PRAM consistency [32] on top of CC. Contrary to CCv, CM allows that two sites diverge on the ordering of concurrent transactions, but both models do not allow roll-backs of concurrent transactions. Thus, CCv and CM are incomparable in terms of computations they admit. The computation in Fig. 1(a) is not admitted by CM because there is no interleaving of those transactions that explains the values read by the site on the right: reading [math] from ${\tt z}$ implies that the transactions on the left must be applied after ${\tt t3}$ while reading $1$ from ${\tt y}$ implies that both ${\tt t1}$ and ${\tt t2}$ are applied before ${\tt t4}$ which contradicts reading 2 from ${\tt x}$. However, this computation is possible under CCv because ${\tt t1}$ can be delivered to the right after executing ${\tt t3}$ but arbitrated before ${\tt t3}$, which implies that the write to ${\tt x}$ in ${\tt t1}$ will be lost. The CM computation in Fig. 1(b) is not possible under CCv because there is no arbitration order that could explain both reads from ${\tt x}$.

As a first contribution of our paper, we show that the three causal consistency models coincide for transactional programs containing no write-write races, i.e., concurrent transactions writing on a common variable. We also show that if a transactional program has a write-write race under one of these models, then it must have a write-write race under any of the other two models. This property is rather counter-intuitive since CC is strictly weaker than both CCv and CM, and CCv and CM are incomparable (in terms of admitted behaviors). Notice that each of the computations in Figures 1(a), 1(b), and 1(c) contains a write-write race which explains why none of these computations is possible under all three models.

Then, we investigate the problem of checking robustness of application programs against causal consistency relaxations: Given a program $P$ and a causal consistency variation $X$, we say that $P$ is robust against $X$ if the set of computations of $P$ when running under $X$ is the same as its set of computations when running under serializability. This means that it is possible to reason about the behaviors of $P$ assuming the simpler serializability model and no additional synchronization is required when $P$ runs under $X$ such that it maintains all the properties satisfied under serializability. Checking robustness is not trivial, it can be seen as a form of checking program equivalence. However, the equivalence to check is between two versions of the same program, obtained using two different semantics, one more permissive than the other one. The goal is to check that this permissiveness has actually no effect on the particular program under consideration. The difficulty in checking robustness is to apprehend the extra behaviors due to the reorderings introduced by the relaxed consistency model w.r.t. serializability. This requires a priori reasoning about complex order constraints between operations in arbitrarily long computations, which may need maintaining unbounded ordered structures, and make the problem of checking robustness hard or even undecidable.

We show that verifying robustness of transactional programs against causal consistency can be reduced in polynomial time to the reachability problem in concurrent programs over SC. This allows to reason about distributed applications running on causally consistent storage systems using the existing verification technology and it implies that the robustness problem is decidable for finite-state programs; the problem is PSPACE-complete when the number of sites is fixed, and EXPSPACE-complete otherwise. This is the first result on the decidability and complexity of verifying robustness against causal consistency. In fact, the problem of verifying robustness has been considered in the literature for several consistency models of distributed systems, including causal consistency [11, 15, 16, 19, 35]. These works provide (over- or under-)approximate analyses for checking robustness, but none of them provides precise (sound and complete) algorithmic verification methods for solving this problem, nor addresses its decidability and complexity.

The approach we adopt for tackling this verification problem is based on a precise characterization of the set of robustness violations, i.e., executions that are causally consistent but not serializable. For both CCv and CM, we show that it is sufficient to search for a special type of robustness violations, that can be simulated by serial (SC) computations of an instrumentation of the original program. These computations maintain the information needed to recognize the pattern of a violation that would have occurred in the original program under a causally consistent semantics (executing the same set of operations). A surprising consequence of these results is that a program is robust against CM iff it is robust against CC, and robustness against CM implies robustness against CCv. This shows that the causal consistency variations we investigate can be incomparable in terms of the admitted behaviors, but comparable in terms of the robust applications they support.

2. Causal Consistency

2.1. Program syntax

We consider a simple programming language where a program is parallel composition of processes distinguished using a set of identifiers $\mathbb{P}$. Our simple programming language syntax is given in Fig. 2. Each process is a sequence of transactions and each transaction is a sequence of labeled instructions. Each transaction starts with a $\mathtt{begin}$ instruction and finishes with an $\mathtt{end}$ instruction. Each other instruction is either an assignment to a process-local register from a set $\mathbb{R}$ or to a shared variable from a set $\mathbb{V}$, or an $\mathtt{assume}$ statement. The assignments use values from a data domain $\mathbb{D}$. An assignment to a register $\langle reg\rangle:=\langle var\rangle$ is called a read of $\langle var\rangle$ and an assignment to a shared variable $\langle var\rangle:=\langle reg\text{-}expr\rangle$ is called a write to $\langle var\rangle$ ($\langle reg\text{-}expr\rangle$ is an expression over registers). The statement $\mathtt{assume}$ $\langle bexpr\rangle$ blocks the process if the Boolean expression $\langle bexpr\rangle$ over registers is false. Each instruction is followed by a $\mathtt{goto}$ statement which defines the evolution of the program counter. Multiple instructions can be associated with the same label which allows us to write non-deterministic programs and multiple $\mathtt{goto}$ statements can direct the control to the same label which allows us to mimic imperative constructs like loops and conditionals. We assume that the control cannot pass from one transaction to another without going as expected through $\mathtt{begin}$ and $\mathtt{end}$ instructions.

2.2. Program Semantics Under Causal Memory

Informally, the semantics of a program under causal memory is defined as follows. The shared variables are replicated across each process, each process maintaining its own local valuation of these variables. During the execution of a transaction in a process, the shared-variable writes are stored in a transaction log which is visible only to the process executing the transaction and which is broadcasted to all the processes at the end of the transaction111For simplicity, we assume that every transaction commits. The effects of aborted transactions shouldn’t be visible to any process.. To read a shared variable $x$, a process ${p}$ first accesses its transaction log and takes the last written value on $x$, if any, and then its own valuation of the shared variables, if $x$ was not written during the current transaction. Transaction logs are delivered to every process in an order consistent with the causal delivery relation between transactions, i.e., the transitive closure of the union of the program order (the order in which transactions are executed by a process), and the delivered-before relation (a transaction ${t}_{1}$ is delivered-before a transaction ${t}_{2}$ iff the log of ${t}_{1}$ has been delivered at the process executing ${t}_{2}$ before ${t}_{2}$ starts). By an abuse of terminology, we call this property causal delivery. Once a transaction log is delivered, it is immediately applied on the shared-variable valuation of the receiving process. Also, no transaction log can be delivered to a process ${p}$ while ${p}$ is executing another transaction, we call this property transaction isolation.

Formally, a program configuration is a triple $\mathsf{gs}=(\mathsf{ls},\mathsf{msgs})$ where $\mathsf{ls}:\mathbb{P}\rightarrow\mathbb{S}$ associates a local state in $\mathbb{S}$ to each process in $\mathbb{P}$, and $\mathsf{msgs}$ is a set of messages in transit. A local state is a tuple $\left\langle\mathsf{pc},\mathsf{store},\mathsf{rval},\mathsf{log}\right\rangle$ where $\mathsf{pc}\in\mathbb{L}\mathsf{ab}$ is the program counter, i.e., the label of the next instruction to be executed, $\mathsf{store}:\mathbb{V}\rightarrow\mathbb{D}$ is the local valuation of the shared variables, $\mathsf{rval}:\mathbb{R}\rightarrow\mathbb{D}$ is the valuation of the local registers, and $\mathsf{log}\in(\mathbb{V}\times\mathbb{D})^{*}$ is the transaction log, i.e., a list of variable-value pairs. For a local state $s$, we use $s.\mathsf{pc}$ to denote the program counter component of $s$, and similarly for all the other components of $s$. A message $m=\left\langle{t},\mathit{log}\right\rangle$ is a transaction identifier ${t}$ from a set $\mathbb{T}$ together with a transaction log $\mathit{log}\in(\mathbb{V}\times\mathbb{D})^{*}$. We let $\mathbb{M}$ denote the set of messages.

Then, the semantics of a program $\mathcal{P}$ under causal memory is defined using a labeled transition system (LTS) $[\mathcal{P}]_{{\tt CM}{}}=(\mathbb{C},\mathbb{E}\mathsf{v},\mathsf{gs}_{0},\rightarrow)$ where $\mathbb{C}$ is the set of program configurations, $\mathbb{E}\mathsf{v}$ is a set of transition labels called events, $\mathsf{gs}_{0}$ is the initial configuration, and $\rightarrow\subseteq\mathbb{C}\times\mathbb{E}\mathsf{v}\times\mathbb{C}$ is the transition relation. As it will be explained later in this section, the executions of $\mathcal{P}$ under causal memory are a subset of those generated by $[\mathcal{P}]_{{\tt CM}{}}$. The set of events is defined by:

[TABLE]

where $\mathsf{begin}$ and $\mathsf{end}$ label transitions corresponding to the start, resp., the end of a transaction, $\mathsf{isu}$ and $\mathsf{ld}$ label transitions corresponding to writing, resp., reading, a shared variable during some transaction, and $\mathsf{del}$ labels transitions corresponding to applying a transition log to the local state of the process issuing the transaction or to the state of another process that received the log. An event $\mathsf{isu}$ is called an issue while an event $\mathsf{del}$ is called a store.

The transition relation $\rightarrow$ is partially defined in Fig. 3 (we will present additional constraints later in this section). The events labeling a transition are written on top of $\rightarrow$. A $\mathsf{begin}$ transition will just reset the transaction log while an $\mathsf{end}$ transition will add the transaction log together with the transaction identifier to the set $\mathsf{msgs}$ of messages in transit. An $\mathsf{ld}$ transition will read the value of a shared-variable looking first at the transaction log $\mathsf{log}$ and then, at the shared-variable valuation $\mathsf{store}$, while an $\mathsf{isu}$ transition will add a new write to the transaction log. Finally, a $\mathsf{del}$ transition represents the delivery of a transaction log that was in transit which is applied immediately on the shared-variable valuation $\mathsf{store}$.

We say that an execution $\rho$ satisfies transaction isolation if no transaction log is delivered to a process ${p}$ while ${p}$ is executing a transaction, i.e., if an event $\mathit{ev}=\mathsf{del}({p},{t})$ occurs in $\rho$ before an event $\mathit{ev}^{\prime}=\mathsf{end}({p},{t}^{\prime})$ with ${t}^{\prime}\neq{t}$, then $\rho$ contains an event $\mathit{ev}^{\prime\prime}=\mathsf{begin}({p},{t}^{\prime})$ between $\mathit{ev}$ and $\mathit{ev}^{\prime}$. For an execution $\rho$ satisfying transaction isolation, we assume w.l.o.g. that transactions executed by different processes do not interleave, i.e., if an event $\mathit{ev}$ associated to a transaction ${t}$ (an event of the process executing ${t}$ or the delivery of the transaction log of ${t}$) occurs in $\rho$ before $\mathit{ev}^{\prime}=\mathsf{end}({p}^{\prime},{t}^{\prime})$, then $\rho$ contains an event $\mathit{ev}^{\prime\prime}=\mathsf{begin}({p}^{\prime},{t}^{\prime})$ between $\mathit{ev}$ and $\mathit{ev}^{\prime}$. Formally, we say that an execution $\rho$ satisfies causal delivery if the following hold:

• •

for any event $\mathsf{begin}({p},{t})$, and for any process ${p}^{\prime}$, $\rho$ contains at most one event $\mathsf{del}({p}^{\prime},{t})$,

• •

for any two events $\mathsf{begin}({p},{t})$ and $\mathsf{begin}({p},{t}^{\prime})$, if $\mathsf{begin}({p},{t})$ occurs in $\rho$ before $\mathsf{begin}({p},{t}^{\prime})$, then the event $\mathsf{del}({p},{t})$ occurs before $\mathsf{begin}({p},{t}^{\prime})$ in $\rho$. This ensures that when ${p}$ issues ${t}$ it must store the writes of ${t}$ in its local state before issuing another transaction ${t}^{\prime}$;

• •

for any events $\mathit{ev}_{1}\in\{\mathsf{del}({p},{t}_{1}),\mathsf{end}({p},{t}_{1})\}$, $\mathit{ev}_{2}=\mathsf{begin}({p},{t}_{2})$, and $\mathit{ev}_{2}^{\prime}=\mathsf{del}({p}^{\prime},{t}_{2})$ with ${p}\neq{p}^{\prime}$, if $\mathit{ev}_{1}$ occurs in $\rho$ before $\mathit{ev}_{2}$, then there exists $\mathit{ev}_{1}^{\prime}=\mathsf{del}({p}^{\prime},{t}_{1})$ such that $\mathit{ev}_{1}^{\prime}$ occurs before $\mathit{ev}_{2}^{\prime}$ in $\rho$.

An execution $\rho$ satisfies causal memory if it satisfies transaction isolation and causal delivery. The set of executions of $\mathcal{P}$ under causal memory, denoted by $\mathbb{E}\mathsf{x}_{{\tt CM}{}}(\mathcal{P})$, is the set of executions of $[\mathcal{P}]_{{\tt CM}{}}$ satisfying causal memory.

Fig. 4(a) shows an execution under CM. This execution satisfies transaction isolation since no transaction is delivered while another transaction is executing.

2.3. Program Semantics Under Causal Convergence

Compared to causal memory, causal convergence ensures eventual consistency of process-local copies of the shared variables. Each transaction log is associated with a timestamp and a process applies a write on some variable $x$ from a transaction log only if it has a timestamp larger than the timestamps of all the transaction logs it has already applied and that wrote the same variable $x$. For simplicity, we assume that the transaction identifiers play the role of timestamps, which are totally ordered according to some relation $<$. CCv satisfies both causal delivery and transaction isolation as well. Assuming that transactions are constituted of either a read alone or a write alone, CCv is equivalent to Strong Release-Acquire (SRA), a strengthening of the standard Release-Acquire of the C11 memory model [28]222This equivalence excludes the atomic read-modify-write (also know as compare-and-swap) operation which is not provided by CCv..

Formally, we define a variation of the LTS $[\mathcal{P}]_{{\tt CM}{}}$, denoted by $[\mathcal{P}]_{{\tt CCv}{}}$, where essentially, the transition identifiers play the role of timestamps and are ordered by a total order $<$, each process-local state contains an additional component $\mathsf{tstamp}$ storing the largest timestamp the process has seen for each variable, and a write on a variable $x$ from a transaction log is applied on the local valuation $\mathsf{store}$ only if it has a timestamp larger than $\mathsf{tstamp}(x)$. Also, a $\mathsf{begin}({p},{t})$ transition will choose a transaction identifier ${t}$ greater than those in the image of the $\mathsf{tstamp}$ component of ${p}$’s local state. The transition rules of $[\mathcal{P}]_{{\tt CCv}{}}$ that change w.r.t. those of $[\mathcal{P}]_{{\tt CM}{}}$ are given in Fig. 5.

The set of executions of $\mathcal{P}$ under causal convergence, denoted by $\mathbb{E}\mathsf{x}_{{\tt CCv}{}}(\mathcal{P})$, is the set of executions of $[\mathcal{P}]_{{\tt CCv}{}}$ satisfying transaction isolation, causal delivery, and the fact that every process ${p}$ generates monotonically increasing transaction identifiers.

The execution in Fig. 4(a) is not possible under causal convergence since ${t}4$ and ${t}2$ read $2$ and $1$ from $x$, respectively. This is possible only if ${t}1$ and ${t}3$ write $x$ at ${p}2$ and ${p}1$, respectively, which contradicts the definition of $\mathsf{del}$ transition given in Fig. 5 where we cannot have both ${t}1<{t}3$ and ${t}3<{t}1$ at the same time. Fig. 4(b) shows an execution under CCv (we assume ${t}_{1}<{t}_{2}<{t}_{3}<{t}_{4}$). Notice that $\mathsf{del}({p}2,{t}1)$ did not result in an update of $x$ because the timestamp ${t}_{1}$ is smaller than the timestamp of the last transaction that wrote $x$ at ${p}_{2}$, namely ${t}_{3}$, a behavior that is not possible under CM. The two processes converge and store the same shared variable copy at the end of the execution.

2.4. Program Semantics Under Weak Causal Consistency

Compared to the previous semantics, CC allows that reads of the same process observe concurrent writes as executing in different orders. Each process maintains a set of values for each shared variable, and a read returns any one of these values non-deterministically. Transaction logs are associated with vector clocks [30] which represent the causal delivery relation, i.e., a transaction ${t}_{1}$ is before ${t}_{2}$ in causal-delivery iff the vector clock of ${t}_{1}$ is smaller than the vector clock of ${t}_{2}$. We assume that transactions identifiers play the role of vector clocks, which are partially ordered according to some relation $<$. In applying the log of a transaction ${t}$ on the local state of the receiving process ${p}$, the final set of values for each shared variable in ${p}$ will be constituted of the value in the log of ${t}$ and the values that were written by concurrent transactions (not related by causal delivery to ${t}$). CC satisfies both causal delivery and transaction isolation.

Formally, in CC semantics, the local valuation of the shared variables $\mathsf{store}:\mathbb{V}\rightarrow(\mathbb{D}\times\mathbb{T})^{*}$ is a map that accepts a shared variable and returns a set of pairs. The pairs are constituted of values that were written concurrently and identifiers of the transactions that wrote those values. When applying a transaction log on the local valuation store, we keep the values that were written by transactions that are concurrent with the current transaction. Additionally, in the CC semantics, the local state of a process has an additional component $\mathsf{snapshot}:\mathbb{V}\rightarrow(\mathbb{D}\times\mathbb{T})$ that maps each shared variable to a single pair. $\mathsf{snapshot}$ is obtained by taking a “consistent” snapshot from $\mathsf{store}$ when a new transaction starts. Such a snapshot corresponds to a linearization of the transactions that were delivered to the process, which is consistent with the vector clock order. The snapshot associates to each variable the last value written in this linearization. When a process does a read from a shared variable $x$, it looks first at the transaction log $\mathsf{log}$ and then, at the variable valuation $\mathsf{snapshot}$. In Fig. 6, we provide the transition rules of $[\mathcal{P}]_{{\tt CC}{}}$ that change w.r.t. those of $[\mathcal{P}]_{{\tt CCv}{}}$ and $[\mathcal{P}]_{{\tt CM}{}}$.

The set of executions of $\mathcal{P}$ under weak causal consistency model, denoted by $\mathbb{E}\mathsf{x}_{{\tt CC}{}}(\mathcal{P})$, is the set of executions of $[\mathcal{P}]_{{\tt CC}{}}$ satisfying transaction isolation and causal delivery. We denote by $\mathbb{T}\mathsf{r}(\mathcal{P})_{{\tt CC}{}}$ the set of traces of executions of a program $\mathcal{P}$ under weak causal consistency.

Fig. 4(c) shows an execution under CC, which is not possible under CCv and CM because ${t}3$ and ${t}4$ read $2$ and $1$, respectively. Since the transactions ${t}_{1}$ and ${t}_{2}$ are concurrent, ${p}_{2}$ stores both values $2$ and $1$ written by these transactions. A read of $x$ can return any of these two values.

2.5. Execution Summary

Let $\rho$ be an execution under $\textsf{X}\in\{{\tt CCv}{},\ {\tt CM}{},\ {\tt CC}{}\}$, a sequence $\tau$ of events $\mathsf{isu}({p},{t})$ and $\mathsf{del}({p},{t})$ with ${p}\in\mathbb{P}$ and ${t}\in\mathbb{T}$ is called a summary of $\rho$ if it is obtained from $\rho$ by substituting every sub-sequence of transitions in $\rho$ delimited by a $\mathsf{begin}$ and an $\mathsf{end}$ transition, with a single “macro-event” $\mathsf{isu}({p},{t})$. For example, $\mathsf{isu}({p}1,{t}1)\cdot\mathsf{isu}({p}2,{t}3)\cdot\mathsf{del}({p}1,{t}3)\cdot\mathsf{del}({p}2,{t}1)\cdot\mathsf{isu}({p}2,{t}4)\cdot\mathsf{isu}({p}1,{t}2)$ is a summary of the execution in Fig. 4(a).

We say that a transaction ${t}$ in $\rho$ performs an external read of a variable $x$ if $\rho$ contains an event $\mathsf{ld}({p},{t},x,v)$ which is not preceded by a write on $x$ of ${t}$, i.e., an event $\mathsf{isu}({p},{t},x,v)$. Under CM and CC, a transaction ${t}$ writes a variable $x$ if $\rho$ contains an event $\mathsf{isu}({p},{t},x,v)$, for some $v$. In Fig. 4(a), both ${t}2$ and ${t}4$ perform external reads and ${t}2$ writes to $y$. A transaction ${t}$ executed by a process ${p}$ writes $x$ at process ${p}^{\prime}$ if ${t}$ writes $x$ and $\rho$ contains an event $\mathsf{del}({p}^{\prime},{t})$ (e.g., in Fig. 4(a), ${t}1$ writes $x$ at ${p}2$). Under CCv, we say that a transaction ${t}$ executed by a process ${p}$ writes $x$ at process ${p}^{\prime}$ if ${t}$ writes $x$ and $\rho$ contains an event $\mathsf{del}({p}^{\prime},{t})$ which is not preceded by an event $\mathsf{del}({p}^{\prime},{t}^{\prime})$ with ${t}<{t}^{\prime}$ and ${t}^{\prime}$ writing $x$ (if it would be preceded by such an event then the write to $x$ of ${t}$ will be discarded). For example, in Fig. 4(b), ${t}1$ does not write $x$ at ${p}2$.

2.6. Trace

We define an abstract representation of executions that satisfy transaction isolation333We refer collectively to executions in $[\mathcal{P}]_{\textsf{X}}\mbox{ with }\textsf{X}\in\{{\tt CCv}{},\ {\tt CM}{},\ {\tt CC}{}\}$., called trace. Essentially, a trace contains the summary of an execution (it forgets the order in which shared-variables are accessed inside a transaction) and several happens-before relations between events in its summary which record control-flow dependencies, the order between transactions issued in the same process, and data-flow dependencies, e.g. which transaction wrote the value read by another transaction.

More precisely, the trace of an execution $\rho$ is a tuple $\mathsf{tr}(\rho)=(\tau,{\mathsf{PO}},{\mathsf{WR}},{\mathsf{WW}},{\mathsf{RW}},{\mathsf{STO}})$ where $\tau$ is the summary of $\rho$, ${\mathsf{PO}}$ is the program order, which relates any two issue events $\mathsf{isu}({p},{t})$ and $\mathsf{isu}({p},{t}^{\prime})$ that occur in this order in $\tau$, ${\mathsf{WR}}$ is the write-read relation (also called read-from), which relates events of two transactions ${t}$ and ${t}^{\prime}$ such that ${t}$ writes a value that ${t}^{\prime}$ reads, ${\mathsf{WW}}$ is the write-write order (also called store-order), which relates events of two transactions that write to the same variable, ${\mathsf{RW}}$ is the read-write relation (also called conflict), which relates events of two transactions ${t}$ and ${t}^{\prime}$ such that ${t}$ reads a value overwritten by ${t}^{\prime}$, and ${\mathsf{STO}}$ is the same-transaction relation, which relates events of the same transaction.

{defi}

[Trace] Formally, the trace of an execution $\rho$ satisfying transaction isolation is $\mathsf{tr}(\rho)=(\tau,{\mathsf{PO}},{\mathsf{WR}},{\mathsf{WW}},{\mathsf{RW}},{\mathsf{STO}})$ where $\tau$ is a summary of $\rho$, and

• ${\mathsf{PO}}$:

relates the issue and store events $\mathsf{isu}({p},{t})$ and $\mathsf{del}({p},{t})$ of ${t}$ and subsequently, the event $\mathsf{del}({p},{t})$ with any issue event $\mathsf{isu}({p},{t}^{\prime})$ that occurs after it in $\tau$.

• ${\mathsf{WR}}$:

relates any store and issue events $\mathit{ev}_{1}=\mathsf{del}({p},{t})$ and $\mathit{ev}_{2}=\mathsf{isu}({p},{t}^{\prime})$ that occur in this order in $\tau$ such that ${t}^{\prime}$ performs an external read of $x$, and $\mathit{ev}_{1}$ is the last event in $\tau$ before $\mathit{ev}_{2}$ such that ${t}$ writes $x$ at ${p}$. To make the shared variable $x$ explicit, we may use ${\mathsf{WR}}(x)$ to name the relation between $\mathit{ev}_{1}$ and $\mathit{ev}_{2}$.

• ${\mathsf{WW}}$:

relates events of two transactions that write to the same variable. More precisely, ${\mathsf{WW}}$ relates any two store events $\mathit{ev}_{1}=\mathsf{del}({p},{t}_{1})$ and $\mathit{ev}_{2}=\mathsf{del}({p},{t}_{2})$ that occur in this order in $\tau$ provided that ${t}_{1}$ and ${t}_{2}$ both write the same variable $x$, and if $\rho$ is an execution under causal convergence, then ${t}_{1}$ and ${t}_{2}$ writes $x$ at ${p}$, and ${t}_{1}<{t}_{2}$. To make the shared variable $x$ explicit, we may use ${\mathsf{WW}}(x)$ to name the relation between $\mathit{ev}_{1}$ and $\mathit{ev}_{2}$.

• ${\mathsf{RW}}$:

relates events of two distinct transactions ${t}$ and ${t}^{\prime}$ such that ${t}$ reads a value that is overwritten by ${t}^{\prime}$. Formally, ${\mathsf{RW}}(x)={\mathsf{WR}}^{-1}(x);{\mathsf{WW}}(x)$ (we use ; to denote the standard composition of relations) and ${\mathsf{RW}}=\bigcup_{x\in\mathbb{V}}{\mathsf{RW}}(x)$. If a transaction ${t}$ reads the initial value of $x$ then ${\mathsf{RW}}(x)$ relates $\mathsf{isu}({p},{t})$ with every event $\mathsf{del}({p}^{\prime},{t}^{\prime})$ with ${p}^{\prime}\in\mathbb{P}$ of any other transaction ${t}^{\prime}$ that writes to $x$ at ${p}^{\prime}$.

• ${\mathsf{STO}}$:

relates issue events with store events of the same transaction. More precisely, ${\mathsf{STO}}$ relates every event $\mathsf{isu}({p},{t})$ with every event $\mathsf{del}({p}^{\prime},{t})$ with ${p}^{\prime}\in\mathbb{P}$.

The following result states an important property of the store order relation ${\mathsf{WW}}$ that is enforced by the CCv semantics. It holds because the writes in different transactions are applied by different processes in the same order given by their timestamps, when visible (delivered) to those processes.

Lemma 1**.**

Let $\tau\in\mathbb{T}\mathsf{r}_{{\tt CCv}{}}(\mathcal{P})$ be a trace. If $(\mathsf{del}({p}_{0},{t}_{0}),\mathsf{del}({p}_{0},{t}_{1}))\in{\mathsf{WW}}(x)$, then for every other process ${p}$, $(\mathsf{del}({p},{t}_{1}),\mathsf{del}({p},{t}_{0}))\not\in{\mathsf{WW}}(x)$.

We define the happens-before relation ${\mathsf{HB}}$ as the transitive closure of the union of all the relations in the trace, i.e., ${\mathsf{HB}}=({\mathsf{PO}}\cup{\mathsf{WR}}\cup{\mathsf{WW}}\cup{\mathsf{RW}}\cup{\mathsf{STO}})^{+}$. Since we reason about only one trace at a time, we may say that a trace is simply a summary $\tau$, keeping the relations implicit. The trace of the CCv execution in Fig. 4(b) is shown on the left of Fig. 7. $\mathbb{T}\mathsf{r}(\mathcal{P})_{\textsf{X}}$ denotes the set of traces of executions of a program $\mathcal{P}$ under $\textsf{X}\in\{{\tt CCv}{},\ {\tt CM}{},\ {\tt CC}{}\}$.

For readability, we write $\mathit{ev}_{1}\rightarrow_{{\mathsf{HB}}}\mathit{ev}_{2}$ instead of $(\mathit{ev}_{1},\mathit{ev}_{2})\in{\mathsf{HB}}$ and $\mathit{ev}_{1}$ and $\mathit{ev}_{2}$ can be either $\mathsf{isu}({p},{t})$ or $\mathsf{del}({p},{t})$. We use the notation $\mathit{ev}_{1}\rightarrow_{{\mathsf{HB}}^{1}}\mathit{ev}_{2}$ (resp., $(\mathit{ev}_{1},\mathit{ev}_{2})\in{\mathsf{HB}}^{1}$) to denote $(\mathit{ev}_{1},\mathit{ev}_{2})\in({\mathsf{PO}}\cup{\mathsf{WW}}\cup{\mathsf{WR}}\cup{\mathsf{STO}}\cup{\mathsf{RW}})$.

The causal order $\mathsf{CO}$ of a trace $\mathit{tr}=(\tau,{\mathsf{PO}},{\mathsf{WR}},{\mathsf{WW}},{\mathsf{RW}},{\mathsf{STO}})$ is the transitive closure of the union of the program order, write-read relation, and the same-transaction relation, i.e., $\mathsf{CO}=({\mathsf{PO}}\cup{\mathsf{WR}}\cup{\mathsf{STO}})^{+}$. For readability, we write $\mathit{ev}_{1}\rightarrow_{\mathsf{CO}}\mathit{ev}_{2}$ instead of $(\mathit{ev}_{1},\mathit{ev}_{2})\in\mathsf{CO}$.

Let ${t}_{1}$ and ${t}_{2}$ be two transactions issued in a trace $\mathit{tr}$ that originate from two different processes ${p}_{1}$ and ${p}_{2}$, respectively. If $(\mathsf{isu}({p}_{1},{t}_{1}),\mathsf{isu}({p}_{2},{t}_{2}))\not\in\mathsf{CO}$ and $(\mathsf{isu}({p}_{2},{t}_{2}),\mathsf{isu}({p}_{1},{t}_{1}))\not\in\mathsf{CO}$, then ${t}_{1}$ and ${t}_{2}$ are called concurrent transactions.

The happens-before relation between events is extended to transactions as follows: a transaction ${t}_{1}$ happens-before another transaction ${t}_{2}\neq{t}_{1}$ if the trace $\mathit{tr}$ contains an event of transaction ${t}_{1}$ which happens-before an event of ${t}_{2}$. The happens-before relation between transactions is denoted by ${\mathsf{HB}}_{t}$ and called transactional happens-before (an example is given on the right of Fig. 7).

Remark 2**.**

The operational models of causal consistency we described are equivalent to the axiomatic models defined in [13]. These axiomatic models are defined as a set of constraints on abstractions of executions, called histories, that consist of a set of read and write operations along with a program order, denoted by ${\mathsf{PO}}^{\prime}$, and a read-from relation, denoted by ${\mathsf{WR}}^{\prime}$: ${\mathsf{PO}}^{\prime}$ relates operations in the same process and ${\mathsf{WR}}^{\prime}$ associates every read operation to the write operation which wrote the read value. For instance, the axiomatic model of CC requires that the union of ${\mathsf{PO}}^{\prime}$ and ${\mathsf{WR}}^{\prime}$ (denoted $\mathsf{CO}^{\prime}$) is acyclic444This constraint corresponds to the absence of the CyclicCO bad pattern in [13]., and its composition with a variation of the conflict relation, denoted by ${\mathsf{RW}}^{\prime}$, ($(a,b)\in{\mathsf{RW}}^{\prime}\mbox{ iff }\exists\ c.\ (c,b)\in\mathsf{CO}^{\prime}\land(c,a)\in{\mathsf{WR}}^{\prime}$555$b$ is overwriting the value $a$ is reading.) is irreflexive666This constraint corresponds to the absence of the WriteCORead bad pattern in [13].. These models can be extended easily to histories that contain transactions instead of operations by adapting the above relations. Note that every program trace (cf. Definition 2.6) can be “projected” to a history where issue and store events from the same transaction in the trace are mapped to a single transaction in the history. Also, the read-from and the program order between trace events are mapped to the ${\mathsf{WR}}^{\prime}$ and ${\mathsf{PO}}^{\prime}$ of the history.

To show equivalence between these models, it is sufficient to show that (1) every history corresponding to a trace in the operational model satisfies the constraints of the axiomatic model, and (2) every history that is valid under the axiomatic model is the “projection” of a trace of the operational model. For instance, for CC, it is easy to see that the relation $\mathsf{CO}^{\prime}={\mathsf{PO}}^{\prime}\cup{\mathsf{WR}}^{\prime}$ in a history that is the projection of a trace $\tau\in\mathbb{T}\mathsf{r}_{{\tt CC}{}}(\mathcal{P})$ is acyclic because the causal order $\mathsf{CO}$ in $\tau$ is. Also, the proof that $\mathsf{CO}^{\prime};{\mathsf{RW}}^{\prime}$ is irreflexive can be derived easily by contradiction (for instance, if $(a,b)\in{\mathsf{RW}}^{\prime}$ and $(b,a)\in\mathsf{CO}^{\prime}$, then there exists $c$ such that $(c,b)\in\mathsf{CO}^{\prime}$ which means that by causal delivery, $a$ can never read the value written by $c$).

3. Write-Write Race Freedom

We say that an execution $\rho$ has a write-write race on a shared variable $x$ if there exist two concurrent transactions ${t}_{1}$ and ${t}_{2}$ that were issued in $\rho$ and each transaction contains a write to the variable $x$. We call $\rho$ write-write race free if there is no variable $x$ such that $\rho$ has a write-write race on $x$. Also, we say a program $\mathcal{P}$ is write-write race free under a consistency semantics $\textsf{X}\in\{{\tt CCv}{},\ {\tt CM}{},\ {\tt CC}{}\}$ iff for every $\rho\in\mathbb{E}\mathsf{x}_{\textsf{X}}(\mathcal{P})$, $\rho$ is write-write race free.

We show that if a given program has a write-write race under one of the three causal consistency models then it must have a write-write race under the remaining two. The intuition behind this is that the three models coincide for programs without write-write races. Indeed, without concurrent transactions that write to the same variable, every process local valuation of a shared variable will be a singleton set under CC and no process will ever discard a write when applying an incoming transaction log under CCv.

Theorem 3**.**

Given a program $\mathcal{P}$ and two consistency semantics $\textsf{X},\textsf{Y}\in\{{\tt CCv}{},\ {\tt CM}{},\ {\tt CC}{}\}$, $\mathcal{P}$ has a write-write race under X iff $\mathcal{P}$ has a write-write race under Y.

Proof 3.1**.**

Since CC is weaker than both CCv and CM, it is sufficient to prove the following two cases: (1) if $\mathcal{P}$ has a write-write race under CC, then $\mathcal{P}$ has a write-write race under CCv and (2) if $\mathcal{P}$ has a write-write race under CC, then $\mathcal{P}$ has a write-write race under CM.

We prove the first case by induction on the number of transactions in $\mathcal{P}$. The second case can be proved in a similar way.

Base case:* $\mathcal{P}$ is constituted of two transactions ${t}_{1}$ and ${t}_{2}$. Assume that $\mathcal{P}$ has a write-write race under CC then the transactions ${t}_{1}$ and ${t}_{2}$ must originate from different processes. Thus, in any trace $\tau$ of $\mathcal{P}$ under CCv where the transactions ${t}_{1}$ and ${t}_{2}$ are executed concurrently we will have a write-write race between these two transactions. Thus, $\mathcal{P}$ has a write-write race under CCv.*

Induction step:* If $n>2$ is the number of transactions in $\mathcal{P}$, we assume that for any program $\mathcal{P}^{\prime}$ with $n^{\prime}<n$ transactions, if $\mathcal{P}^{\prime}$ has a write-write race under CC, then $\mathcal{P}^{\prime}$ has a write-write race under CCv. Assume that $\mathcal{P}$ has a write-write race under CC. Let $\tau$ be a trace of $\mathcal{P}$ under CC where we have a write-write race between two transactions ${t}_{1}$ and ${t}_{2}$ that were issued by processes ${p}_{1}$ and ${p}_{2}$, respectively. Executing ${t}_{1}$ and ${t}_{2}$ concurrently while writing to a common variable is not possible under CCv only if the writes were enabled by some events that occurred before ${t}_{1}$ and ${t}_{2}$ under CC and are not possible under CCv. However, based on the semantic models of both CC and CCv, if all the transactions that write to common variables are causally related then such events cannot occur under CC but not CCv. Thus, we must have two other transactions ${t}^{\prime}_{1}$ and ${t}^{\prime}_{2}$ of $\mathcal{P}$ that were executed concurrently in $\tau$ under CC and occurred before ${t}_{1}$ (or ${t}_{2}$ or both) which write to a common variable. Without loss of generality, let $\mathcal{P}_{1}$ be the program resulting from removing the transaction ${t}_{1}$ from $\mathcal{P}$. We know that $\mathcal{P}_{1}$ admits a trace $\tau_{1}$ under CC where the transactions ${t}^{\prime}_{1}$ and ${t}^{\prime}_{2}$ are involved in a data race. Also, the size of $\mathcal{P}_{1}$ is $n-1<n$. Thus, from the induction hypothesis we get that $\mathcal{P}_{1}$ has a write-write race under CCv. Because adding a new transaction to $\mathcal{P}_{1}$ will not eliminate existing data races, $\mathcal{P}$ has a write-write race under CCv as well.*

The following result shows that indeed, the three causal consistency models coincide for programs which are write-write race free under any one of these three models.

Theorem 4**.**

Let $\mathcal{P}$ be a program. Then, $\mathbb{E}\mathsf{x}_{{\tt CC}{}}(\mathcal{P})=\mathbb{E}\mathsf{x}_{{\tt CCv}{}}(\mathcal{P})=\mathbb{E}\mathsf{x}_{{\tt CM}{}}(\mathcal{P})$ iff $\mathcal{P}$ has no write-write race under neither CC, CM, and CCv.

Proof 3.2**.**

Left-to-right direction: By Theorem 3, it is sufficient to prove that $\mathcal{P}$ has no write-write race under CM. Suppose by contradiction that $\mathcal{P}$ has a write-write race under CM. Then, there must exist a trace $\tau\in\mathbb{T}\mathsf{r}_{{\tt CC}{}}(\mathcal{P})$ such that we have two concurrent transactions ${t}_{1}$ and ${t}_{2}$ that are issued in $\tau$ and write to a variable $x$. Assume w.l.o.g that the issue event of ${t}_{1}$ occurs before the issue event of ${t}_{2}$ in $\tau$. Since ${t}_{1}$ and ${t}_{2}$ are concurrent in $\tau$, the issue event of ${t}_{1}$ and the store events of ${t}_{2}$ are commutative, and the issue event of ${t}_{2}$ and the store events of ${t}_{1}$ are commutative. Then, $\tau^{\prime}=\alpha\cdot\mathsf{isu}({p}_{1},{t}_{1})\cdot\mathsf{del}({p}_{1},{t}_{1})\cdot\beta\cdot\mathsf{isu}({p}_{2},{t}_{2})\cdot\mathsf{del}({p}_{2},{t}_{2})\cdot\mathsf{del}({p}_{1},{t}_{2})\cdot\mathsf{del}({p}_{2},{t}_{1})$ where $\alpha$ and $\beta$ are sequences of events in $\tau$ that ${t}_{1}$ and ${t}_{2}$ causally depend on (since we are not interested in other events)777Note that other cases such as $\tau^{\prime}=\alpha\cdot\mathsf{isu}({p}_{1},{t}_{1})\cdot\beta\cdot\mathsf{isu}({p}_{2},{t}_{2})\cdot\mathsf{del}({p}_{2},{t}_{2})\cdot\mathsf{del}({p}_{1},{t}_{2})\cdot\mathsf{del}({p}_{1},{t}_{1})$ implies that $\tau^{\prime\prime}=\alpha\cdot\mathsf{isu}({p}_{1},{t}_{1})\cdot\mathsf{del}({p}_{1},{t}_{1})\cdot\beta\cdot\mathsf{isu}({p}_{2},{t}_{2})\cdot\mathsf{del}({p}_{2},{t}_{2})\cdot\mathsf{del}({p}_{1},{t}_{2})\cdot\mathsf{del}({p}_{2},{t}_{1})$ is a trace of $\mathcal{P}$ as well since all events in $\beta$ are not causally dependent on ${t}_{1}$., is a trace of $\mathcal{P}$ under CM. In $\tau^{\prime}$, both store events $\mathsf{del}({p}_{2},{t}_{1})$ and $\mathsf{del}({p}_{1},{t}_{2})$ do not discard any writes (guaranteed under CM). Therefore, $(\mathsf{del}({p}_{1},{t}_{1}),\mathsf{del}({p}_{1},{t}_{2}))\in{\mathsf{WW}}(x)$ and $(\mathsf{del}({p}_{2},{t}_{2}),\mathsf{del}({p}_{2},{t}_{1}))\in{\mathsf{WW}}(x)$ since both ${t}_{1}$ and ${t}_{2}$ write to $x$. However, it is impossible to obtain $\tau^{\prime}$ under CCv as we cannot have $(\mathsf{del}({p}_{2},{t}_{2}),\mathsf{del}({p}_{2},{t}_{1}))\in{\mathsf{WW}}(x)$ if $(\mathsf{del}({p}_{1},{t}_{1}),\mathsf{del}({p}_{1},{t}_{2}))\in{\mathsf{WW}}(x)$ which leads to a contradiction ($\mathcal{P}$ has different sets of traces under CM and CCv).

Right-to-left direction: It is sufficient to prove the following two cases: if $\tau$ has no write-write race under CC then $\tau\in\mathbb{T}\mathsf{r}_{{\tt CC}{}}$ implies $\tau\in\mathbb{T}\mathsf{r}_{{\tt CM}{}}$ and $\tau\in\mathbb{T}\mathsf{r}_{{\tt CCv}{}}$ ($\mathbb{T}\mathsf{r}_{{\tt CCv}{}}(\mathcal{P})\subseteq\mathbb{T}\mathsf{r}_{{\tt CC}{}}(\mathcal{P})$ and $\mathbb{T}\mathsf{r}_{{\tt CM}{}}(\mathcal{P})\subseteq\mathbb{T}\mathsf{r}_{{\tt CC}{}}(\mathcal{P})$ hold by definition).

Let $\tau\in\mathbb{T}\mathsf{r}_{{\tt CC}{}}$ be a trace under CC. Then, $\tau$ satisfies transactions isolation and causal delivery. It is important to notice that if $\tau$ has no write-write race then the contents of $store$ at a given variable will contain a single value at any time during $\tau$. This implies that $store$ can be simulated by a single value memory which does not discard writes. Thus, we obtain a program semantics that is the same as the one for CM. Thus, $\tau$ is also a trace of $\mathcal{P}$ under CM. To prove that $\tau\in\mathbb{T}\mathsf{r}_{{\tt CCv}{}}$, we also need to ensure that the transitive closure of store order in $\tau$ is acyclic which is enough to guarantee the existence of a total arbitration between transactions which is ensured by CCv semantics. Suppose by contradiction that the transitive closure of store order is cyclic then there must exist a sequence of events $\mathit{ev}_{1}\cdot\mathit{ev}_{2}\cdot\ldots\mathit{ev}_{n}$ in $\tau$ such that $(\mathit{ev}_{i},\mathit{ev}_{i+1})\in{\mathsf{WW}}$, for all $1\leq i\leq n-1$ and $(\mathit{ev}_{n},\mathit{ev}_{1})\in{\mathsf{WW}}$. Since $\tau$ has no write-write races then $(\mathit{ev}_{i},\mathit{ev}_{i+1})\in{\mathsf{WW}}$ implies that the issue events corresponding to $\mathit{ev}_{i}$ and $\mathit{ev}_{i+1}$ must be related by causal ordered (since the corresponding transactions must be causally related to prevent concurrency which will lead to write-write races for transactions that write to a common variable). For all $i$ s.t. $1\leq i\leq n-1$, let $\mathit{ev}^{\prime}_{i}$ and $\mathit{ev}^{\prime}_{i+1}$ denote these issue events then $(\mathit{ev}^{\prime}_{i},\mathit{ev}^{\prime}_{i+1})\in\mathsf{CO}$ which implies that the causal order $\mathsf{CO}$ is cyclic. This is a contradiction since it is not possible under CC. Thus, there exists a total order between transactions in $\tau$ that includes both the causal order and the transitive closure of store order. Thus, $\tau$ is also a trace of $\mathcal{P}$ under CCv.

4. Program Robustness

4.1. Program Semantics Under Serializability

The semantics of a program under serializability [37] can be defined using a transition system where the configurations keep a single shared-variable valuation (accessed by all processes) with the standard interpretation of read or write statements. Each transaction executes in isolation. Alternatively, the serializability semantics can be defined as a restriction of $[\mathcal{P}]_{\textsf{X}}$, $\textsf{X}\in\{{\tt CCv}{},\ {\tt CM}{},\ {\tt CC}{}\}$, to the set of executions where each transaction is immediately delivered to all processes, i.e., each event $\mathsf{end}({p},{t})$ is immediately followed by all $\mathsf{del}({p}^{\prime},{t})$ with ${p}^{\prime}\in\mathbb{P}$. Such executions are called serializable and the set of serializable executions of a program $\mathcal{P}$ is denoted by $\mathbb{E}\mathsf{x}_{{\tt SER}{}}(\mathcal{P})$. The latter definition is easier to reason about when relating executions under causal consistency and serializability, respectively.

Given a trace $\mathit{tr}=(\tau,{\mathsf{PO}},{\mathsf{WR}},{\mathsf{WW}},{\mathsf{RW}},{\mathsf{STO}})$ of a serializable execution, we have that every event $\mathsf{isu}({p},{t})$ in $\tau$ is immediately followed by all $\mathsf{del}({p}^{\prime},{t})$ with ${p}^{\prime}\in\mathbb{P}$. For simplicity, we write $\tau$ as a sequence of “atomic macro-events” $({p},{t})$ where $({p},{t})$ denotes a sequence $\mathsf{isu}({p},{t})\cdot\mathsf{del}({p},{t})\cdot\mathsf{del}({p}_{1},{t})\cdot\ldots\cdot\mathsf{del}({p}_{n},{t})$ with $\mathbb{P}=\{{p},{p}_{1},\ldots,{p}_{n}\}$. We say that ${t}$ is atomic. In Fig. 7, ${t}3$ is atomic and we can use $({p}2,{t}3)$ instead of $\mathsf{isu}({p}2,{t}3)\cdot\mathsf{del}({p}2,{t}3)\cdot\mathsf{del}({p}1,{t}3)$.

The following result characterizes traces of serializable executions, and follows from previous works [2, 41] that considered a notion of history/trace that corresponds to our notion of transactional happens-before. The transactional happens-before of any trace under ${\tt SER}{}$ is acyclic, and conversely, any trace obtained under a weaker semantics $\textsf{X}\in\{{\tt CCv}{},\ {\tt CM}{},\ {\tt CC}{}\}$ with an acyclic transactional happens-before can be transformed into a trace under ${\tt SER}{}$ by successive swaps of consecutive events in its summary, which are not related by happens-before (the happens-before relations remain the same). Indeed, note that multiple executions/traces can have the same (transactional) happens-before (an example for traces is given in Fig. 8). In particular, it is possible that a trace $\mathit{tr}$ produced by a variation of causal consistency has an acyclic transactional happens-before even though $\mathsf{isu}({p},{t})$ events are not immediately followed by the corresponding $\mathsf{del}({p}^{\prime},{t})$ events. However, $\mathit{tr}$ would be equivalent, up to reordering of consecutive summary events that are not related by happens-before to a serializable trace.

{thmC}

[[2, 41]] For any trace $\mathit{tr}\in\mathbb{T}\mathsf{r}_{{\tt SER}{}}(\mathcal{P})$, the transactional happens-before of $\mathit{tr}$ is acyclic. Moreover, for any trace $\mathit{tr}=(\tau,{\mathsf{PO}},{\mathsf{WR}},{\mathsf{WW}},{\mathsf{RW}},{\mathsf{STO}})\in\mathbb{T}\mathsf{r}_{\textsf{X}}(\mathcal{P})$ with $\textsf{X}\in\{{\tt CCv}{},\ {\tt CM}{},\ {\tt CC}{}\}$, if the transactional happens-before of $\mathit{tr}$ is acyclic, then there exists a permutation $\tau^{\prime}$ of $\tau$ such that $(\tau^{\prime},{\mathsf{PO}},{\mathsf{WR}},{\mathsf{WW}},{\mathsf{RW}},{\mathsf{STO}})\in\mathbb{T}\mathsf{r}_{{\tt SER}{}}(\mathcal{P})$.

As a consequence of Theorem 4.1, we define a trace $\mathit{tr}$ to be serializable if it has the same happens-before relations as a trace of a serializable execution. Let $\mathbb{T}\mathsf{r}_{{\tt SER}{}}(\mathcal{P})$ denote the set of serializable traces of a program $\mathcal{P}$.

4.2. Robustness Problem

We consider the problem of checking whether the causally-consistent semantics of a program produces only serializable traces (it produces all serializable traces because every issue event can be immediately followed by all the corresponding store events). {defi} A program $\mathcal{P}$ is called robust against a semantics $\textsf{X}\in\{{\tt CCv}{},\ {\tt CM}{},\ {\tt CC}{}\}$ iff $\mathbb{T}\mathsf{r}_{\textsf{X}}(\mathcal{P})=\mathbb{T}\mathsf{r}_{{\tt SER}{}}(\mathcal{P})$.

A trace $\mathit{tr}\in\mathbb{T}\mathsf{r}_{\textsf{X}}(\mathcal{P})\setminus\mathbb{T}\mathsf{r}_{{\tt SER}{}}(\mathcal{P})$ is called a robustness violation (or violation, for short). By Theorem 4.1, the transactional happens-before ${\mathsf{HB}}_{t}$ of $\mathit{tr}$ is cyclic.

We discuss several examples of programs which are (non-) robust against both CM and CCv or only one of them. Robustness violations are presented in terms of “observable” behaviors, tuples of values that can be read in the different transactions and that are not possible under the serializability semantics (they correspond to traces with acyclic transactional happens-before). Fig. 9(a) and Fig. 9(b) show examples of programs that are not robust against both CM and CCv, which have also been discussed in the literature on weak memory models, e.g. [6]. The execution of Lost Update under both CM and CCv allows that the two reads of ${\tt x}$ in transactions ${t}1$ and ${t}2$ return [math] although this cannot happen under serializability. Also, executing Store Buffering under both CM and CCv allows that the reads of ${\tt x}$ and ${\tt y}$ return [math] although this would not be possible under serializability. These values are possible because the transaction in each of the processes may not be delivered to the other process.

Assuming for the moment that each instruction in Fig. 9(c) and Fig. 9(d) forms a different transaction, the values we give in comments show that the program in Fig. 9(c), resp., Fig. 9(d), is not robust against CCv, resp., CM. The values in Fig. 9(c) are possible assuming that the timestamp of the transaction ${\tt[x=1]}$ is smaller than the timestamp of ${\tt[x=2]}$ (which means that if the former is delivered after the second process executes ${\tt[x=2]}$, then it will be discarded). Moreover, enlarging the transactions as shown in Fig. 9(c), the program becomes robust against CCv. The values in Fig. 9(d) are possible under CM because different processes do not need to agree on the order in which to apply transactions, each process applying the transaction received from the other process last. However, under CCv this behavior is not possible, the program being actually robust against CCv. As in the previous case, enlarging the transactions as shown in the figure leads to a robust program against CM.

We end the discussion with several examples of programs that are robust against both CM and CCv. These are simplified models of real applications reported in [27]. The program in Fig. 9(e) can be understood as the parallel execution of two processes that either create a new user of some service, represented abstractly as a write on a variable ${\tt x}$ or check its credentials, represented as a read of ${\tt x}$ (the non-deterministic choice abstracts some code that checks whether the user exists). Clearly this program is robust against both CM and CCv since each process does a single access to the shared variable. Although we considered simple transactions that access a single shared-variable this would hold even for “bigger” transactions that access an arbitrary number of variables. The program in Fig. 9(f) can be thought of as a process creating a new user of some service and reading some additional data in parallel to a process that updates that data only if the user exists. It is rather easy to see that it is also robust against both CM and CCv.

5. Minimal Violations

We define a class of robustness violations called minimal violations. The particular shapes of these violations, that we determine through a series of results in this section, Section 6, and Section 7, enables a polynomial-time reduction of robustness checking to a reachability problem in a program running under serializability.

For simplicity, we use “atomic macro-events” $({p},{t})$ even in traces obtained under causal consistency (recall that this notation was introduced to simplify serializable traces), i.e., we assume that any sequence of events formed of an issue $\mathsf{isu}({p},{t})$ followed immediately by all the store events $\mathsf{del}({p}^{\prime},{t})$ is replaced by $({p},{t})$. Then, all the relations that held between an event $\mathit{ev}$ of such a sequence and another event $\mathit{ev}^{\prime}$, e.g., $(\mathit{ev},\mathit{ev}^{\prime})\in{\mathsf{PO}}$, are defined to hold as well between the corresponding macro-event $({p},{t})$ and $\mathit{ev}^{\prime}$, e.g, $(({p},{t}),\mathit{ev}^{\prime})\in{\mathsf{PO}}$.

5.1. Happens-Before Through Relation

To decide if two events in a trace are “independent” (or commutative) we use the information about the existence of a happens-before relation between the events. If two events are not related by happens-before then they can be swapped while preserving the same happens-before. Thus, we extend the happens-before relation to obtain the happens-before through relation as follows:

{defi}

Let $\tau=\alpha\cdot a\cdot\beta\cdot b\cdot\gamma$ be a trace where $a$ and $b$ are events (or atomic macro events), and $\alpha$, $\beta$, and $\gamma$ are sequences of events (or atomic macro events) under a semantics $\textsf{X}\in\{{\tt CCv}{},\ {\tt CM}{}\}$. We say that $a$ happens-before $b$ through $\beta$ if there is a non empty sub-sequence $c_{1}\cdots c_{n}$ of $\beta$ that satisfies:

[TABLE]

where $c_{0}=a$, $c_{n+1}=b$.

The following result shows that any two events in a trace which are not related via the happens-before through relation can be reordered without affecting the happens-before or they can be placed one immediately after the other.

Lemma 5**.**

Let $\tau$ be a trace of a program $\mathcal{P}$ under a semantics $\textsf{X}\in\{{\tt CCv}{},\ {\tt CM}{}\}$, and $a$ and $b$ be two events such that $\tau=\alpha\cdot a\cdot\beta\cdot b\cdot\gamma$. Then, one of the following holds:

1. (1)

$a$* happens-before $b$ through $\beta$;* 2. (2)

$\tau^{\prime}=\alpha\cdot\beta_{1}\cdot a\cdot b\cdot\beta_{2}\cdot\gamma\in\mathbb{T}\mathsf{r}_{\textsf{X}}(\mathcal{P})$* where $(a,b)\in{\mathsf{HB}}^{1}$ has the same happens-before as $\tau$;* 3. (3)

$\tau^{\prime}=\alpha\cdot\beta_{1}\cdot b\cdot a\cdot\beta_{2}\cdot\gamma\in\mathbb{T}\mathsf{r}_{\textsf{X}}(\mathcal{P})$* has the same happens-before as $\tau$.*

Proof 5.1**.**

We prove that $\neg(1)\Rightarrow((2)\ \mathsf{or}\ (3))$ using induction on the size of $\beta$.

Base case:* If $|{\beta}|=0$, then $\tau=\alpha\cdot a\cdot b\cdot\gamma$, which implies that $a$ does not happen-before $b$ through $\beta$ (by definition, $\beta$ cannot be empty). Thus, either $a$ and $b$ are ${\mathsf{HB}}^{1}$-related, which corresponds to $(2)$, or $a$ and $b$ are not ${\mathsf{HB}}^{1}$-related, which implies that $b$ can move to the left of $a$ producing the trace $\tau^{\prime}=\alpha\cdot b\cdot a\cdot\gamma$ that has the same happens-before as $\tau$ and that corresponds to $(3)$.*

Induction step:* We assume that the lemma holds for $|{\beta}|\leq n$. Consider $\tau_{n+1}=\alpha\cdot a\cdot\beta\cdot b\cdot\gamma$ with $|{\beta}|=n+1$. Consider $c$ the last event in the sequence $\beta=\beta_{1}\cdot c$. If $a$ does not happen before $b$ through $\beta$, then either $a$ does not happen before $c$ through $\beta_{1}$ and $a$ and $c$ are not ${\mathsf{HB}}^{1}$-related, or $c$ and $b$ are not ${\mathsf{HB}}^{1}$-related.*

First case: suppose that $a$ does not happen before $c$ through $\beta_{1}$ and $a$ and $c$ are not ${\mathsf{HB}}^{1}$-related. Using the induction hypothesis over $\tau_{n+1}$ with respect to $a$ and $c$ (since $|{\beta_{1}}|\leq n$) results in $\tau^{\prime}_{n+1}=\alpha\cdot\beta_{11}\cdot c\cdot a\cdot\beta_{12}\cdot b\cdot\gamma$ that has the same happens-before as $\tau_{n+1}$. We know that if $a$ happens-before $b$ through $\beta_{12}$ then $a$ happens-before $b$ through $\beta$ because $\beta_{12}$ is a subset of $\beta$. Therefore, $a$ does not happen-before $b$ through $\beta_{12}$. Since $|{\beta_{12}}|\leq|{\beta_{1}}|\leq n$, then we can apply the induction hypothesis to $\tau^{\prime}_{n+1}$ with respect to $a$ and $b$ which yields either $\tau^{\prime\prime}_{n+1}=\alpha\cdot\beta_{11}\cdot c\cdot\beta_{121}\cdot b\cdot a\cdot\beta_{122}\cdot\gamma$ which has the same happens-before as $\tau^{\prime}_{n+1}$, if $a$ and $b$ are not ${\mathsf{HB}}^{1}$-related, or $\tau^{\prime\prime}_{n+1}=\alpha\cdot\beta_{11}\cdot c\cdot\beta_{121}\cdot a\cdot b\cdot\beta_{122}\cdot\gamma$ which has the same happens-before as $\tau^{\prime}_{n+1}$, otherwise.

Second case: suppose $c$ and $b$ are not ${\mathsf{HB}}^{1}$-related. We apply the induction hypothesis to $\tau_{n+1}$ with respect to $c$ and $b$, and we get $\tau^{\prime}_{n+1}=\alpha\cdot a\cdot\beta_{1}\cdot b\cdot c\cdot\gamma$ with the same happens-before as $\tau_{n+1}$. As we already know that $a$ does not happen before $b$ through $\beta$ then $a$ does not happen before $b$ through $\beta_{1}$. Subsequently by using the induction hypothesis over $\tau^{\prime}_{n+1}$ with respect to $a$ and $b$, we obtain $\tau^{\prime\prime}_{n+1}=\alpha\cdot\beta_{11}\cdot b\cdot a\cdot\beta_{12}\cdot c\cdot\gamma$ where $\tau^{\prime\prime}_{n+1}$ has the same happens-before as $\tau_{n+1}^{\prime}$, if $a$ and $b$ are not ${\mathsf{HB}}^{1}$-related, or $\tau^{\prime\prime}_{n+1}=\alpha\cdot\beta_{11}\cdot a\cdot b\cdot\beta_{12}\cdot c\cdot\gamma$ where $\tau^{\prime\prime}_{n+1}$ has the same happens-before as $\tau_{n+1}^{\prime}$, otherwise.

We show next that a robustness violation should contain at least an issue and a store event of the same transaction that are separated by another event that occurs after the issue and before the store and which is related to both via the happens-before relation. Otherwise, since any two events which are not related by happens-before could be swapped in order to derive a trace with the same happens-before, every store event could be swapped until it immediately follows the corresponding issue and the trace would be serializable.

Lemma 6**.**

Given a violation $\tau$, there must exist a transaction ${t}$ such that $\tau=\alpha\cdot\mathsf{isu}({p},{t})\cdot\beta\cdot\mathsf{del}({p}_{0},{t})\cdot\gamma$ and $\mathsf{isu}({p},{t})$ happens-before $\mathsf{del}({p}_{0},{t})$ through $\beta$.

Proof 5.2**.**

Assume by contradiction that the lemma does not hold. For every transaction ${t}$ of $\tau$ suppose there exist ${p}^{\prime}\in\mathbb{P}$ such that $\mathsf{del}({p}^{\prime},{t})$ does not occur immediately after $\mathsf{isu}({p},{t})$. Thus, $\tau=\alpha\cdot\mathsf{isu}({p},{t})\cdot\beta\cdot\mathsf{del}({p}^{\prime},{t})\cdot\gamma$, and $(\mathsf{isu}({p},{t}),\mathsf{del}({p}^{\prime},{t}))\in{\mathsf{STO}}\subset{\mathsf{HB}}^{1}$. From Lemma 5, $\tau^{\prime}=\alpha\cdot\beta_{1}\cdot\mathsf{isu}({p},{t})\cdot\mathsf{del}({p}^{\prime},{t})\cdot\beta_{2}\cdot\gamma$ has the same happens-before as $\tau$ (since $\mathsf{isu}({p},{t})$ does not happens-before $\mathsf{del}({p}^{\prime},{t})$ through $\beta$). Then, the trace $\tau^{*}$ where for every transaction ${t}$ of $\tau$ the store events occur immediately after the issue event has the same happens-before as $\tau$. Thus, $\tau^{*}$ is serializable which means that its ${\mathsf{HB}}_{t}$ is acyclic which contradicts the fact that $\tau$ is a violation.

The transaction ${t}$ in the trace $\tau$ above is called a delayed transaction. The happens-before constraints imply that ${t}$ belongs to a transactional happens-before cycle in the trace. In the remainder of the paper, when given a violation $\tau=\alpha\cdot\mathsf{isu}({p},{t})\cdot\beta\cdot\mathsf{del}({p}_{0},{t})\cdot\gamma$, we assume that ${t}$ is the first delayed transaction in $\tau$.

5.2. Minimal Violations

Given a trace $\tau=\alpha\cdot b\cdot\beta\cdot c\cdot\omega$ containing two events $b=\mathsf{isu}({p},{t})$ and $c$, the distance between $b$ and $c$, denoted by $d_{\tau}(b,c)$, is the number of events in $\beta$ that are causally related to $b$, excluding events that correspond to the delivery of ${t}$, i.e., d_{\tau}(b,c)=|{\{d\in\beta\ |\ (b,d)\in\mathsf{CO}\ \land d\neq\mathsf{del}({p}^{\prime},{t})\mbox{ for every {p}^{\prime}\in\mathbb{P}}\}}|

The number of delays $\#(\tau)$ in a trace $\tau$ is the sum of all distances between issue and store events that originate from the same transaction:

[TABLE]

{defi}

[Minimal Violation] A robustness violation $\tau$ is called minimal if it has the least number of delays among all robustness violations (for a given program $\mathcal{P}$ and semantics $\textsf{X}\in\{{\tt CC}{},\ {\tt CCv}{},\ {\tt CM}{}\}$).

Remark 7**.**

It is important to note that a non-robust program can admit multiple minimal violations with different happens-before relations. For instance, Fig. 10 pictures two minimal violations that do not have the same happens-before and both traces have 0 delays. In the trace in Fig. 10(b) a single transaction is delayed while in the trace in Fig. 10(c) two transactions are delayed and are not causally related. For the trace $\tau_{1}$ in Fig. 10(b), we have that $\#(\tau_{1})=d_{\tau_{1}}(\mathsf{isu}({p}2,{t}2),\mathsf{del}({p}2,{t}2))+d_{\tau_{1}}(\mathsf{isu}({p}2,{t}2),\mathsf{del}({p}3,{t}2))=0$. For the trace $\tau_{2}$ in Fig. 10(c), we have that $\#(\tau_{2})=d_{\tau_{2}}(\mathsf{isu}({p}1,{t}1),\mathsf{del}({p}1,{t}1))+d_{\tau_{2}}(\mathsf{isu}({p}1,{t}1),\mathsf{del}({p}3,{t}1))+d_{\tau_{2}}(\mathsf{isu}({p}2,{t}2),\mathsf{del}({p}3,{t}2))=0$. Hence, the number of delays for both cases is 0.

Given a minimal violation $\tau=\alpha\cdot\mathsf{isu}({p},{t})\cdot\beta\cdot\mathsf{del}({p}_{0},{t})\cdot\gamma$, the following lemma shows that we can assume w.l.o.g. that $\gamma$ contains only store events from transactions that were issued before $\mathsf{del}({p}_{0},{t})$ in $\tau$.

Lemma 8**.**

Let $\tau=\alpha\cdot\mathsf{isu}({p},{t})\cdot\beta\cdot\mathsf{del}({p}_{0},{t})\cdot\gamma$ be a minimal violation such that $\mathsf{isu}({p},{t})$ happens-before $\mathsf{del}({p}_{0},{t})$ through $\beta$. Then, $\tau^{\prime}=\alpha\cdot\mathsf{isu}({p},{t})\cdot\beta\cdot\mathsf{del}({p}_{0},{t})\cdot\gamma^{\prime}$, such that $\gamma^{\prime}$ contains only store events from transactions that were issued before $\mathsf{del}({p}_{0},{t})$ in $\tau$, is also a minimal violation.

Proof 5.3**.**

The prefix $\alpha\cdot\mathsf{isu}({p},{t})\cdot\beta\cdot\mathsf{del}({p}_{0},{t})$ has a cyclic transactional happens-before and it is already a minimal violation independently of whether $\gamma$ contains additional transactions.

The following result shows that for every minimal violation, we can extract another minimal violation of the shape $\tau=\alpha\cdot\mathsf{isu}({p},{t})\cdot\beta\cdot({p}^{\prime},{t}^{\prime})\cdot\mathsf{del}({p}^{\prime},{t})\cdot\gamma$ such that $(\mathsf{isu}({p},{t}),({p}^{\prime},{t}^{\prime}))\in{\mathsf{HB}}$, and $(({p}^{\prime},{t}^{\prime}),\mathsf{del}({p}^{\prime},{t}))\in{\mathsf{HB}}^{1}$.

Lemma 9**.**

If $\mathcal{P}$ is a program that is not robust against some $\textsf{X}\in\{{\tt CCv}{},\ {\tt CM}{},\ {\tt CC}{}\}$, then its set of traces under the semantics X must admit a minimal violation of the shape $\tau=\alpha\cdot\mathsf{isu}({p},{t})\cdot\beta\cdot({p}^{\prime},{t}^{\prime})\cdot\mathsf{del}({p}^{\prime},{t})\cdot\gamma$ such that $(\mathsf{isu}({p},{t}),({p}^{\prime},{t}^{\prime}))\in{\mathsf{HB}}$ and $(({p}^{\prime},{t}^{\prime}),\mathsf{del}({p}^{\prime},{t}))\in{\mathsf{HB}}^{1}$.

Proof 5.4**.**

Let $\tau=\alpha\cdot\mathsf{isu}({p},{t})\cdot\beta\cdot\mathsf{del}({p}_{0},{t})\cdot\gamma$ be a minimal violation of $\mathcal{P}$, such that $\mathsf{isu}({p},{t})$ happens-before $\mathsf{del}({p}_{0},{t})$ through $\beta$. By Lemma 8, we assume that $\gamma$ contains only store events. We prove by induction on the size of $\beta$ that $\mathcal{P}$ admits another minimal violation against X of the form $\tau^{\prime}=\alpha^{\prime}\cdot\mathsf{isu}({p}_{1},{t}_{1})\cdot\beta^{\prime}\cdot({p}_{2},{t}_{2})\cdot\mathsf{del}({p}_{2},{t}_{1})\cdot\gamma^{\prime}$ such that $(\mathsf{isu}({p}_{1},{t}_{1}),({p}_{2},{t}_{2}))\in{\mathsf{HB}}$, $(({p}_{2},{t}_{2}),\mathsf{del}({p}_{2},{t}_{1}))\in{\mathsf{HB}}^{1}$, and $\tau^{\prime}$ is a permutation of a subsequence of $\tau$.

Note that $\mathsf{isu}({p},{t})$ happens-before $\mathsf{del}({p}_{0},{t})$ through $\beta$ implies that there exists a sub-sequence $c_{1}\cdots c_{n}$ of $\beta$ that satisfies: $c_{i}\rightarrow_{{\mathsf{HB}}^{1}}c_{i+1}\quad\text{ for all }i\in[0,n]$ where $c_{0}=\mathsf{isu}({p},{t})$, $c_{n+1}=\mathsf{del}({p}_{0},{t})$. Then, we have three possibilities for $c_{n}$: $({p}^{\prime},{t}^{\prime})$, $\mathsf{isu}({p}^{\prime},{t}^{\prime})$, or $\mathsf{del}({p}_{0},{t}^{\prime})$.

Base case:* $|{\beta}|=1$ implies that $\beta=c_{n}$. If $c_{n}=({p}^{\prime},{t}^{\prime})$ then $\tau$ is a minimal violation s.t. $\mathsf{isu}({p},{t})\rightarrow_{{\mathsf{HB}}}({p}^{\prime},{t}^{\prime})$ and $({p}^{\prime},{t}^{\prime})\rightarrow_{{\mathsf{HB}}^{1}}\mathsf{del}({p}_{0},{t})$. If $c_{n}=\mathsf{isu}({p}^{\prime},{t}^{\prime})$ then we regroup together the issue event $\mathsf{isu}({p}^{\prime},{t}^{\prime})$ with its store events obtaining $\tau^{\prime}=\alpha\cdot\mathsf{isu}({p},{t})\cdot({p}^{\prime},{t}^{\prime})\cdot\mathsf{del}({p}_{0},{t})\cdot\gamma^{\prime}$ to be a minimal violation as well (since the transactional happens-before of the trace resulting from reordering store events in $\mathsf{del}({p}_{0},{t})\cdot\gamma^{\prime}$ will always be cyclic). Since $({p}^{\prime},{t}^{\prime})\rightarrow_{{\mathsf{HB}}^{1}}\mathsf{del}({p}_{0},{t})$ implies that $({p}^{\prime},{t}^{\prime})\rightarrow_{{\mathsf{HB}}^{1}}\mathsf{del}({p}^{\prime},{t})\in\gamma$, then $\tau^{\prime\prime}=\alpha\cdot\mathsf{isu}({p},{t})\cdot({p}^{\prime},{t}^{\prime})\cdot\mathsf{del}({p}^{\prime},{t})\cdot\gamma^{\prime\prime}$, where the two store events $\mathsf{del}({p}^{\prime},{t})$ and $\mathsf{del}({p}^{\prime},{t})$ are reordered, is a minimal violation. $c_{n}=\mathsf{del}({p}_{0},{t}^{\prime})$ is not possible since ${t}$ is the first delayed transaction in $\tau$.*

Induction step:* We assume that the induction hypothesis holds for $|{\beta}|\leq m$. The case $c_{n}=({p}^{\prime},{t}^{\prime})$ is trivial. If $c_{n}=\mathsf{isu}({p}^{\prime},{t}^{\prime})$ then removing the issue events that occur after $c_{n}$ will not impact the happens-before. Thus, we remove every issue and atomic marco event that occurs after $\mathsf{isu}({p}^{\prime},{t}^{\prime})$ with all their store events and regroup together the event $\mathsf{isu}({p}^{\prime},{t}^{\prime})$ with its store events obtaining $\tau^{\prime}=\alpha\cdot\mathsf{isu}({p},{t})\cdot\beta^{\prime}\cdot({p}^{\prime},{t}^{\prime})\cdot\mathsf{del}({p}_{0},{t})\cdot\gamma^{\prime}$ to be a minimal violation. Similar to before, $\tau^{\prime\prime}=\alpha\cdot\mathsf{isu}({p},{t})\cdot\beta^{\prime}\cdot({p}^{\prime},{t}^{\prime})\cdot\mathsf{del}({p}^{\prime},{t})\cdot\gamma^{\prime\prime}$ is a minimal violation.*

If $c_{n}=\mathsf{del}({p}_{0},{t}^{\prime})$, then the corresponding issue event $\mathsf{isu}({p}^{\prime},{t}^{\prime})$ must occur in $\beta$ ($\alpha$ contains only atomic macro events because ${t}$ is the first delayed transaction). If $\mathsf{isu}({p}^{\prime},{t}^{\prime})$ does not happen before $\mathsf{del}({p}_{0},{t}^{\prime})$ (or any store event of ${t}^{\prime}$ in $\beta\cdot\mathsf{del}({p}_{0},{t})\cdot\gamma$) through a subsequence of $\beta$ (resp., $\beta\cdot\mathsf{del}({p}_{0},{t})\cdot\gamma$) then we can regroup together the issue and store events of ${t}^{\prime}$ and get that $\tau^{\prime}=\alpha\cdot\mathsf{isu}({p},{t})\cdot\beta^{\prime}\cdot({p}^{\prime},{t}^{\prime})\cdot\beta^{\prime\prime}\cdot\mathsf{del}({p}_{0},{t})\cdot\gamma^{\prime}$ is a minimal violation. Otherwise, if $\mathsf{isu}({p}^{\prime},{t}^{\prime})$ happens-before $\mathsf{del}({p}_{0},{t}^{\prime})$ through a subsequence of $\beta$, then $\tau$ can be written as $\tau=\alpha\cdot\mathsf{isu}({p},{t})\cdot\beta_{1}\cdot\mathsf{isu}({p}^{\prime},{t}^{\prime})\cdot\beta_{2}\cdot\mathsf{del}({p}_{0},{t}^{\prime})\cdot\beta_{3}\cdot\mathsf{del}({p}_{0},{t})\cdot\gamma$. Note that if there exists an issue event $\mathsf{isu}({p}_{1},{t}_{1})$ in $\beta_{1}\cdot\mathsf{isu}({p}^{\prime},{t}^{\prime})\cdot\beta_{2}$ s.t. $(\mathsf{isu}({p}_{1},{t}_{1}),\mathsf{del}({p}_{0},{t}))\in{\mathsf{RW}}$ (or $(\mathsf{isu}({p}1,{t}1),\mathsf{del}({p}_{1},{t}))\in{\mathsf{RW}}$) then similar to before the following trace $\tau^{\prime}=\alpha\cdot\mathsf{isu}({p},{t})\cdot\beta^{\prime}\cdot({p}_{1},{t}_{1})\cdot\mathsf{del}({p}_{0},{t})\cdot\gamma^{\prime}$ (resp., $\tau^{\prime}=\alpha\cdot\mathsf{isu}({p},{t})\cdot\beta^{\prime}\cdot({p}_{1},{t}_{1})\cdot\mathsf{del}({p}_{1},{t})\cdot\gamma^{\prime}$) is a minimal violation. Assume now that there does not exist an issue event $\mathsf{isu}({p}_{1},{t}_{1})$. Then, let $\mathsf{isu}({p}_{2},{t}_{2})$ be the first issue event in $\mathsf{isu}({p},{t})\cdot\beta_{1}\cdot\mathsf{isu}({p}^{\prime},{t}^{\prime})$ s.t. $\tau=\alpha\cdot\mathsf{isu}({p},{t})\cdot\beta^{\prime}_{1}\cdot\mathsf{isu}({p}_{2},{t}_{2})\cdot\beta^{\prime}_{2}\cdot\mathsf{del}({p}_{3},{t}_{2})\cdot\beta^{\prime}_{3}\cdot\gamma$ and $\mathsf{isu}({p}_{2},{t}_{2})$ happens-before $\mathsf{del}({p}_{3},{t}_{2})$ through $\beta^{\prime}_{2}$ and s.t. for every issue event in $\mathsf{isu}({p},{t})\cdot\beta^{\prime}_{1}$ of a transaction ${t}_{4}$ there does not exist an event in $\beta^{\prime}_{1}\cdot\mathsf{isu}({p}_{2},{t}_{2})\cdot\beta^{\prime}_{2}$ that reads from a variable that ${t}_{4}$ overwrites. We can remove every issue event and atomic marco event which occur after $\mathsf{del}({p}_{3},{t}_{2})$ with all related stores: $\tau^{\prime}=\alpha\cdot\mathsf{isu}({p},{t})\cdot\beta^{\prime}_{1}\cdot\mathsf{isu}({p}_{2},{t}_{2})\cdot\beta^{\prime}_{2}\cdot\mathsf{del}({p}_{3},{t}_{2})\cdot\gamma^{\prime}$ where $\gamma^{\prime}$ contains only store events is a minimal violation. Then, not delaying the transactions in $\mathsf{isu}({p},{t})\cdot\beta^{\prime}_{1}$ does not affect the reads in $\beta^{\prime}_{1}\cdot\mathsf{isu}({p}_{2},{t}_{2})\cdot\beta^{\prime}_{2}$, and thus, we get that $\tau^{\prime\prime}=\alpha\cdot({p},{t})\cdot\beta^{\prime\prime}_{1}\cdot\mathsf{isu}({p}_{2},{t}_{2})\cdot\beta^{\prime\prime}_{2}\cdot\mathsf{del}({p}_{3},{t}_{2})\cdot\gamma^{\prime\prime}$, where ${t}_{2}$ is the first delayed transaction in $\tau^{\prime\prime}$ and $\mathsf{isu}({p}_{2},{t}_{2})$ happens-before $\mathsf{del}({p}_{3},{t}_{2})$ through $\beta^{\prime\prime}_{2}$, is a minimal violation. Note that $|{\beta^{\prime\prime}_{2}}|<|{\beta}|=m+1$, and we can apply the induction hypothesis to $\tau^{\prime\prime}$ and conclude the proof.

Next, we show that a program which is not robust against CCv or CM admits violations of particular shapes. For the remainder of the paper, we write a minimal violation in the shape $\tau=\mathsf{\alpha}_{\mathsf{A}}\cdot\mathsf{isu}({p},{t})\cdot\beta\cdot({p}^{\prime},{t}^{\prime})\cdot\mathsf{del}({p}^{\prime},{t})\cdot\mathsf{\gamma}_{\mathsf{S}}$ to say that all the events in the sequence $\mathsf{\alpha}_{\mathsf{A}}$ are atomic macro events and all the events in the sequence $\mathsf{\gamma}_{\mathsf{S}}$ are store events. As before, we assume that ${t}$ is the first delayed transaction in $\tau$, and by Lemma 9, we assume that $(\mathsf{isu}({p},{t}),({p}^{\prime},{t}^{\prime}))\in{\mathsf{HB}}$ and $(({p}^{\prime},{t}^{\prime}),\mathsf{del}({p}^{\prime},{t}))\in{\mathsf{HB}}^{1}$.

6. Robustness Violations Under Causal Convergence

In this section, we present a precise characterization of minimal violations under CCv. In particular, we show that in these violations, the first delayed transaction (which must exist by Lemma 6) is followed by a possibly-empty sequence of delayed transactions that form a “causality chain”, i.e., the issue of every new delayed transaction is causally ordered after the issue of the first delayed transaction. Also, we show that the issue event of the last delayed transaction happens-before an event of another transaction that reads a variable updated by the first delayed transaction (which implies a cycle in the transactional happens-before). This characterization will allow us to build a monitor for detecting the existence of robustness violations that is linear in the size of the input program.

Next, we give a precise definition of the “causality chain”. It consists of a sequence of issue events such that the first issue is causally ordered before every other issue event and every issued transaction is delivered to the process executing the next issue event in the chain, before this issue event executes.

{defi}

We say that a sequence of issue events $\mathit{ev}_{1}\cdot\mathit{ev}_{2}\cdot\ldots\mathit{ev}_{n}$ forms a causality chain that starts with $\mathit{ev}_{1}$ and ends at $\mathit{ev}_{n}$ in a trace $\tau$ if the followings hold:

1. (1)

$(\mathit{ev}_{1},\mathit{ev}_{i})\in\mathsf{CO}$, for all $2\leq i\leq n$ 2. (2)

for all $1\leq i\leq n-1$ such that $\mathit{ev}_{i}=\mathsf{isu}({p}_{i},{t}_{i})$, $\mathit{ev}_{i+1}=\mathsf{isu}({p}_{i+1},{t}_{i+1})$, the store event $\mathsf{del}({p}_{i+1},{t}_{i})$ occurs before the issue event $\mathit{ev}_{i+1}$ in $\tau$.

The characterization of robustness violations under CCv is stated in the following theorem and pictured in Fig. 11.

Theorem 10**.**

A program $\mathcal{P}$ is not robust under CCv iff there exists a minimal violation in $\mathbb{T}\mathsf{r}(\mathcal{P})_{{\tt CCv}{}}$ of one of the following forms:

1. (1)

$\tau_{{\tt CCv}{}1}=\mathsf{\alpha}_{\mathsf{A}}\cdot\mathsf{isu}({p},{t})\cdot\mathsf{del}({p},{t})\cdot\beta_{2}\cdot({p}^{\prime},{t}^{\prime})\cdot\mathsf{del}({p}^{\prime},{t})\cdot\mathsf{\gamma}_{\mathsf{S}}\mbox{ where:}$**

1. (a)

$\mathsf{isu}({p},{t})$* is the issue of the first and only delayed transaction (Lemma 11);* 2. (b)

$\exists\ y.$* s.t. $(\mathsf{del}({p},{t}),({p}^{\prime},{t}^{\prime}))\in{\mathsf{WW}}(y)$ and $(({p}^{\prime},{t}^{\prime}),\mathsf{del}({p}^{\prime},{t}))\in{\mathsf{RW}}(y)$ (Lemma 11);* 3. (c)

$\forall\ a\in\beta_{2}.\ (\mathsf{isu}({p},{t}),a)\in{\mathsf{HB}}\setminus\mathsf{CO}\mbox{ and }(a,({p}^{\prime},{t}^{\prime}))\in\mathsf{CO}$* (Lemma 11).* 2. (2)

$\tau_{{\tt CCv}{}2}=\mathsf{\alpha}_{\mathsf{A}}\cdot\mathsf{isu}({p},{t})\cdot\beta_{1}\cdot\mathsf{isu}({p}_{1},{t}_{1})\cdot\beta_{2}\cdot({p}^{\prime},{t}^{\prime})\cdot\mathsf{del}({p}^{\prime},{t})\cdot\mathsf{\gamma}_{\mathsf{S}}\mbox{ where:}$**

1. (a)

$\mathsf{isu}({p},{t})$* and $\mathsf{isu}({p}_{1},{t}_{1})$ are the issues of the first and last delayed transactions (Lemmas 11 and 12);* 2. (b)

the issues of all delayed transactions are in $\beta_{1}$ and are included in a causality chain that starts with $\mathsf{isu}({p},{t})$ and ends at $\mathsf{isu}({p}_{1},{t}_{1})$ (Lemma 12); 3. (c)

for every $a\in\beta_{2}$, we have that $(\mathsf{isu}({p}_{1},{t}_{1}),a)\in{\mathsf{HB}}\setminus\mathsf{CO}$ and $(a,({p}^{\prime},{t}^{\prime}))\in{\mathsf{HB}}$ (Lemma 11); 4. (d)

there exist $a\in\beta_{2}\cdot({p}^{\prime},{t}^{\prime})$, $x$, and $y$ s.t. $x\neq y$, $(\mathsf{isu}({p}_{1},{t}_{1}),a)\in{\mathsf{RW}}(x)\cup({\mathsf{STO}};{\mathsf{WW}}(x))$, $(a,({p}^{\prime},{t}^{\prime}))\in{\mathsf{HB}}{}?$888${\mathsf{HB}}{}?$ is the reflexive closure of ${\mathsf{HB}}{}$., and $(({p}^{\prime},{t}^{\prime}),\mathsf{del}({p}^{\prime},{t}))\in{\mathsf{RW}}(y)$ (Lemma 11); 5. (e)

all delayed transactions in $\mathsf{isu}({p},{t})\cdot\beta_{1}$ do not access the variable $x$ (Lemma 14).

Above, $\tau_{{\tt CCv}{}1}$ contains a single delayed transaction while $\tau_{{\tt CCv}{}2}$ may contain arbitrarily many delayed transactions. In $\tau_{{\tt CCv}{}1}$ the store event $\mathsf{del}({p},{t})$ of the only delayed transaction happens before $({p}^{\prime},{t}^{\prime})$ which is conflicting with ${t}$, thus resulting in a cycle in the transactional happens-before. In $\tau_{{\tt CCv}{}2}$ the issue event of the last delayed transaction ${t}_{1}$, which is causally ordered after the issue of the first delayed transaction ${t}$, happens before $({p}^{\prime},{t}^{\prime})$ which is conflicting with ${t}$, thus resulting in a cycle in the transactional happens-before as well. The theorem above allows $\mathsf{\alpha}_{\mathsf{A}}=\epsilon$, $\beta_{1}=\epsilon$, $\beta_{2}=\epsilon$, $\beta=\epsilon$, $\mathsf{\gamma}_{\mathsf{S}}=\epsilon$, ${p}={p}_{1}$, ${t}={t}_{1}$, and ${t}_{1}$ to be a read-only transaction. Fig. 12(a) and Fig. 12(b) show two violations under CCv where such equalities hold. If ${t}_{1}$ is a read-only transaction then $\mathsf{isu}({p}_{1},{t}^{\prime})$ has the same effect as $({p}_{1},{t}_{1})$ since ${t}_{1}$ does not contain writes.

The minimality of the violation enforces the constraints stated above. For example, in the context of $\tau_{{\tt CCv}{}2}$, the delayed transactions in $\beta_{1}$ cannot create a cycle in the transactional happens-before (otherwise, there exists a sequence of store events $\mathsf{\gamma}_{\mathsf{S}}^{\prime}$ such that $\mathsf{\alpha}_{\mathsf{A}}\cdot\mathsf{isu}({p},{t})\cdot\mathsf{del}({p},{t})\cdot\beta_{1}\cdot\mathsf{del}({p}_{0},{t})\cdot\mathsf{\gamma}_{\mathsf{S}}^{\prime}$ is a violation with a smaller measure, which contradicts minimality). Moreover, $(c)$ implies that $\beta_{2}$ contains no stores of delayed transactions from $\beta_{1}$. If this were the case, then these stores can either be reordered after $\mathsf{del}({p}^{\prime},{t})$ or if this is not possible due to happens-before constraints, then there would exist an issue event which is after such a store in the happens-before order and thus causally after $\mathsf{isu}({p},{t})$, which would contradict the fact that $\mathsf{isu}({p}_{1},{t}_{1})$ is the last issue event in $\tau$ that is causally ordered after $\mathsf{isu}({p},{t})$. Also, if it were to have a delayed transaction ${t}_{2}$ in $\beta_{2}$ (resp., $\beta$ for $\tau_{{\tt CCv}{}1}$), then it is possible to remove some transaction (the issue and all its store events) from the original trace and obtain a new violation trace with a smaller number of delays. For instance, in the case of $\beta_{2}$, if ${t}_{1}\neq{t}$, then we can remove the events of the last delayed transaction (i.e., ${t}_{1}$), that is causally related to $\mathsf{isu}({p},{t})$, since all events in $\beta_{2}\cdot\mathsf{del}({p}_{0},{t})\cdot\mathsf{\gamma}_{\mathsf{S}}$ neither read from the writes of ${t}_{1}$ nor are issued by the same process as ${t}_{1}$ (because of the ${\mathsf{HB}}\setminus\mathsf{CO}$ relation between events $\beta_{2}$ and $\mathsf{isu}({p}_{1},{t}_{1})$). The resulting trace is still a robustness violation (because of the transactional happens-before cycle involving ${t}_{2}$ since it is delayed in $\beta_{2}$) but with a smaller measure. Note that all processes that delayed transactions, stop executing new transactions in $\beta_{2}$ (resp., $\beta$) because of the relation ${\mathsf{HB}}\setminus\mathsf{CO}$, shown in Fig. 11, between the delayed transaction ${t}_{1}$ (resp., ${t}$) and events in $\beta_{2}$ (resp., $\beta$).

In the following we give a series of lemmas that collectively imply Theorem 10. Next lemma gives the decomposition of minimal violations under CCv into two possible patterns. It also characterizes the nature of the happens-before dependencies in these traces. For instance, we show that the last dependency in the happens-before cycle is always a conflict dependency. The lemma proof starts with a minimal violation as characterized in Lemma 9 and uses induction to show that we can always obtain a minimal violation which follows one of the two patterns. The induction is based on the size of the sequence of events between the issue and delayed store events of the first delayed transaction (the sequence $\beta$ in Lemma 9).

Lemma 11**.**

If $\mathcal{P}$ is a program that is not robust under CCv, then it must admit a minimal violation $\tau$ that satisfies one of the following:

1. (1)

$\tau=\mathsf{\alpha}_{\mathsf{A}}\cdot\mathsf{isu}({p},{t})\cdot\mathsf{del}({p},{t})\cdot\beta\cdot({p}^{\prime},{t}^{\prime})\cdot\mathsf{del}({p}^{\prime},{t})\cdot\mathsf{\gamma}_{\mathsf{S}}\mbox{ where: }$**

1. (a)

$\exists\ y.$* s.t. $(\mathsf{del}({p},{t}),({p}^{\prime},{t}^{\prime}))\in{\mathsf{WW}}(y)$ and $(({p}^{\prime},{t}^{\prime}),\mathsf{del}({p}^{\prime},{t}))\in{\mathsf{RW}}(y)$;* 2. (b)

$\forall\ a\in\beta.\ (\mathsf{isu}({p},{t}),a)\in{\mathsf{HB}}\setminus\mathsf{CO}\mbox{ and }(a,({p}^{\prime},{t}^{\prime}))\in\mathsf{CO}$. 2. (2)

$\tau=\mathsf{\alpha}_{\mathsf{A}}\cdot\mathsf{isu}({p},{t})\cdot\beta_{1}\cdot\mathsf{isu}({p}_{1},{t}_{1})\cdot\beta_{2}\cdot({p}^{\prime},{t}^{\prime})\cdot\mathsf{del}({p}^{\prime},{t})\cdot\mathsf{\gamma}_{\mathsf{S}}\mbox{ where: }$**

1. (a)

$\mathsf{isu}({p}_{1},{t}_{1})$* is the last issue event in $\{c\in\beta\ |\ (\mathsf{isu}({p},{t}),c)\in\mathsf{CO}\}$;* 2. (b)

$\exists\ x,\ y,\ \mbox{and }a\in\beta_{2}\cdot({p}^{\prime},{t}^{\prime})$* s.t. $(\mathsf{isu}({p}_{1},{t}_{1}),a)\in{\mathsf{RW}}(x)\cup({\mathsf{STO}};{\mathsf{WW}}(x))$, $(a,({p}^{\prime},{t}^{\prime}))\in{\mathsf{HB}}{}?$, and $(({p}^{\prime},{t}^{\prime}),\mathsf{del}({p}^{\prime},{t}))\in{\mathsf{RW}}(y)$;* 3. (c)

$\forall\ a\in\beta_{2}.\ (\mathsf{isu}({p}_{1},{t}_{1}),a)\in{\mathsf{HB}}\setminus\mathsf{CO}\mbox{ and }(a,({p}^{\prime},{t}^{\prime}))\in{\mathsf{HB}}$.

Proof 6.1**.**

Let $\tau=\mathsf{\alpha}_{\mathsf{A}}\cdot\mathsf{isu}({p},{t})\cdot\beta\cdot({p}^{\prime},{t}^{\prime})\cdot\mathsf{del}({p}^{\prime},{t})\cdot\mathsf{\gamma}_{\mathsf{S}}$ be a minimal violation under CCv (cf. Lemma 9). We prove by induction on the size of $\beta$ that there exists a minimal violation trace $\tau^{\prime}$ that satisfies ($1$) or ($2$) and $\tau^{\prime}$ is obtained from $\tau$. By the definition of the happens-before $(({p}^{\prime},{t}^{\prime}),\mathsf{del}({p}^{\prime},{t}))\in{\mathsf{HB}}^{1}$ implies that $(({p}^{\prime},{t}^{\prime}),\mathsf{del}({p}^{\prime},{t}))\in{\mathsf{RW}}\cup{\mathsf{WW}}$. Since ${t}^{\prime}$ was issued after ${t}$ in $\tau$, then based on the total order of timestamps under CCv, we cannot have $(({p}^{\prime},{t}^{\prime}),\mathsf{del}({p}^{\prime},{t}))\in{\mathsf{WW}}$. Then, there must exist $y$ s.t. $(({p}^{\prime},{t}^{\prime}),\mathsf{del}({p}^{\prime},{t}))\in{\mathsf{RW}}(y)$.

Base case:* $|{\beta}|=0$. Since $(\mathsf{isu}({p},{t}),({p}^{\prime},{t}^{\prime}))\in{\mathsf{HB}}$ then from the definition of the happens-before the only possible relation is $(\mathsf{isu}({p},{t}),({p}^{\prime},{t}^{\prime}))\in{\mathsf{RW}}$. Thus, there must exist $x$ s.t. $(\mathsf{isu}({p},{t}),({p}^{\prime},{t}^{\prime}))\in{\mathsf{RW}}(x)$. If $x=y$ then both ${t}$ and ${t}^{\prime}$ write to $x$. Thus, by reordering the store event $\mathsf{del}({p},{t})\in\mathsf{\gamma}_{\mathsf{S}}$ to occur just after the corresponding issue event we get $\tau^{\prime}=\mathsf{\alpha}_{\mathsf{A}}\cdot\mathsf{isu}({p},{t})\cdot\mathsf{del}({p},{t})\cdot({p}^{\prime},{t}^{\prime})\cdot\mathsf{del}({p}^{\prime},{t})\cdot\mathsf{\gamma}_{\mathsf{S}}^{\prime}$ is also a minimal violation where $(\mathsf{del}({p},{t}),({p}^{\prime},{t}^{\prime}))\in{\mathsf{WW}}(x)$ (since ${t}$ was issued before ${t}^{\prime}$ and both write to $x$) and $(({p}^{\prime},{t}^{\prime}),\mathsf{del}({p}^{\prime},{t}))\in{\mathsf{RW}}(x)$. $\tau^{\prime}$ satisfies the first case of the lemma. If $x\neq y$ then $\tau=\mathsf{\alpha}_{\mathsf{A}}\cdot\mathsf{isu}({p},{t})\cdot({p}^{\prime},{t}^{\prime})\cdot\mathsf{del}({p}^{\prime},{t})\cdot\mathsf{\gamma}_{\mathsf{S}}$ where there exist $x$ and $y$ s.t. $x\neq y$, $(\mathsf{isu}({p},{t}),({p}^{\prime},{t}^{\prime}))\in{\mathsf{RW}}(x)$, and $(({p}^{\prime},{t}^{\prime}),\mathsf{del}({p}^{\prime},{t}))\in{\mathsf{RW}}(y)$ satisfies the second case of the lemma where ${t}$ and ${t}_{1}$ coincide and $a$ corresponds to $({p}^{\prime},{t}^{\prime})$.*

Induction step:* We assume the induction hypothesis holds for $|{\beta}|\leq m$. Let $\sigma=\{c\in\beta\ |\ (\mathsf{isu}({p},{t}),c)\in\mathsf{CO}\}$, we will consider the following three possible cases:*

First, assume that $\sigma$ is empty. Since $(\mathsf{isu}({p},{t}),({p}^{\prime},{t}^{\prime}))\in{\mathsf{HB}}$ then there must exist $a\in\beta\cdot({p}^{\prime},{t}^{\prime})$ s.t. $(\mathsf{isu}({p},{t}),a)\in{\mathsf{HB}}^{1}$ and $(a,({p}^{\prime},{t}^{\prime}))\in{\mathsf{HB}}?$. $\sigma$ is empty implies that $\beta$ does not contain events that are related to $\mathsf{isu}({p},{t})$ through $\mathsf{CO}$ (which includes ${\mathsf{PO}}\cup{\mathsf{WR}}\cup{\mathsf{STO}}$), therefore, $(\mathsf{isu}({p},{t}),a)\in{\mathsf{WW}}\cup{\mathsf{RW}}$. It is impossible to have $(\mathsf{isu}({p},{t}),a)\in{\mathsf{WW}}$ since $\mathsf{isu}({p},{t})$ does not contain writes. Thus, there must exist $x$ s.t. $(\mathsf{isu}({p},{t}),a)\in{\mathsf{RW}}(x)$. If $x=y$ then both the transaction of the event $a$, denoted ${t}_{2}$, and ${t}$ write to $x$. We consider the two cases of $(a,({p}^{\prime},{t}^{\prime}))\in{\mathsf{HB}}?$: i) $a=({p}^{\prime},{t}^{\prime})$ (i.e., ${t}_{2}={t}^{\prime}$), and ii) $(a,({p}^{\prime},{t}^{\prime}))\in{\mathsf{HB}}$. Assume $a=({p}^{\prime},{t}^{\prime})$ then by reordering the store event $\mathsf{del}({p},{t})\in\tau$ to occur just after the corresponding issue event (since the events in $\beta$ are not causally related to $\mathsf{isu}({p},{t})$) we get $\tau^{\prime}=\mathsf{\alpha}_{\mathsf{A}}\cdot\mathsf{isu}({p},{t})\cdot\mathsf{del}({p},{t})\cdot\beta\cdot({p}^{\prime},{t}^{\prime})\cdot\mathsf{del}({p}^{\prime},{t})\cdot\mathsf{\gamma}_{\mathsf{S}}^{\prime}$ is also a minimal violation where $(\mathsf{del}({p},{t}),({p}^{\prime},{t}^{\prime}))\in{\mathsf{WW}}(x)$ (since ${t}$ was issued before ${t}^{\prime}$ and both write to $x$) and $(({p}^{\prime},{t}^{\prime}),\mathsf{del}({p}^{\prime},{t}))\in{\mathsf{RW}}(x)$. In $\tau^{\prime}$ we remove all events in $\beta$ that are not causally ordered before $({p}^{\prime},{t}^{\prime})$ since they do not contribute to the happens-before cycle. We obtain a new violation trace that satisfies the first case of the lemma. Assume now that $(a,({p}^{\prime},{t}^{\prime}))\in{\mathsf{HB}}$. This implies that $\mathsf{isu}({p}_{2},{t}_{2})\in\beta$ happens-before $({p}^{\prime},{t}^{\prime})$ (since $a$ is an event ${t}_{2}$). Since both ${t}_{2}$ and ${t}$ write to $x$ and ${t}$ occurs before ${t}_{2}$ in $\tau$ then from the definition of store and conflict relations $(({p}^{\prime},{t}^{\prime}),\mathsf{del}({p}^{\prime},{t}))\in{\mathsf{RW}}(x)$ implies that $(({p}^{\prime},{t}^{\prime}),\mathsf{del}({p}^{\prime},{t}_{2}))\in{\mathsf{RW}}(x)$. Also, since in $\beta$ we do not have events that are causally related to $\mathsf{isu}({p},{t})$ then let $\tau^{\prime}$ be the trace resulting from removing all events of ${t}$ in $\tau$: $\tau^{\prime}=\mathsf{\alpha}_{\mathsf{A}}\cdot\mathsf{isu}({p}_{2},{t}_{2})\cdot\beta^{\prime}\cdot({p}^{\prime},{t}^{\prime})\cdot\mathsf{del}({p}^{\prime},{t}_{2})\cdot\mathsf{\gamma}_{\mathsf{S}}^{\prime}$ where $\tau^{\prime}$ is a subsequence of $\tau$ and $\beta^{\prime}$ is a subsequence of $\beta$. $\tau^{\prime}$ is a minimal violation as well since it was obtained from $\tau$ by just removing events and $(\mathsf{isu}({p}_{2},{t}_{2}),({p}^{\prime},{t}^{\prime}))\in{\mathsf{HB}}$ and $(({p}^{\prime},{t}^{\prime}),\mathsf{del}({p}^{\prime},{t}_{2}))\in{\mathsf{RW}}(x)$. Since $|{\beta^{\prime}}|\leq m$ then we can apply the induction hypothesis on $\tau^{\prime}$. If $x\neq y$ we get that in $\tau$, $(\mathsf{isu}({p},{t}),a)\in{\mathsf{RW}}(x)$ and $(({p}^{\prime},{t}^{\prime}),\mathsf{del}({p}^{\prime},{t}))\in{\mathsf{RW}}(y)$ which satisfies the second case of the lemma.

Second, assume that $\sigma$ is not empty and all the elements of $\sigma$ are store events. Since ${t}$ is the first delayed transaction in $\tau$ then all stores in $\sigma$ are stores of ${t}$. Then, following the same analogy as before there must exist $x$ and an event $a\in\beta\cdot({p}^{\prime},{t}^{\prime})$ that is not a store event of ${t}$ s.t. $(\mathsf{isu}({p},{t}),a)\in({\mathsf{STO}};{\mathsf{WW}}(x))\cup{\mathsf{RW}}(x)$ and $(a,({p}^{\prime},{t}^{\prime}))\in{\mathsf{HB}}?$. Similar to before we consider the two cases $x=y$ and $x\neq y$ and apply the induction hypothesis in the first case.

*Third, assume that $\sigma$ is not empty and $\mathsf{isu}({p}_{1},{t}_{1})$ is the last issue event in $\sigma$, i.e., $\beta=\beta_{1}\cdot\mathsf{isu}({p}_{1},{t}_{1})\cdot\beta_{2}$ where all the events in $\beta_{2}$ are either stores of transactions that are causally related to $\mathsf{isu}({p},{t})$ (we can reorder these stores to be part of $\mathsf{\gamma}_{\mathsf{S}}$ except the store $\mathsf{del}({p}_{1},{t}_{1})$) or other events that are not causally related to $\mathsf{isu}({p},{t})$. We also have that $\mathsf{isu}({p},{t})$ is causally ordered before $\mathsf{isu}({p}_{1},{t}_{1})$. Since $(\mathsf{isu}({p},{t}),({p}^{\prime},{t}^{\prime}))\in{\mathsf{HB}}$ then $(\mathsf{isu}({p}_{1},{t}_{1}),({p}^{\prime},{t}^{\prime}))\in{\mathsf{HB}}$, otherwise, we remove $\mathsf{isu}({p}_{1},{t}_{1})$ and all related store events from $\tau$ and the resulting trace is still a violation and it has less delays since $\mathsf{isu}({p},{t})$ was not delayed after $\mathsf{isu}({p}_{1},{t}_{1})$ in the trace. Thus, $(\mathsf{isu}({p}_{1},{t}_{1}),({p}^{\prime},{t}^{\prime}))\in{\mathsf{HB}}$. Similar to before we obtain that there exist $x$ and an event $a\in\beta_{2}\cdot({p}^{\prime},{t}^{\prime})$ that is not a store event of ${t}_{1}$ s.t. $(\mathsf{isu}({p}_{1},{t}_{1}),a)\in({\mathsf{STO}};{\mathsf{WW}}(x))\cup{\mathsf{RW}}(x)$ and $(a,({p}^{\prime},{t}^{\prime}))\in{\mathsf{HB}}?$. If $x=y$ then both the transaction of the event $a$, denoted ${t}_{2}$, and ${t}$ write to $x$. Thus, $(\mathsf{isu}({p},{t}),a)\in{\mathsf{STO}};{\mathsf{WW}}(x)$. Then, since the events in $\beta_{2}\cdot({p}^{\prime},{t}^{\prime})$ do not causally depend on $\mathsf{isu}({p}_{1},{t}_{1})$ then we can remove the events of ${t}_{1}$ and obtain $\tau^{\prime}$ where $(\mathsf{isu}({p},{t}),a)\in{\mathsf{STO}};{\mathsf{WW}}(x)$, $(a,({p}^{\prime},{t}^{\prime}))\in{\mathsf{HB}}?$, and $(({p}^{\prime},{t}^{\prime}),\mathsf{del}({p}^{\prime},{t}))\in{\mathsf{RW}}(y)$ where ${t}$ was not delayed after $\mathsf{isu}({p}_{1},{t}_{1})$ in the trace, which means that $\tau^{\prime}$ has less delays than $\tau$ (a contradiction to $\tau$ being a minimal violation). Therefore, we must have $x\neq y$ s.t. $(\mathsf{isu}({p}_{1},{t}_{1}),a)\in({\mathsf{STO}};{\mathsf{WW}}(x))\cup{\mathsf{RW}}(x)$ and $(a,({p}^{\prime},{t}^{\prime}))\in{\mathsf{HB}}?$ and $(({p}^{\prime},{t}^{\prime}),\mathsf{del}({p}^{\prime},{t}))\in{\mathsf{RW}}(y)$ which satisfies the second case of the lemma. *

We use $\mathbb{T}\mathsf{ccv1}$ and $\mathbb{T}\mathsf{ccv2}$ to denote the class of minimal violations that satisfy the first and second case in Lemma 11, respectively. The following lemma shows that we can always obtain a minimal violation trace in either $\mathbb{T}\mathsf{ccv1}$ or $\mathbb{T}\mathsf{ccv2}$ where $\beta$ and $\beta_{2}$ contain no delayed transactions, respectively. We distinguish two cases in the proof: i) a minimal violation in $\mathbb{T}\mathsf{ccv2}$ where ${t}$ and ${t}_{1}$ are distinct transactions, and ii) a minimal violation in $\mathbb{T}\mathsf{ccv1}$ or in $\mathbb{T}\mathsf{ccv2}$ where ${t}$ and ${t}_{1}$ coincide. In the first case, we show that if it were to have a delayed transaction in $\beta_{2}$, then it is possible to remove some transaction from $\tau$ that is causally dependent on the first delayed transaction in $\tau$, and obtain a new violation with a smaller number of delays (which contradicts the minimality assumption). The second case is proved by induction on the size of $\beta$ (note that if ${t}$ and ${t}_{1}$ coincide, then $\beta=\beta_{2}$) where the base case is trivial (i.e., $\beta=\epsilon$), and in the induction step, we show that if it were to have a delayed transaction in $\beta$ then we can remove one of the delayed transactions in the trace and obtain another violation with the same number of delays as the original violation and for which we can apply the induction hypothesis.

Lemma 12**.**

Let $\tau$ be a minimal violation in $\mathbb{T}\mathsf{ccv1}$ or $\mathbb{T}\mathsf{ccv2}$. Then, there exist a violation $\tau_{1}$ in $\mathbb{T}\mathsf{ccv1}$ where $\beta$ contains no delayed transactions or a violation $\tau_{2}$ in $\mathbb{T}\mathsf{ccv2}$ where $\beta_{2}$ contains no delayed transactions.

Proof 6.2**.**

We consider two cases: i) $\tau$ in $\mathbb{T}\mathsf{ccv2}$ where ${t}_{1}$ and ${t}$ are two distinct transactions, ii) $\tau$ in $\mathbb{T}\mathsf{ccv1}$ or $\tau$ in $\mathbb{T}\mathsf{ccv2}$ where ${t}_{1}$ and ${t}$ coincide. We prove the first case by contradiction and the second case by induction on the size $\beta$ (we abused terminology here and considered $\beta_{2}=\beta$ since $\beta_{1}=\epsilon$ in the second case).

First case: let $\tau=\mathsf{\alpha}_{\mathsf{A}}\cdot\mathsf{isu}({p},{t})\cdot\beta_{1}\cdot\mathsf{isu}({p}_{1},{t}_{1})\cdot\beta_{2}\cdot({p}^{\prime},{t}^{\prime})\cdot\mathsf{del}({p}^{\prime},{t})\cdot\mathsf{\gamma}_{\mathsf{S}}$ and suppose by contradiction that $\beta_{2}$ contains a delayed transaction ${t}_{0}$ issued by a process $q\neq p$. W.l.o.g., we assume that the delayed store events of ${t}_{0}$ occur in $\beta_{2}$. Thus, $\beta_{2}=\beta_{21}\cdot\mathsf{isu}(q,{t}_{0})\cdot\beta_{22}\cdot\mathsf{del}(q^{\prime},{t}_{0})\cdot\beta_{23}$ and $\tau=\mathsf{\alpha}_{\mathsf{A}}\cdot\mathsf{isu}({p},{t})\cdot\beta_{1}\cdot\mathsf{isu}({p}_{1},{t}_{1})\cdot\beta_{21}\cdot\mathsf{isu}(q,{t}_{0})\cdot\beta_{22}\cdot\mathsf{del}(q^{\prime},{t}_{0})\cdot\beta_{23}\cdot({p}^{\prime},{t}^{\prime})\cdot\mathsf{del}({p}^{\prime},{t})\cdot\mathsf{\gamma}_{\mathsf{S}}$. In $\tau$, $\mathsf{isu}(q,{t}_{0})$ happens-before $\mathsf{del}(q^{\prime},{t}_{0})$ through $\beta_{22}$. Hence, we deduce that we can get a robustness violation when the event $\mathsf{del}(q^{\prime},{t}_{0})$ is executed, thus we can remove all issued transactions from $\beta_{23}\cdot({p}^{\prime},{t}^{\prime})$ except stores of already issued transactions and we obtain: $\tau^{\prime}=\mathsf{\alpha}_{\mathsf{A}}\cdot\mathsf{isu}({p},{t})\cdot\beta_{1}\cdot\mathsf{isu}({p}_{1},{t}_{1})\cdot\beta_{21}\cdot\mathsf{isu}(q,{t}_{0})\cdot\beta_{22}\cdot\mathsf{del}(q^{\prime},{t}_{0})\cdot\beta_{23}^{\prime}\cdot\mathsf{del}({p}^{\prime},{t})\cdot\mathsf{\gamma}_{\mathsf{S}}$ which is a minimal violation because $\mathsf{isu}(q,{t}_{0})$ happens-before $\mathsf{del}(q^{\prime},{t}_{0})$ through $\beta_{22}$ and its number of delays is less or equal to the one of $\tau$. We know that in $\beta_{21}\cdot\mathsf{isu}(q,{t}_{0})\cdot\beta_{22}\cdot\mathsf{del}(q^{\prime},{t}_{0})\cdot\beta_{23}^{\prime}\cdot\mathsf{del}({p}^{\prime},{t})\cdot\mathsf{\gamma}_{\mathsf{S}}$ there are no transactions from the process ${p}_{1}$ or that see the effect of transactions from ${p}_{1}$ (because of the ${\mathsf{HB}}\setminus\mathsf{CO}$ relation between events $\beta_{2}$ and $\mathsf{isu}({p}_{1},{t}_{1})$). Therefore, $\mathsf{isu}({p}_{1},{t}_{1})$ is the last issued transaction from ${p}_{1}$ and we do not have any transaction in $\tau^{\prime}$ that depends on it. Thus, we can remove $\mathsf{isu}({p}_{1},{t}_{1})$ and we obtain the following trace: $\tau^{\prime\prime}=\mathsf{\alpha}_{\mathsf{A}}\cdot\mathsf{isu}({p},{t})\cdot\beta_{1}\cdot\beta_{21}\cdot\mathsf{isu}(q,{t}_{0})\cdot\beta_{22}\cdot\mathsf{del}(q^{\prime},{t}_{0})\cdot\beta_{23}^{\prime}\cdot\mathsf{del}({p}^{\prime},{t})\cdot\mathsf{\gamma}_{\mathsf{S}}^{\prime}$, which is a robustness violation because $\mathsf{isu}(q,{t}_{0})$ happens-before $\mathsf{del}(q^{\prime},{t}_{0})$ through $\beta_{22}$. $\tau^{\prime\prime}$ has less delays than $\tau^{\prime}$ ($\mathsf{del}({p}^{\prime},{t})$ was not delayed after $\mathsf{isu}({p}_{1},{t}_{1})$ which was removed), which is a contradiction to the fact that $\tau$ is a minimal violation.

Second case: let $\tau=\mathsf{\alpha}_{\mathsf{A}}\cdot\mathsf{isu}({p},{t})\cdot\beta\cdot({p}^{\prime},{t}^{\prime})\cdot\mathsf{del}({p}^{\prime},{t})\cdot\mathsf{\gamma}_{\mathsf{S}}$. We show by induction that we can construct either $\tau_{1}$ in $\mathbb{T}\mathsf{ccv1}$ where $\beta$ of $\tau_{1}$ contains no delayed transactions or $\tau_{2}$ in $\mathbb{T}\mathsf{ccv2}$ where $\beta_{2}$ of $\tau_{2}$ contains no delayed transactions.

Base case:* $|{\beta}|=0$ is trivial.*

Induction step:* We assume that the induction hypothesis holds for $|{\beta}|\leq m$. Let ${t}_{0}$ be the first delayed transaction in $\beta$. Similar to before, we assume w.l.o.g. that the delayed store events of ${t}_{0}$ occurs in $\beta$. Thus, $\beta=\beta_{01}\cdot\mathsf{isu}(q,{t}_{0})\cdot\beta_{02}\cdot\mathsf{del}(q^{\prime},{t}_{0})\cdot\beta_{03}$ and $\tau=\mathsf{\alpha}_{\mathsf{A}}\cdot\mathsf{isu}({p},{t})\cdot\beta_{01}\cdot\mathsf{isu}(q,{t}_{0})\cdot\beta_{02}\cdot\mathsf{del}(q^{\prime},{t}_{0})\cdot\beta_{03}\cdot({p}^{\prime},{t}^{\prime})\cdot\mathsf{del}({p}^{\prime},{t})\cdot\mathsf{\gamma}_{\mathsf{S}}$ where $\mathsf{isu}(q,{t}_{0})$ happens-before $\mathsf{del}(q^{\prime},{t}_{0})$ through $\beta_{02}$. Using the same arguments as before, we can remove the event $\mathsf{isu}({p},{t})$, its related stores in $\tau$, and all issued transactions in $\beta_{03}\cdot({p}^{\prime},{t}^{\prime})$. We obtain: $\tau^{\prime}=\mathsf{\alpha}_{\mathsf{A}}^{\prime}\cdot\mathsf{isu}(q,{t}_{0})\cdot\beta_{02}\cdot\mathsf{del}(q^{\prime},{t}_{0})\cdot\mathsf{\gamma}_{\mathsf{S}}^{\prime}$ where $\mathsf{\alpha}_{\mathsf{A}}^{\prime}=\mathsf{\alpha}_{\mathsf{A}}\cdot\beta_{01}$ and $\mathsf{isu}(q,{t}_{0})$ happens-before $\mathsf{del}(q^{\prime},{t}_{0})$ through $\beta_{02}$. $\tau^{\prime}$ is a robustness violation, and it has the same number of delays as $\tau$. We now consider two possible case of $\tau^{\prime}$: i) $\tau^{\prime}$ is in $\mathbb{T}\mathsf{ccv2}$ where ${t}_{0}$ and ${t}_{01}$, the last delayed transaction causally dependent on $\mathsf{isu}(q,{t}_{0})$ in $\tau^{\prime}$, are two distinct transactions, or ii) $\tau$ in $\mathbb{T}\mathsf{ccv1}$ or $\tau$ in $\mathbb{T}\mathsf{ccv2}$ where ${t}_{0}$ and ${t}_{01}$ coincide. From the first part of the proof, it is guaranteed that in the first case there are no delayed transactions after ${t}_{01}$. For the second case, we use the induction hypothesis since $|{\beta_{02}}|\leq m$ ($\beta_{02}$ is a strict subsequence of $\beta$).*

We have now showed all the necessary characterizations for minimal violations that fall under the first pattern (i.e., $\mathbb{T}\mathsf{ccv1}$). In the rest of this section, we focus on minimal violations that fall under the second pattern (i.e., $\mathbb{T}\mathsf{ccv2}$). In particular, we look at minimal violations in $\mathbb{T}\mathsf{ccv2}$ where ${t}$ and ${t}_{1}$ are distinct transactions. In the following lemma, we show that for these minimal violations the issue events of delayed transactions in $\mathsf{isu}({p},{t})\cdot\beta_{1}\cdot\mathsf{isu}({p}_{1},{t}_{1})$ constitute a causality chain. Our proof can be decomposed to two parts. In the first part, we show that we cannot have an issue event of a delayed transaction in $\beta_{1}\cdot\mathsf{isu}({p}_{1},{t}_{1})$ that is not causally dependent on $\mathsf{isu}({p},{t})$. We prove this by showing that if this were possible then we can remove a transaction that is causally dependent on one of the two delayed transactions and obtain a new violation trace with less delays than the original violation (which contradicts the minimality assumption). For the second part, we show that for a given minimal violation, we can construct a happens-before equivalent trace where for every two successive issue events of delayed transactions in $\mathsf{isu}({p},{t})\cdot\beta_{1}\cdot\mathsf{isu}({p}_{1},{t}_{1})$, the transaction in the first issue is delivered to the process executing the second issue before this event happens.

Lemma 13**.**

Let $\tau=\mathsf{\alpha}_{\mathsf{A}}\cdot\mathsf{isu}({p},{t})\cdot\beta_{1}\cdot\mathsf{isu}({p}_{1},{t}_{1})\cdot\beta_{2}\cdot({p}^{\prime},{t}^{\prime})\cdot\mathsf{del}({p}^{\prime},{t})\cdot\mathsf{\gamma}_{\mathsf{S}}$ be a minimal violation in $\mathbb{T}\mathsf{ccv2}$ s.t ${t}\neq{t}_{1}$ and $\beta_{2}$ contains no delayed transactions (cf. Lemma 12). Then, there exists a violation $\tau^{\prime}=\mathsf{\alpha}_{\mathsf{A}}\cdot\mathsf{isu}({p},{t})\cdot\beta_{1}^{\prime}\cdot\mathsf{isu}({p}_{1},{t}_{1})\cdot\beta_{2}\cdot({p}^{\prime},{t}^{\prime})\cdot\mathsf{del}({p}^{\prime},{t})\cdot\mathsf{\gamma}_{\mathsf{S}}^{\prime}$ obtained from $\tau$ where $\beta_{1}^{\prime}\cdot\mathsf{\gamma}_{\mathsf{S}}^{\prime}$ is a subsequence of $\beta_{1}\cdot\mathsf{\gamma}_{\mathsf{S}}$ and the sequence of issue events of delayed transactions forms a causality chain that starts with $\mathsf{isu}({p},{t})$ and ends at $\mathsf{isu}({p}_{1},{t}_{1})$.

Proof 6.3**.**

First, we show that we can obtain a violation $\tau^{\prime}$ from $\tau$ where all delayed transactions in $\beta_{1}^{\prime}\cdot\mathsf{isu}({p}_{1},{t}_{1})$ are causally dependent on $\mathsf{isu}({p},{t})$. From the definition of ${t}_{1}$ in Lemma 11, we already have that $(\mathsf{isu}({p},{t}),\mathsf{isu}({p}_{1},{t}_{1}))\in\mathsf{CO}$. In the proof, we assume w.l.o.g that in $\beta_{1}\cdot\mathsf{isu}({p}_{1},{t}_{1})\cdot\beta_{2}$ there is no event $a$ that reads a value that ${t}$ overwrites, otherwise, we can shortcut the trace by removing $({p}^{\prime},{t}^{\prime})$ and instead using the conflict relation between $a$ and a store event of ${t}$ to build the transactional happens-before cycle. Now, assume that $\beta_{1}$ contains a delayed transaction ${t}_{0}$ from another process $q\neq p$ that is not causally dependent on $\mathsf{isu}({p},{t})$. We show that we either can obtain a contradiction or we can remove all events of ${t}_{0}$ and obtain a new violation trace $\tau^{\prime}$ that has the same number of delays as $\tau$. We have three possible cases based on whether the delayed store event $\mathsf{del}(q^{\prime},{t}_{0})$ of ${t}_{0}$ occurs in $\beta_{1}$, $\beta_{2}$ or $\mathsf{\gamma}_{\mathsf{S}}$. Hence, we get that $\tau$ can be one of the following:

1. (a)

$\tau=\mathsf{\alpha}_{\mathsf{A}}\cdot\mathsf{isu}({p},{t})\cdot\beta_{11}\cdot\mathsf{isu}(q,{t}_{0})\cdot\beta_{12}\cdot\mathsf{del}(q^{\prime},{t}_{0})\cdot\beta_{13}\cdot\mathsf{isu}({p}_{1},{t}_{1})\cdot\beta_{2}\cdot({p}^{\prime},{t}^{\prime})\cdot\mathsf{del}({p}^{\prime},{t})\cdot\mathsf{\gamma}_{\mathsf{S}}$** 2. (b)

$\tau=\mathsf{\alpha}_{\mathsf{A}}\cdot\mathsf{isu}({p},{t})\cdot\beta_{11}\cdot\mathsf{isu}(q,{t}_{0})\cdot\beta_{12}\cdot\mathsf{isu}({p}_{1},{t}_{1})\cdot\beta_{21}\cdot\mathsf{del}(q^{\prime},{t}_{0})\cdot\beta_{22}\cdot({p}^{\prime},{t}^{\prime})\cdot\mathsf{del}({p}^{\prime},{t})\cdot\mathsf{\gamma}_{\mathsf{S}}$** 3. (c)

$\tau=\mathsf{\alpha}_{\mathsf{A}}\cdot\mathsf{isu}({p},{t})\cdot\beta_{11}\cdot\mathsf{isu}(q,{t}_{0})\cdot\beta_{12}\cdot\mathsf{isu}({p}_{1},{t}_{1})\cdot\beta_{2}\cdot({p}^{\prime},{t}^{\prime})\cdot\mathsf{del}({p}^{\prime},{t})\cdot\mathsf{\gamma}_{\mathsf{S}}^{1}\cdot\mathsf{del}(q^{\prime},{t}_{0})\cdot\mathsf{\gamma}_{\mathsf{S}}^{2}$**

In case $(a)$ (resp., $(b)$) we can notice that since $\mathsf{isu}(q,{t}_{0})$ happens-before $\mathsf{del}(q^{\prime},{t}_{0})$ through $\beta_{12}$ (resp., $\beta_{12}\cdot\mathsf{isu}({p}_{1},{t}_{1})\cdot\beta_{21}$) then after executing $\mathsf{del}(q^{\prime},{t}_{0})$ we obtain a cycle in the transactional happens-before. Thus, we can remove $({p}^{\prime},{t}^{\prime})$ from both traces and still obtain a robustness violation. Let $\tau^{\prime}$ be the resulting trace. $\tau^{\prime}$ has the same number of delays as $\tau$. In $\tau^{\prime}$, we do not have events that read values that ${t}$ overwrites. Therefore, we do not need to delay the transaction ${t}$ to ensure that that the trace is a violation. Let $\tau^{\prime\prime}$ be the resulting trace where the transaction ${t}$ executes atomically. In $\tau^{\prime\prime}$, the transaction ${t}$ was not delayed after the issue event of ${t}_{1}$ which means that $\tau^{\prime\prime}$ has less delays than $\tau$. This contradicts the fact that $\tau$ is a minimal violation.

Case $(c)$: we assume that $\mathsf{del}(q^{\prime},{t}_{0})$ happens-before after $({p}^{\prime},{t}^{\prime})$, otherwise, we can reorder it before $({p}^{\prime},{t}^{\prime})$ and get case $(b)$. Since $\mathsf{\gamma}_{\mathsf{S}}^{1}$ contains only store events, then by the happens-before definition, $\mathsf{del}(q^{\prime},{t}_{0})$ must be a store event executed by ${p}^{\prime}$ which means that $q^{\prime}={p}^{\prime}$. Let $e_{1}$ and $e_{2}$ be the read/write actions ${t}^{\prime}$ that are the source of the conflict between $({p}^{\prime},{t}^{\prime})$ and $\mathsf{del}({p}^{\prime},{t})$ and the happens-before between $({p}^{\prime},{t}^{\prime})$ and $\mathsf{del}({p}^{\prime},{t}_{0})$, respectively. Similar to before we assume w.l.o.g that there is no event in $\beta_{12}\cdot\mathsf{isu}({p}_{1},{t}_{1})\cdot\beta_{2}$ that reads a value that ${t}_{0}$ overwrites. We consider the two cases: i) $e_{2}$ occurs before $e_{1}$ in ${t}^{\prime}$ or the two coincide, and ii) $e_{1}$ occurs before $e_{2}$ in ${t}^{\prime}$. In the first case we can obtain a new violation where we do not delay the transaction ${t}$ which will not affect the action $e_{2}$ that is the source of the happens-before between $({p}^{\prime},{t}^{\prime})$ and $\mathsf{del}({p}^{\prime},{t}_{0})$ (since $e_{1}$ occurs after $e_{2}$ then it cannot disable it). The new trace $\tau^{\prime}$ is a violation since the store event $\mathsf{del}({p}^{\prime},{t}_{0})$ is delayed. Also, since the store event $\mathsf{del}({p}^{\prime},{t})$ of ${t}$ was not delayed after $\mathsf{isu}({p}_{1},{t}_{1})$ then $\tau^{\prime}$ has less delays than $\tau$, which contradicts the fact that $\tau$ is a minimal violation. In the second case, if in $\beta_{12}\cdot\mathsf{isu}({p}_{1},{t}_{1})\cdot\beta_{2}$ we do not have any event that is causally dependent on $\mathsf{isu}(q,{t}_{0})$ other than the store events of ${t}_{0}$, then we can remove all events of ${t}_{0}$ from $\tau$ without affecting the happens before between $\mathsf{isu}({p},{t})$ and $\mathsf{del}({p}^{\prime},{t})$ through $\beta_{12}\cdot\mathsf{isu}({p}_{1},{t}_{1})\cdot\beta_{2}\cdot({p}^{\prime},{t}^{\prime})$. Let $\tau^{\prime}=\mathsf{\alpha}_{\mathsf{A}}\cdot\mathsf{isu}({p},{t})\cdot\beta_{1}^{\prime}\cdot\mathsf{isu}({p}_{1},{t}_{1})\cdot\beta_{2}\cdot({p}^{\prime},{t}^{\prime})\cdot\mathsf{del}({p}^{\prime},{t})\cdot\mathsf{\gamma}_{\mathsf{S}}^{\prime}$ be the resulting trace which has the same number of delays as $\tau$. Otherwise, if in $\beta_{12}\cdot\mathsf{isu}({p}_{1},{t}_{1})\cdot\beta_{2}$ we have an event $a$ that is causally dependent on $\mathsf{isu}(q,{t}_{0})$ that is not a store event of ${t}_{0}$, then the new trace ${t}^{\prime}$ resulting from not delaying ${t}_{0}$ is a violation. This is because the store event $\mathsf{del}({p}^{\prime},{t})$ is delayed. $\tau^{\prime}$ has less delays than $\tau$ since the store event $\mathsf{del}({p}^{\prime},{t}_{0})$ of ${t}_{0}$ was not delayed after $a$. This contradicts the fact that $\tau$ is a minimal violation.

Now, we show that for every two successive issue events of delayed transactions in $\tau^{\prime}$, we can deliver the first to the process of the second before the second is issued. Let $\mathit{ev}_{i}=\mathsf{isu}({p}_{i},{t}_{i})$ and $\mathit{ev}_{j}=\mathsf{isu}({p}_{j},{t}_{j})$ be two successive issue events of delayed transactions in $\beta_{1}\cdot\mathsf{isu}({p}_{1},{t}_{1})$ s.t. either $(\mathit{ev}_{i},\mathit{ev}_{j})\in{\mathsf{HB}}$ or $(\mathit{ev}_{i},\mathsf{del}({p}_{i},{t}_{j}))\in{\mathsf{HB}}$. Note that the only case where the store event $\mathsf{del}({p}_{j},{t}_{i})$ cannot be moved to occur before $\mathit{ev}_{j}$ in $\beta_{1}$ is when the two events are related by a happens-before relation, i.e., $(\mathit{ev}_{j},\mathsf{del}({p}_{j},{t}_{i}))\in{\mathsf{HB}}$. In this case, we get that the transactions ${t}_{i}$ and ${t}_{j}$ are involved in a cycle in the transactional happens-before in $\tau^{\prime}$ which means that $\tau^{\prime\prime}=\mathsf{\alpha}_{\mathsf{A}}\cdot({p},{t})\cdot\beta_{1}\cdot\mathsf{isu}({p}_{1},{t}_{1})\cdot\mathsf{\gamma}_{\mathsf{S}}$ is a violation which has less delays than $\tau$ (since ${t}$ was not delayed after $\mathsf{isu}({p}_{1},{t}_{1})$). Therefore, the trace $\tau^{\prime\prime}$ where the store event $\mathsf{del}({p}_{j},{t}_{i})$ occurs before $\mathit{ev}_{2}$ is happens-before equivalent to $\tau^{\prime}$. Similarly, when the two events are concurrent, the trace $\tau^{\prime\prime}$ where the store event $\mathsf{del}({p}_{j},{t}_{i})$ occurs before $\mathit{ev}_{j}$ is happens-before equivalent to $\tau^{\prime}$. Thus, given the sequence of issue events $\mathit{ev}_{1}\cdot\mathit{ev}_{2}\cdot\ldots\mathit{ev}_{n}$ of delayed transactions in $\tau^{\prime}$ s.t. $\mathit{ev}_{1}=\mathsf{isu}({p},{t})$ and $\mathit{ev}_{n}=\mathsf{isu}({p}_{1},{t}_{1})$, the trace $\tau^{\prime\prime}$ where for every $1\leq k\leq n-1$ s.t. $\mathit{ev}_{k}=\mathsf{isu}({p}_{k},{t}_{k})$ and $\mathit{ev}_{k+1}=\mathsf{isu}({p}_{k+1},{t}_{k+1})$, we have the store event $\mathsf{del}({p}_{k+1},{t}_{k})$ occurs before the issue event $\mathit{ev}_{k+1}$ is happens-before equivalent to $\tau^{\prime}$. Also, in $\tau^{\prime\prime}$ for every $2\leq k\leq n$, we have that $\mathit{ev}_{k}$ is causally dependent on $\mathit{ev}_{1}=\mathsf{isu}({p},{t})$. Thus, in $\tau^{\prime\prime}$ the sequence of issue events $\mathit{ev}_{1}\cdot\mathit{ev}_{2}\cdot\ldots\mathit{ev}_{n}$ of delayed transactions forms a causality chain.

Next, we show that for minimal violations in $\mathbb{T}\mathsf{ccv2}$ where ${t}$ and ${t}_{1}$ are distinct transactions, all delayed transactions in $\mathsf{isu}({p},{t})\cdot\beta_{1}$ do not access the shared variable $x$ that starts the happens-before path in $\beta_{2}$ (Lemma 11) between $\mathsf{isu}({p}_{1},{t}_{1})$ and $({p}^{\prime},{t}^{\prime})$. If this were not the case, then the events of ${t}_{1}$ can be removed and we still guarantee a happens-before path to $\mathsf{del}({p}^{\prime},{t})$ (starting in the delayed transaction accessing the variable $x$), thus obtaining a new robustness violation trace with less delays (since $\mathsf{del}({p}^{\prime},{t})$ was not delayed after $\mathsf{isu}({p}_{1},{t}_{1})$), which contradicts the minimality assumption.

Lemma 14**.**

Let $\tau$ be a minimal violation in $\mathbb{T}\mathsf{ccv2}$ where ${t}_{1}$ and ${t}$ are two distinct transactions. Then, all the delayed transactions in $\mathsf{isu}({p},{t})\cdot\beta_{1}$ do not access the variable $x$ from Lemma 11.

Proof 6.4**.**

Suppose by contradiction that we have an issue event $\mathsf{isu}({p}_{2},{t}_{2})$ in $\mathsf{isu}({p},{t})\cdot\beta_{1}$ (i.e., $\mathsf{isu}({p},{t})\cdot\beta_{1}=\mathsf{isu}({p},{t})\cdot\beta_{11}\cdot\mathsf{isu}({p}_{2},{t}_{2})\cdot\beta_{12}$) which accesses the shared variable $x$ with either a read or a write instruction. Then, since there exists an event $a\in\beta_{2}$ s.t. $(\mathsf{isu}({p}_{1},{t}_{1}),a)\in{\mathsf{WW}}(x)\cup({\mathsf{STO}};{\mathsf{RW}}(x))$, we have that $(\mathsf{isu}({p}_{2},{t}_{2}),a)\in{\mathsf{WW}}(x)\cup({\mathsf{STO}};{\mathsf{RW}}(x))$. Moreover, because $\beta_{2}\cdot({p}^{\prime},{t}^{\prime})\cdot\mathsf{del}({p}^{\prime},{t})\cdot\mathsf{\gamma}_{\mathsf{S}}$ does not contain any transaction that causally depends on $\mathsf{isu}({p}_{1},{t}_{1})$, we get that $\mathsf{isu}({p}_{1},{t}_{1})$ is the issue event by the process ${p}_{1}$ and we can remove it together with all the related stores in $\mathsf{\gamma}_{\mathsf{S}}$ to obtain: $\tau^{\prime}=\mathsf{\alpha}_{\mathsf{A}}\cdot\mathsf{isu}({p},{t})\cdot\beta_{11}\cdot\mathsf{isu}({p}_{2},{t}_{2})\cdot\beta_{12}\cdot\beta_{2}\cdot({p}^{\prime},{t}^{\prime})\cdot\mathsf{del}({p}^{\prime},{t})\cdot\mathsf{\gamma}_{\mathsf{S}}^{\prime}$ which is a violation because $\mathsf{isu}({p},{t})$ happens-before $\mathsf{del}({p}^{\prime},{t})$ through $\beta_{11}\cdot\mathsf{isu}({p}_{2},{t}_{2})\cdot\beta_{12}\cdot\beta_{2}\cdot({p}^{\prime},{t}^{\prime})$. Furthermore, $\tau^{\prime}$ has less delays than $\tau$ since $\mathsf{del}({p}^{\prime},{t})$ was not delayed after $\mathsf{isu}({p}_{1},{t}_{1})$. This contradicts the fact that $\tau$ is a minimal violation.

7. Robustness Violations Under Causal Memory

The characterization of robustness violations under ${\tt CM}{}$ is at some level similar to that of robustness violations under ${\tt CCv}{}$. However, some instance of the violation pattern under CCv is not possible under CM and CM admits some class of violations that is not possible under CCv. This reflects the fact that these consistency models are incomparable in general.

The following theorem gives the characterization of minimal violations under CM which is pictured in Fig. 13. Roughly, a program is not robust iff it admits a violation that either contains two concurrent transactions that write to the same variable, or it is a restriction of the pattern $\tau_{{\tt CCv}{}2}$ admitted by CCv where the last delayed transaction is related only by ${\mathsf{RW}}$ to future transactions. The first pattern is not admitted by ${\tt CCv}{}$ because the writes to each variable are executed according to the timestamp order (CM does not satisfy the ${\tt CCv}{}$ property stated in Lemma 1).

Theorem 15**.**

A program $\mathcal{P}$ is not robust under CM iff there exists a minimal violation in $\mathbb{T}\mathsf{r}(\mathcal{P})_{{\tt CM}{}}$ of one of the following forms:

1. (1)

$\tau_{{\tt CM}{}1}=\mathsf{\alpha}_{\mathsf{A}}\cdot\mathsf{isu}({p},{t})\cdot\mathsf{del}({p},{t})\cdot\beta\cdot({p}^{\prime},{t}^{\prime})\cdot\mathsf{del}({p}^{\prime},{t})\cdot\mathsf{\gamma}_{\mathsf{S}}$, where:

1. (a)

$\mathsf{isu}({p},{t})$* is the issue of the first and only delayed transaction;* 2. (b)

$\exists\ y.$* s.t. $(\mathsf{del}({p},{t}),({p}^{\prime},{t}^{\prime}))\in{\mathsf{WW}}(y)$ and $(({p}^{\prime},{t}^{\prime}),\mathsf{del}({p}^{\prime},{t}))\in{\mathsf{WW}}(y)$ (Lemma 17);* 3. (c)

$\forall\ a\in\beta.\ (\mathsf{isu}({p},{t}),a)\in{\mathsf{HB}}\setminus\mathsf{CO}\mbox{ and }(a,({p}^{\prime},{t}^{\prime}))\in\mathsf{CO}$* (Lemma 17).* 2. (2)

$\tau_{{\tt CM}{}2}=\mathsf{\alpha}_{\mathsf{A}}\cdot\mathsf{isu}({p},{t})\cdot\beta_{1}\cdot\mathsf{isu}({p}_{1},{t}_{1})\cdot\beta_{2}\cdot({p}^{\prime},{t}^{\prime})\cdot\mathsf{del}({p}^{\prime},{t})\cdot\mathsf{\gamma}_{\mathsf{S}}$, where

1. (a)

$\mathsf{isu}({p},{t})$* and $\mathsf{isu}({p}_{1},{t}_{1})$ are the issues of the first and last delayed transactions (Lemma 17);* 2. (b)

the issues of all delayed transactions are in $\beta_{1}$ are included in a causality chain that starts with $\mathsf{isu}({p},{t})$ and ends with $\mathsf{isu}({p}_{1},{t}_{1})$; 3. (c)

for every $a\in\beta_{2}$, we have that $(\mathsf{isu}({p}_{1},{t}_{1}),a)\in{\mathsf{HB}}\setminus\mathsf{CO}$ and $(a,({p}^{\prime},{t}^{\prime}))\in{\mathsf{HB}}$ (Lemma 17); 4. (d)

there exist $a\in\beta_{2}\cdot({p}^{\prime},{t}^{\prime})$, $x$, and $y$ s.t. $x\neq y$, $(\mathsf{isu}({p}_{1},{t}_{1}),a)\in{\mathsf{RW}}(x)$, $(a,({p}^{\prime},{t}^{\prime}))\in{\mathsf{HB}}{}?$, and $(({p}^{\prime},{t}^{\prime}),\mathsf{del}({p}^{\prime},{t}))\in{\mathsf{RW}}(y)$ (Lemma 17); 5. (e)

all delayed transactions in $\mathsf{isu}({p},{t})\cdot\beta_{1}$ do not access the variable $x$.

The violation pattern $\tau_{{\tt CM}{}2}$ is a restriction of the pattern $\tau_{{\tt CCv}{}2}$ under CCv. For instance, the trace in Fig.12(b) is a valid minimal violation of the SB program under CM. The violation pattern $\tau_{{\tt CM}{}1}$ implies the existence of a write-write race under CM. Fig.14 shows a minimal violation under CM that corresponds to a write-write race in the LU program. Conversely, if a program $\mathcal{P}$ admits a trace $\tau$ which contains a write-write race under CM, then $\mathcal{P}$ also admits a trace $\tau^{\prime}$ where the two transactions ${t}_{1}$ and ${t}_{2}$ that caused the write-write race form a cycle in the store order (the store events of ${t}_{1}$ and ${t}_{2}$ on the two processes ${p}_{1}$ and ${p}_{2}$ that issued them can be reordered to occur in opposite orders, i.e., $\mathsf{del}({p}_{1},{t}_{1})$ before $\mathsf{del}({p}_{1},{t}_{2})$ and $\mathsf{del}({p}_{2},{t}_{2})$ before $\mathsf{del}({p}_{2},{t}_{1})$, which implies that are also in opposite orders w.r.t. the store order). Thus, $\mathcal{P}$ has a trace $\tau^{\prime}$ with a cycle in the transactional happens-before which means that $\mathcal{P}$ is not robust against CM. Therefore, a program which is robust against CM is also write-write race free under CM. Since without write-write races, the CM and the CCv semantics coincide, we get the following the result.

Lemma 16**.**

If a program $\mathcal{P}$ is robust against CM, then $\mathcal{P}$ is robust against CCv.

Next, we discuss the proof of Theorem 15. The following lemma reveals the two possible minimal violation patterns under causal memory. The characterization of the patterns in this lemma can be refined further using arguments similar to the case of CCv (see the discussion at the end of this section).

Lemma 17**.**

If $\mathcal{P}$ is a program that is not robust under CM, then it must admit a minimal violation $\tau$ that satisfies one of the following:

1. (1)

$\tau=\mathsf{\alpha}_{\mathsf{A}}\cdot\mathsf{isu}({p},{t})\cdot\mathsf{del}({p},{t})\cdot\beta\cdot({p}^{\prime},{t}^{\prime})\cdot\mathsf{del}({p}^{\prime},{t})\cdot\mathsf{\gamma}_{\mathsf{S}}\mbox{ where: }$**

1. (a)

$\exists\ y.$* s.t. $(\mathsf{del}({p},{t}),({p}^{\prime},{t}^{\prime}))\in{\mathsf{WW}}(y)$ and $(({p}^{\prime},{t}^{\prime}),\mathsf{del}({p}^{\prime},{t}))\in{\mathsf{WW}}(y)$;* 2. (b)

$\forall\ a\in\beta.\ (\mathsf{isu}({p},{t}),a)\in{\mathsf{HB}}\setminus\mathsf{CO}\mbox{ and }(a,({p}^{\prime},{t}^{\prime}))\in\mathsf{CO}$. 2. (2)

$\tau=\mathsf{\alpha}_{\mathsf{A}}\cdot\mathsf{isu}({p},{t})\cdot\beta_{1}\cdot\mathsf{isu}({p}_{1},{t}_{1})\cdot\beta_{2}\cdot({p}^{\prime},{t}^{\prime})\cdot\mathsf{del}({p}^{\prime},{t})\cdot\mathsf{\gamma}_{\mathsf{S}}\mbox{ where: }$**

1. (a)

$\mathsf{isu}({p}_{1},{t}_{1})$* is the last issue event from $\{c\in\beta\ |\ (\mathsf{isu}({p},{t}),c)\in\mathsf{CO}\}$ in $\tau$;* 2. (b)

there exist two variables $x\neq y$, $a$ in $\beta_{2}\cdot({p}^{\prime},{t}^{\prime})$, and $b=({p}^{\prime},{t}^{\prime})$ such that $(\mathsf{isu}({p}_{1},{t}_{1}),a)\in{\mathsf{RW}}(x)$, $(b,\mathsf{del}({p}^{\prime},{t}))\in{\mathsf{RW}}(y)$, and $(a,b)\in{\mathsf{HB}}{}?$; 3. (c)

$\forall\ a\in\beta_{2}.\ (\mathsf{isu}({p}_{1},{t}_{1}),a)\in{\mathsf{HB}}\setminus\mathsf{CO}\mbox{ and }(a,({p}^{\prime},{t}^{\prime}))\in{\mathsf{HB}}$.

Proof 7.1**.**

The proof will contain many arguments which are similar to those used in the proof of Lemma 11. Let $\tau=\mathsf{\alpha}_{\mathsf{A}}\cdot\mathsf{isu}({p},{t})\cdot\beta\cdot({p}^{\prime},{t}^{\prime})\cdot\mathsf{del}({p}^{\prime},{t})\cdot\mathsf{\gamma}_{\mathsf{S}}$ be a minimal violation under CM (cf. Lemma 9). We prove that there exists a minimal violation trace $\tau^{\prime}$ obtained from $\tau$ that satisfies ($1$) or ($2$). Similar to Lemma 11, we get that there must exist $y$ s.t. $(({p}^{\prime},{t}^{\prime}),\mathsf{del}({p}^{\prime},{t}))\in{\mathsf{RW}}(y)\cup{\mathsf{WW}}(y)$.

We consider two cases: i) $(({p}^{\prime},{t}^{\prime}),\mathsf{del}({p}^{\prime},{t}))\in{\mathsf{WW}}(y)$, and ii) $(({p}^{\prime},{t}^{\prime}),\mathsf{del}({p}^{\prime},{t}))\in{\mathsf{RW}}(y)$. If $(({p}^{\prime},{t}^{\prime}),\mathsf{del}({p}^{\prime},{t}))\in{\mathsf{WW}}(y)$, then by reordering the store event $\mathsf{del}({p},{t})\in\mathsf{\gamma}_{\mathsf{S}}$ to occur just after the corresponding issue and removing all events in $\beta$ (and all related stores in $\mathsf{\gamma}_{\mathsf{S}}$) that are not causally ordered before $({p}^{\prime},{t}^{\prime})$ (since they do not contribute to the transactional happens-before cycle) we obtain a trace $\tau^{\prime}=\mathsf{\alpha}_{\mathsf{A}}\cdot\mathsf{isu}({p},{t})\cdot\mathsf{del}({p},{t})\cdot\beta^{\prime}\cdot({p}^{\prime},{t}^{\prime})\cdot\mathsf{del}({p}^{\prime},{t})\cdot\mathsf{\gamma}_{\mathsf{S}}^{\prime}$ that is also a minimal violation and where $(\mathsf{del}({p},{t}),({p}^{\prime},{t}^{\prime}))\in{\mathsf{WW}}(y)$ and $(({p}^{\prime},{t}^{\prime}),\mathsf{del}({p}^{\prime},{t}))\in{\mathsf{WW}}(y)$. The trace $\tau^{\prime}$ satisfies the first case of the lemma.

Now assume that $(({p}^{\prime},{t}^{\prime}),\mathsf{del}({p}^{\prime},{t}))\in{\mathsf{RW}}(y)$, and let $\sigma=\{c\in\beta\ |\ (\mathsf{isu}({p},{t}),c)\in\mathsf{CO}\}$. We consider the following three cases.

First, assume that $\sigma$ is empty. As in the proof of Lemma 11, we obtain that there exist $a\in\beta\cdot({p}^{\prime},{t}^{\prime})$ and $x$ s.t. $(\mathsf{isu}({p},{t}),a)\in{\mathsf{RW}}(x)$ and $(a,({p}^{\prime},{t}^{\prime}))\in{\mathsf{HB}}?$. If $x=y$ then both ${t}$ and the transaction ${t}_{2}$ by a process ${p}_{2}$ of the event $a$ write to $x$. Similar to before we can reorder the store event $\mathsf{del}({p},{t})\in\mathsf{\gamma}_{\mathsf{S}}$ to occur just after the corresponding issue and remove all issue events in $\beta\cdot({p}^{\prime},{t}^{\prime})$ that occur after the issue event of ${t}_{2}$ and all their related stores. Also, we remove all events in $\beta$ that are not causally ordered before the issue event of ${t}_{2}$. We obtain $\tau^{\prime}=\mathsf{\alpha}_{\mathsf{A}}\cdot\mathsf{isu}({p},{t})\cdot\mathsf{del}({p},{t})\cdot\beta^{\prime}({p}_{2},{t}_{2})\cdot\mathsf{del}({p}_{2},{t})\cdot\mathsf{\gamma}_{\mathsf{S}}^{\prime}$. In $\tau^{\prime}$ the events of ${t}_{2}$ are assembled together, $\mathsf{del}({p}_{2},{t})\in\mathsf{\gamma}_{\mathsf{S}}$ is reordered to occur just after $({p}_{2},{t}_{2})$, and $(\mathsf{del}({p},{t}),({p}_{2},{t}_{2}))\in{\mathsf{WW}}(y)$ and $(({p}_{2},{t}_{2}),\mathsf{del}({p}_{2},{t}))\in{\mathsf{WW}}(y)$. Thus, $\tau^{\prime}$ is a minimal violation and it satisfies the first case of the lemma. If $x\neq y$ then we get the second case of the lemma.

Second, assume that $\sigma$ is not empty and all the elements of $\sigma$ are store events. As in the proof of Lemma 11, we obtain that there exist $x$ and an event $a\in\beta\cdot({p}^{\prime},{t}^{\prime})$ that is not a store event of ${t}$ s.t. $(\mathsf{isu}({p},{t}),a)\in({\mathsf{STO}};{\mathsf{WW}}(x))\cup{\mathsf{RW}}(x)$ and $(a,({p}^{\prime},{t}^{\prime}))\in{\mathsf{HB}}?$. If $(\mathsf{isu}({p},{t}),a)\in({\mathsf{STO}};{\mathsf{WW}}(x))$ or $x=y$ then both ${t}$ and the transaction ${t}_{2}$ by a process ${p}_{2}$ of the event $a$ write to $x$. Using the same procedure as in the previous paragraph we can obtain $\tau^{\prime}=\mathsf{\alpha}_{\mathsf{A}}\cdot\mathsf{isu}({p},{t})\cdot\mathsf{del}({p},{t})\cdot\beta^{\prime}\cdot({p}_{2},{t}_{2})\cdot\mathsf{del}({p}_{2},{t})\cdot\mathsf{\gamma}_{\mathsf{S}}^{\prime}$ that satisfies the first case of the lemma. Similarly, if $(\mathsf{isu}({p},{t}),a)\in{\mathsf{RW}}(x)$ and $x\neq y$ then we get the second case of the lemma.

*Third, assume that $\sigma$ is not empty and $\mathsf{isu}({p}_{1},{t}_{1})$ is the last issue event in $\sigma$, i.e., $\beta=\beta_{1}\cdot\mathsf{isu}({p}_{1},{t}_{1})\cdot\beta_{2}\cdot({p}^{\prime},{t}^{\prime})$. As in the proof of Lemma 11, we obtain that there exist $x$ and an event $a\in\beta_{2}\cdot({p}^{\prime},{t}^{\prime})$ that is not a store event of ${t}_{1}$ s.t. $(\mathsf{isu}({p}_{1},{t}_{1}),a)\in({\mathsf{STO}};{\mathsf{WW}}(x))\cup{\mathsf{RW}}(x)$ and $(a,({p}^{\prime},{t}^{\prime}))\in{\mathsf{HB}}?$. If $x=y$ then both ${t}$ and the transaction ${t}_{2}$ by a process ${p}_{2}$ of the event $a$ write to $x$. Using the same procedure as before we can obtain a trace $\tau^{\prime}=\mathsf{\alpha}_{\mathsf{A}}\cdot\mathsf{isu}({p},{t})\cdot\mathsf{del}({p},{t})\cdot\beta_{1}^{\prime}\cdot\beta_{2}^{\prime}\cdot({p}_{2},{t}_{2})\cdot\mathsf{del}({p}_{2},{t})\cdot\mathsf{\gamma}_{\mathsf{S}}^{\prime}$ that is a minimal violation. $\tau^{\prime}$ has less delays than $\tau$ since the store of ${t}$ was not delayed after $\mathsf{isu}({p}_{1},{t}_{1})$. This contradicts the fact that $\tau$ is a minimal violation. Assume now that $x\neq y$. We assume w.l.o.g. that all events in $\beta_{2}$ do not read values that any transaction with an issue event in $\mathsf{isu}({p},{t})\cdot beta_{1}\cdot\mathsf{isu}({p}_{1},{t}_{1})$ overwrites. If $(\mathsf{isu}({p}_{1},{t}_{1}),a)\in({\mathsf{STO}};{\mathsf{WW}}(x))$ and $a\neq({p}^{\prime},{t}^{\prime})$ then we can remove all issue events in $\beta_{2}\cdot({p}^{\prime},{t}^{\prime})$ that occur after the issue event of ${t}_{2}$ including $({p}^{\prime},{t}^{\prime})$ and assemble together the events of ${t}_{2}$. We obtain that $(\mathsf{del}({p}_{1},{t}_{1}),({p}_{2},{t}_{2}))\in{\mathsf{WW}}(x)$ and $(({p}_{2},{t}_{2}),\mathsf{del}({p}_{2},{t}_{1}))\in{\mathsf{WW}}(x)$ where we do not need to delay the transaction ${t}$ and obtain $\tau^{\prime}=\mathsf{\alpha}_{\mathsf{A}}\cdot({p},{t})\cdot\beta_{1}^{\prime}\cdot\mathsf{isu}({p}_{1},{t}_{1})\cdot\mathsf{del}({p}_{1},{t}_{1})\cdot\beta_{2}^{\prime}\cdot({p}_{2},{t}_{2})\cdot\mathsf{del}({p}_{2},{t}_{1})\cdot\mathsf{\gamma}_{\mathsf{S}}^{\prime}$ that is a violation and has less delays than $\tau$. This contradicts the fact that $\tau$ is a minimal violation. If $(\mathsf{isu}({p}_{1},{t}_{1}),a)\in({\mathsf{STO}};{\mathsf{WW}}(x))$ and $a=({p}^{\prime},{t}^{\prime})$ (i.e., ${t}^{\prime}={t}_{2}$) then we construct $\tau^{\prime}$ such that all transactions that have issue events in $\sigma$ and ${t}$ are executed atomically after all the events in $(\beta_{1}\setminus\sigma)\cdot\beta_{2}\cdot\mathsf{isu}({p}^{\prime},{t}^{\prime})\cdot\mathsf{del}({p}^{\prime},{t}^{\prime})$ are executed first, i.e., $\tau^{\prime}=\mathsf{\alpha}_{\mathsf{A}}\cdot\beta_{11}\cdot\beta_{2}\cdot\mathsf{isu}({p}^{\prime},{t}^{\prime})\cdot\mathsf{del}({p}^{\prime},{t}^{\prime})\cdot({p},{t})\cdot\beta_{12}\cdot\beta^{\prime}\cdot({p}_{1},{t}_{1})\cdot\mathsf{del}({p}_{1},{t}^{\prime})\cdot\mathsf{\gamma}_{\mathsf{S}}^{\prime}$. $\tau^{\prime}$ is a robustness violation since $(\mathsf{del}({p}^{\prime},{t}^{\prime}),({p}_{1},{t}_{1}))\in{\mathsf{WW}}(x)$ and $(({p}_{1},{t}_{1}),\mathsf{del}({p}_{1},{t}^{\prime}))\in{\mathsf{WW}}(x)$. Also, $\tau^{\prime}$ has less delays than $\tau$ since ${t}^{\prime}$ was not delayed after a causally dependent event other than its store events and ${t}$ is no longer delayed after the issue event of ${t}_{1}$. This contradicts the fact that $\tau$ is a minimal violation. Finally, the only remaining possibility is $(\mathsf{isu}({p}_{1},{t}_{1}),a)\in{\mathsf{RW}}(x)$ where $x\neq y$ which corresponds to the second case of the lemma. *

We use $\mathbb{T}\mathsf{cm1}$ and $\mathbb{T}\mathsf{cm2}$ to denote the class of minimal violations that satisfy the first and second case in Lemma 17, respectively. To show that for a non robust program, we can always find a minimal violation in either $\mathbb{T}\mathsf{cm1}$ or $\mathbb{T}\mathsf{cm2}$ where $\beta$ and $\beta_{2}$ do not contain delayed transactions we can use the same proof arguments as in Lemma 12. For minimal violations in $\mathbb{T}\mathsf{cm2}$ where ${t}$ and ${t}_{1}$ are distinct transactions, the two properties that issue events of all delayed transactions form a causality chain and that delayed transactions in $\mathsf{isu}({p},{t})\cdot\beta_{1}$ do not access the shared variable $x$ can also be proved in the same manner as in Lemmas 13 and 14, respectively.

8. Robustness Violations Under Weak Causal Consistency

If a program is robust against CM, then it must not contain a write-write race under CM (note that this is not true for CCv). Therefore, by Theorem 4, a program which is robust against CM has the same set of traces under both CM and CC, which implies that it is also robust against CC. Conversely, since CC is weaker than CM (i.e., $\mathbb{T}\mathsf{r}_{{\tt CM}{}}(\mathcal{P})\subseteq\mathbb{T}\mathsf{r}_{{\tt CC}{}}(\mathcal{P})$ for any $\mathcal{P}$), if a program is robust against CC then it is robust against CM. Thus, we obtain the following result.

Theorem 18**.**

A program $\mathcal{P}$ is robust against CC iff it is robust against CM.

9. Reduction to SC Reachability

We describe a reduction of robustness checking to a reachability problem in a program executing under the serializability semantics, which can be simulated on top of standard sequential consistency (SC) by considering that each transaction is an atomic section (guarded by a fixed global lock). Essentially, given a program $\mathcal{P}$ and a semantics $\textsf{X}\in\{{\tt CCv}{},\ {\tt CM}{},\ {\tt CC}{}\}$, we define an instrumentation of $\mathcal{P}$ such that $\mathcal{P}$ is not robust against X iff the instrumentation reaches an error state under the serializability semantics. The instrumentation uses auxiliary variables in order to simulate the robustness violations (in particular, the delayed transactions) satisfying the patterns given in Fig. 11 and Fig. 13. We will focus our presentation on the second violation pattern of CCv (which is similar to the second violation pattern of CM): $\tau_{{\tt CCv}{}2}=\mathsf{\alpha}_{\mathsf{A}}\cdot\mathsf{isu}({p},{t})\cdot\beta_{1}\cdot\mathsf{isu}({p}_{1},{t}_{1})\cdot\beta_{2}\cdot({p}^{\prime},{t}^{\prime})\cdot\mathsf{del}({p}^{\prime},{t})\cdot\mathsf{\gamma}_{\mathsf{S}}$.

The process ${p}$ that delayed the first transaction ${t}$ is called the Attacker. The other processes delaying transactions in $\beta_{1}\cdot\mathsf{isu}({p}_{1},{t}_{1})$ are called Visibility Helpers. Recall that all the delayed transactions must be causally ordered after $\mathsf{isu}({p},{t})$. The processes that execute transactions in $\beta_{2}\cdot({p}^{\prime},{t}^{\prime})$ and contribute to the happens-before path between $\mathsf{isu}({p}_{1},{t}_{1})$ and $\mathsf{del}({p}^{\prime},{t})$ are called Happens-Before Helpers. A happens-before helper cannot be the attacker or a visibility helper since this would contradict the causal delivery guarantee provided by causal consistency (a transaction of a happens-before helper is not delayed, so visible immediately to all processes, and it cannot follow a delayed transaction). $\mathsf{\gamma}_{\mathsf{S}}$ contains the stores of the delayed transactions in $\mathsf{isu}({p},{t})\cdot\beta_{1}\cdot\mathsf{isu}({p}_{1},{t}_{1})$. It is important to notice that we may have ${t}={t}_{1}$. In this case, $\beta_{1}=\epsilon$ and the only delayed transaction is ${t}$. Also, all delayed transactions in $\beta_{1}$ including ${t}_{1}$ may be issued by the same process as ${t}$. In all of these cases, the set of Visibility Helpers is empty.

The instrumentation uses two copies of the set of shared variables in the original program. We use primed variables $x^{\prime}$ to denote the second copy. When a process becomes the attacker or a visibility helper, it will write only to the second copy that is visible only to these processes (and remains invisible to the other processes including the happens-before helpers). The writes made by other processes including the happens-before helpers are made visible to all processes, i.e., they are applied on both copies of every shared variable.

To establish the causality chains of the delayed transactions issued by the attacker and the visibility helpers, we look whether a transaction can extend the causality chain started by the first delayed transaction issued by the attacker. This is to ensure that all such transactions are causally related to the first delayed transaction (of the attacker). In order for a transaction to “join” the causality chain, it has to satisfy one of the following conditions:

• •

the transaction is issued by a process that has already another transaction in the causality chain. Thus, we ensure the continuity of the causality chain through program order;

• •

the transaction is reading from a variable that was updated by a previous transaction in the causality chain. Hence, we ensure the continuity of the causality chain through the write-read relation.

We introduce a flag for each shared variable to mark the fact that it was updated by a previous transaction in the causality chain. These flags are used by the instrumentation to establish whether a transaction “joins” a causality chain. Enforcing a happens-before path starting in the last delayed transaction, using transactions of the happens-before helpers, can be done in the same way. Compared to causality chains, there are two more cases in which a transaction can extend a happens-before path:

• •

the transaction writes to a shared variable that was read by a previous transaction in the happens-before path. Hence, we ensure the continuity of the happens-before path through the read-write relation;

• •

the transaction writes to a shared variable that was updated by a previous transaction in the happens-before path. Hence, we ensure the continuity of the happens-before path through write-write order.

Thus, we extend the shared variables flags used for causality chains in order to record if a variable was read or written by a previous transaction (in this case, a previous transaction in the happens-before path). Overall, the instrumentation uses a flag $x.event$ or $x^{\prime}.event$ for each (copy of a) shared variable, that stores the type of the last access (read or write) to the variable. Initially, these flags and other flags used by the instrumentation as explained below are initialized to null ($\perp$).

In general, whether a process is an attacker, visibility helper, or happens-before helper is not enforced syntactically by the instrumentation, and can vary from execution to execution. The role of a process in an execution is set non-deterministically during the execution using some additional process-local flags. Thus, during an execution, each process chooses to set to $\mathsf{true}$ at most one of the flags $p.a$, $p.vh$, and $p.hbh$, implying that the process becomes an attacker, visibility helper, or happens-before helper, respectively. At most one process can be an attacker, i.e., set $p.a$ to $\mathsf{true}$.

9.1. Instrumentation of the Attacker

We provide in Fig. 15, the instrumentation of the instructions for the attacker process. Such a process passes through an initial phase where it executes transactions that are visible immediately to all the other processes (i.e., they are not delayed), and then non-deterministically it can choose to delay a transaction. When the attacker randomly chooses the first transaction to start delaying of transactions, it sets a global flag $a_{\mathsf{tr}_{\mathsf{A}}}$ to $\mathsf{true}$ in the instruction $\mathsf{begin}$ (line (3)). Then, it sets the flag $p.a$ to $\mathsf{true}$ to indicate that the current process is the attacker. During the first delayed transaction, the attacker non-deterministically chooses a write instruction to a shared variable $y$ and stores the name of this variable in the flag $a_{\mathsf{st}_{\mathsf{A}}}$ (line (8)). The values written during delayed transactions are stored in the primed variables and are visible only to the attacker and the visibility helpers. For example, given a variable $z$, all the writes to $z$ from the original program are transformed into writes to the primed version $z^{\prime}$ (line (6)). Each time the attacker writes to a variable $z^{\prime}$, it sets the flag $z^{\prime}.event$ to $\mathsf{st}$ (line (7)) which will allow other processes that read the same variable to join the set of visibility helpers and start delaying their transactions. Once the attacker delays a transaction, it will read only from the primed variables (i.e., $z^{\prime}$).

To start the happens-before path, the attacker has to execute a transaction that either reads or writes to a shared variable $x$ that was not accessed by a delayed transaction (i.e., $x^{\prime}.event=\perp$). In this case, it sets the variable $\mathsf{HB}$ to $\mathsf{true}$ (lines (4) and (9)) to mark the start of the happens before path and the end of the visibility chains, and it sets the flag $x.event$ to $\mathsf{ld}$ (lines (5) and (10)). We set $x.event$ to $\mathsf{ld}$ even in the case of a write to $x$ in order to simplify the instrumentation of the happens-before helpers (to check that this transaction is related to a transaction of a happens-before helper $p$ through ${\mathsf{WW}}(x)$ or ${\mathsf{RW}}(x)$ it is enough that $p$ writes to $x$ and it “observers” the same value $\mathsf{ld}$ in $x.event$). When the flag $\mathsf{HB}$ is set to $\mathsf{true}$ the attacker stops executing new transactions. We can notice that when the $\mathsf{HB}$ is set to $\mathsf{true}$, we can no longer execute new transactions from the attacker (all conditions in lines (1) and (2) become $\mathsf{false}$).

9.2. Instrumentation of the Visibility Helpers

Fig. 16 lists the instrumentation of the instructions of a process that belongs to the set of visibility helpers. Such a process passes through an initial phase where it executes the original code instructions (lines (18) and (13)) until the flag $a_{\mathsf{tr}_{\mathsf{A}}}$ is set to $\mathsf{true}$ by the attacker. Then, it continues the execution of its original instructions but, whenever it stores a value it writes it to both the shared variable $z$ and the primed variable $z^{\prime}$ so it is visible to all processes. Non deterministically it chooses a first transaction to delay, at which point it joins the set of visibility helpers. It sets the flag $p.vh$ to $\mathsf{false}$ signaling its desire to join the visibility helpers, and it chooses a transaction (the $\mathsf{begin}$ of this transaction is shown in line (12)) through which the process will join the set of visibility helpers. The process directly starts delaying its writes, i.e., writing to primed variables, and reading only from delayed writes, i.e., from primed variables, and behaving the same as the attacker. In order to check that it can extend the sequence of causal dependencies (required by the causal chain definition), it takes a snapshot of the $\_.event$ fields at the beginning of the transaction and stores it to $\_.event^{\prime}$ fields (line $\mathsf{l}_{x4}$ in the instrumentation of $\mathsf{begin}$). This snapshot is necessary to check that it reads from writes made in other transactions (ignoring the writes in the current transaction). When a process choses a first transaction to delay (during the $\mathtt{begin}$ instruction), it has made a pledge that during this transaction it will read from a variable that was updated by a another delayed transaction from either the attacker or some other visibility helper. This is to ensure that this transaction extends the visibility chain. Hence, the local process flag $p.vh$ will be set to $\mathsf{true}$ when the process meets its pledge (line (15)). If the process does not keep its pledge (i.e., $p.vh$ is equal to $\mathsf{false}$) at the end of the transaction (i.e., during the $\mathtt{end}$ instruction) we block the execution. Thus, when executing the $\mathsf{end}$ instruction of the underlying transaction we check whether the flag $p.vh$ is null, if so we block the execution (line (23)).

When a process joins the visibility helpers, it delays all writes and reads only from the primed variables (lines (19) and (14)). Similar to the attacker, a process in the visibility helpers delays a write to a shared variable $z$ by writing to $z^{\prime}$, it sets the flag $z^{\prime}.event$ to $\mathsf{st}$ (line (20)). In order for a process in the visibility helpers to start the happens-before path, it has to either read or write a shared variable $x$ that was not accessed by a delayed transaction (i.e., $x^{\prime}.event=\perp$). In this case we set the flag $\mathsf{HB}$ to $\mathsf{true}$ (lines (21) and (16)) to mark the start of the happens before path and the end of the visibility chains and set the flag $x.event$ to $\mathsf{ld}$ (lines (22) and (17)). When the flag $\mathsf{HB}$ is set to $\mathsf{true}$, all processes in the set of visibility helpers stop issuing new transactions because all conditions for executing the $\mathsf{begin}$ instruction become $\mathsf{false}$.

9.3. Instrumentation of the Happens-Before Helpers

The remaining processes, which are not the attacker or a visibility helper, can become happens-before helpers. Fig. 17 lists the instrumentation of the instructions of a happens-before helper process. Similar to above, when the flag $a_{\mathsf{tr}_{\mathsf{A}}}$ is set to $\mathsf{true}$ by the attacker, other processes enter a phase where they continue executing their instructions, however, when they store a value they write it in both the shared variable $z$ and the primed variable $z^{\prime}$ (lines (25) and (26)). However, they only read from the original shared variables (line (29)). Once the flag ${\mathsf{HB}}$ is set to $\mathsf{true}$, a process that cannot be the attacker (i.e., the flag $p.a$ is null) or a visibility helper (i.e., the flag $p.vh$ is null) chooses non-deterministically a transaction ${t}$ (the $\mathsf{begin}$ of this transaction is shown in line (24)) through which it wants to join the set of happens-before helpers, i.e., continue the happens-before path created by the existing happens-before helpers. Similar to visibility helpers, when a process choses the transaction ${t}$, it makes a pledge (while executing the $\mathtt{begin}$ instruction) that during this transaction it will either read a variable updated by another happens-before helper or write to a variable that was accessed (read or written) by another happens-before helper (every process that executes a transaction after $\mathsf{HB}$ is set to $\mathsf{true}$ makes this pledge). When the pledge is met, the process sets the flag $p.hbh$ to $\mathsf{true}$ (lines (30) and (28)). The execution is blocked if a process does not keep its pledge (i.e., the flag $p.hbh$ is null) at the end of the transaction (line (35)). We use a flag $x.event$ for each variable $x$ to record the type (read $\mathsf{ld}$ or write $\mathsf{st}$) of the last access made by a happens-before helper (lines (31) and (27)). Moreover, once $\mathsf{HB}$ is set to $\mathsf{true}$ (i.e., there are no more delayed transactions), the process can write and read only the original shared variables, since the primed versions are no longer in use. A particular case is when the transaction ${t}$ is from the first process trying to join the happens-before helpers, in which the transaction must contain a read accessing the variable $x$ that was read or written to by a transaction from the attacker of a visibility helper.

The happens-before helpers continue executing their instructions, until one of them reads from the shared variable $y$ whose name was stored in $a_{\mathsf{st}_{\mathsf{A}}}$. This establishes a happens-before path between the last delayed transaction and a “fictitious” store event corresponding to the first delayed transaction that could be executed just after this read of $y$. The execution does not have to contain this store event explicitly since it is always enabled. Therefore, at the end of every transaction, the instrumentation checks whether the transaction read $y$. If it is the case, then the execution stops and goes to an error state to indicate that this is a robustness violation. The happens-before helpers processes continue executing their instructions, until one of them executes a load that reads from the shared variable $y$ that was stored in $a_{\mathsf{st}_{\mathsf{A}}}$ which implies the existence of a happens-before cycle. Thus, when executing the instruction $\mathsf{end}$ at the end of every transaction, we have a conditional check to detect if we have a load or a write accessing the variable $y$ (lines (32), (33), and (34)). When the check detects that the variable $y$ was accessed, the execution goes to an error state (line (34)) to indicate that it has produced a robustness violation.

In Fig. 18, we show an excerpt of the instrumentations of the two transactions of the $\mathsf{SB}$ program. In particular, we only give the instructions of the instrumented $\mathsf{SB}$ that are reached during the execution that leads to an error state. The attacker instrumentation is applied to the transaction ${t}1$ of ${p}1$ and the happens-before helpers instrumentation is applied to the transaction ${t}2$ of ${p}2$. The first conflict order from ${t}1$ to ${t}2$ (shown in Fig. 11) is simulated by the fact that at line 39, $y.event^{\prime}=\mathsf{ld}$ (see lines 37 and 38). Also, the second conflict order from ${t}2$ to ${t}1$ is simulated by the fact that at line 41 we reach the error state where $a_{\mathsf{st}_{\mathsf{A}}}.event=x.event=\mathsf{ld}$ (see lines 36 and 40).

9.4. Correctness

As we have already mentioned, the role of a process in an execution is chosen non-deterministically at runtime. Therefore, the final instrumentation of a given program $\mathcal{P}$, denoted by $[\![\mathcal{P}]\!]^{\mathsf{P2}}$, is obtained by replacing each labeled instruction $\langle linst\rangle$ with the concatenation of the instrumentations corresponding to the attacker, the visibility helpers, and the happens-before helpers, i.e., $[\![\langle linst\rangle]\!]^{\mathsf{P2}}::=[\![\langle linst\rangle]\!]^{\mathsf{P2}}_{\mathsf{A}}\hskip 4.83691pt[\![\langle linst\rangle]\!]^{\mathsf{P2}}_{\mathsf{VH}}\hskip 4.83691pt[\![\langle linst\rangle]\!]^{\mathsf{P2}}_{\mathsf{HbH}}$. The instrumented program $[\![\mathcal{P}]\!]^{\mathsf{P2}}$ reaches the error state iff $\mathcal{P}$ admits a violation of the pattern $\tau_{{\tt CCv}{}2}$. Let $[\![\mathcal{P}]\!]^{\mathsf{P1}}$ be the instrumented program that reaches an error state iff $\mathcal{P}$ admits a violation of the pattern $\tau_{{\tt CCv}{}1}$. The instrumentation $[\![\ ]\!]^{\mathsf{P1}}$ does not include the visibility helpers since only a single transaction is delayed in $\tau_{{\tt CCv}{}1}$, and it can be obtained in the same manner as $[\![\ ]\!]^{\mathsf{P2}}$. The following theorem states the correctness of the instrumentation.

Theorem 19**.**

A program $\mathcal{P}$ is not robust against CCv iff either $[\![\mathcal{P}]\!]^{\mathsf{P1}}$ or $[\![\mathcal{P}]\!]^{\mathsf{P2}}$ reaches the error state.

The proof of this theorem relies on the explanations given above. One can define a bijection between executions of the instrumentation that reach an error state and executions of the original program that satisfy the constraints in one of the two violation patterns. The former can be rewritten to the latter by roughly, removing all accesses to the auxiliary variables used by the instrumentation, replacing the writes to shared variable copies by writes to the original variables, delivering delayed transactions only to visibility helpers, and appending store events for all the delayed transactions. For the reverse, given a robustness violation $\tau=\mathsf{\alpha}_{\mathsf{A}}\cdot\mathsf{isu}({p},{t})\cdot\beta_{1}\cdot\mathsf{isu}({p}_{1},{t}_{1})\cdot\beta_{2}\cdot({p}^{\prime},{t}^{\prime})\cdot\mathsf{del}({p}^{\prime},{t})\cdot\mathsf{\gamma}_{\mathsf{S}}$ of type $\tau_{{\tt CCv}{}2}$, we can build an execution of the instrumentation that reaches an error state, where ${p}$ is the attacker, the processes delaying transactions in $\beta_{1}\cdot\mathsf{isu}({p}_{1},{t}_{1})$ are visibility helpers, and the processes that issue transactions between $\mathsf{isu}({p}_{1},{t}_{1})$ and $\mathsf{del}({p}^{\prime},{t})$ and that are part of the happens-before path between these two events are the happens-before helpers.

The following result states the complexity of checking robustness for finite-state programs999That is, programs where the number of variables and the data domain are bounded. against one of the three variations of causal consistency considered in this work (we use causal consistency as a generic name to refer to all of them). The upper bound is a direct consequence of Theorem 19 and of previous results concerning the reachability problem in concurrent programs running over SC, with a fixed [26] or parametric number of processes [40]. For the lower bound, given an instance of the reachability problem under sequential consistency, denoted by $(\mathcal{P},\ell)$101010That is, whether the program $\mathcal{P}$ reaches the control location $\ell$ under SC., we construct a program $\mathcal{P}^{\prime}$ where each statement $s$ of $\mathcal{P}$ is a different transaction (guarded by a global lock), and where reaching the location $\ell$ enables the execution of a “gadget” that corresponds to the $\mathsf{SB}$ program in Figure 9(b). Executing each statement under a global lock ensures that every execution of $\mathcal{P}^{\prime}$ under causal consistency is serializable, and faithfully represents an execution of the original $\mathcal{P}$ under sequential consistency. Moreover, $\mathcal{P}$ reaches $\ell$ iff $\mathcal{P}^{\prime}$ contains a robustness violation, which is due to the execution of $\mathsf{SB}$.

Corollary 20**.**

Checking robustness of finite-state programs against causal consistency is PSPACE-complete when the number of processes is fixed and EXPSPACE-complete, otherwise.

Remark 21**.**

The reduction to reachability does not manipulate transaction identifiers and it is insensitive to the number of transactions executed by one process. Thus, all our results extend to processes that include unbounded loops of transactions. This includes programs where each process can call a statically known set of transactions (with parameters) an arbitrary number of times.

10. Related Work

Causal consistency is one of the oldest consistency models for distributed systems [30]. Formal definitions of several variants of causal consistency, suitable for different types of applications, have been introduced recently [18, 17, 38, 13]. The definitions in this paper are inspired from these works and coincide with those given in [13]. In that paper, the authors address the decidability and the complexity of verifying that an implementation of a storage system is causally consistent (i.e., all its computations, for every client, are causally consistent).

While our paper focuses on trace-based robustness, state-based robustness requires that a program is robust if the set of all its reachable states under the weak semantics is the same as its set of reachable states under the strong semantics. While state-robustness is the necessary and sufficient concept for preserving state-invariants, its verification, which amounts in computing the set of reachable states under the weak semantics, is in general a hard problem. The decidability and the complexity of this problem has been investigated in the context of relaxed memory models such as TSO and Power, and it has been shown that it is either decidable but highly complex (non-primitive recursive), or undecidable [8, 9]. As far as we know, the decidability and complexity of this problem has not been investigated for causal consistency. Automatic procedures for approximate reachability/invariant checking have been proposed using either abstractions or bounded analyses, e.g., [10, 5, 20, 1]. Proof methods have also been developed for verifying invariants in the context of weakly consistent models such as [29, 25, 36, 4]. These methods, however, do not provide decision procedures.

Decidability and complexity of trace-based robustness has been investigated for the TSO and Power memory models [14, 12, 21]. The work we present in this paper borrows the idea of using minimal violation characterizations for building an instrumentation allowing to obtain a reduction of the robustness checking problem to the reachability checking problem over SC. However, applying this approach to the case of causal consistency is not straightforward and requires different proof techniques. Dealing with causal consistency is far more tricky and difficult than dealing with TSO, and requires coming up with radically different arguments and proofs, for (1) characterizing in a finite manner the set of violations, (2) showing that this characterization is sound and complete, and (3) using effectively this characterization in the definition of the reduction to the reachability problem.

As far as we know, our work is the first one that establishes results on the decidability and complexity issues of the robustness problem in the context of causal consistency, and taking into account transactions. The existing work on the verification of robustness for distributed systems consider essentially trace-based concepts of robustness and provide either over- or under-approximate analyses for checking it. In [11, 15, 16, 19], static analysis techniques are proposed based on computing an abstraction of the set of computations that is used in searching for robustness violations. These approaches may return false alarms due to the abstractions they consider. In particular, [11] shows that a trace under causal convergence is not admitted by the serializability semantics iff it contains a (transactional) happens-before cycle with a ${\mathsf{RW}}$ dependency, and another ${\mathsf{RW}}$ or ${\mathsf{WW}}$ dependency. This characterization alone is not sufficient to prove our result concerning robustness checking. Our result relies on a characterization of more refined robustness violations and relies on different proof arguments. In [35] a sound (but not complete) bounded analysis for detecting robustness violation is proposed. Our approach is technically different, is precise, and provides a decision procedure for checking robustness when the program is finite-state.

11. Conclusion

We have studied three variations of transactional causal consistency, showing that they are equivalent for programs without write-write races. We have shown that the problem of verifying that a transactional program is robust against causal consistency can be reduced, modulo a linear-size instrumentation, to a reachability problem in a transactional program running over a sequentially consistent shared memory. This reduction leads to the first decidability result concerning the problem of checking robustness against a weak transactional consistency model. Furthermore, this reduction opens the door to the use of existing methods and tools for the analysis and verification of SC concurrent programs, in order to reason about weakly-consistent transactional programs. It can be used for the design of a large spectrum of static/dynamic tools for testing/verifying robustness against causal consistency.

Our notion of robustness relies on a particular interpretation of behaviors as traces recording all happens-before dependencies. This is stronger than a more immediate notion of state-based robustness that requires equality of sets of reachable states, which means that it could produce false alarms, i.e., robustness violations that are not also violations of the intended program specification. This trade-off is similar in spirit to data races being used as an approximation of concurrency errors (since data races are easier to detect, compared to violations of arbitrary specifications).

An interesting direction for future work is looking at the robustness problem in the context of hybrid consistency models where some of the transactions in the program can be declared serializable. These models include synchronization primitives similar to lock acquire/release which allow to enforce a serialization order between some transactions. Such mechanisms can be used as a “repair” mechanism in order to make programs robust.