On%20the%20expressive%20power%20of%20primitives%20for%20compensation%20handling

1
On the expressive power of primitivesfor
compensation handling
Ivan Lanese Computer Science Department University
of Bologna Italy
Joint work with Catia Vaz and Carla Ferreira
2
Map of the talk

• Comparing primitives for compensations
• A hierarchy of calculi
• Encoding parallel recovery
• An impossibility result
• Conclusions

3
Map of the talk

• Comparing primitives for compensations
• A hierarchy of calculi
• Encoding parallel recovery
• An impossibility result
• Conclusions

4
Error handling

• We want to compose services to create complex
  applications
• Safe composition of services requires to deal
  with faults
• No guarentee on services behaviour because of
  loose coupling
• Disconnections, message losses,
• A fault is an abnormal situation that forbids the
  continuation of an activity
• An activity that generates a fault is terminated
• Faults should be managed so that the whole system
  reaches a consistent state

5
Compensation handling

• Managing errors require to undo previously
  completed activities
• Undoing can not be perfect
• Some activities can not be undone
• Impossible to lock resources for long times
• The programmer defines some code (the handler) to
  take the system to a consistent state
• Handlers are associated to long-running
  transactions
• Computations that either succeed or are
  compensated
• Weaker requirement w.r.t. ACID transactions

6
Different proposals

• Different calculi and languages provide
  primitives for fault and compensation handling
• BPEL, Sagas, StAC, cjoin, SOCK, dcp, webp,
• Are the proposed primitives equivalent?
• Which are the best ones?

7
A difficult problem

• Approaches to compensation handling can differ
  according to many features
• Flat vs nested transactions
• Automatic vs programmed kill of subtransactions
• Static vs dynamic definition of compensations
• Approaches applied to different underlying
  languages
• Differences between the languages may hide
  differences between the primitives

8
Our approach

• Taking the simplest possible calculus
  (p-calculus)
• Adding different primitives to it
• Comparing their expressive power looking for
  compositional encodings
• Try to export the results to the original calculi
• Too many possible differences
• We concentrate on static vs dynamic definition of
  handlers
• Other differences will be considered in future
  work

9
Static approach

• The error recovery code is fixed
• Java try P catch e Q
• Whenever a fault is triggered inside P code Q is
  executed
• For a more fine-grained control
• One can use nested try-catch blocks
• More complex code
• Or Q has to check the state to understand when
  the fault happened
• Need for auxiliary variables, race conditions
  problem
• This is the approach of Java, Webp, pt-calculus,
  conversation calculus

10
Dynamic approach

• The error recovery code can be updated during the
  computation
• Requires a specific primitive for doing the
  update
• Parallel recovery new error recovery processes
  can be added in parallel
• This is the approach of dcp and the approach of
  Sagas and StAC for parallel activities
• General dynamic recovery a (higher-order)
  function can be applied to the error recovery
  code
• This is the approach of SOCK
• BPEL, Sagas and StAC use backward recovery for
  sequential activities
• It is a particular form of general dynamic
  recovery

11
Map of the talk

• Comparing primitives for compensations
• A hierarchy of calculi
• Encoding parallel recovery
• An impossibility result
• Conclusions

12
A hierarchy of calculi

• P 0 inaction
  Si pi.Pi guarded
  choice
• !p.P guarded
  replication
• PQ parallel
  composition
• (?x)P
  restriction
• tP,Q
  transaction
• ltPgt protected
  block
• X process
  variable
• inst?X.Q.P compensation
  update

13
Simple examples static compensations

• Transactions can compute
• Transactions can be killed
• Transactions can suicide
• Protected code is protected

14
Simple examples compensation update

• Parallel update
• Sequential update
• Compensation deletion

15
Race conditions

• Should never happen that an action has been
  performed and its compensation has not been
  installed
• Otherwise in case of fault the compensation is
  not the desired one
• Compensation update should have priority w.r.t.
  normal actions

16
Classes of calculi

• General dynamic recovery
• Parallel recovery
• All compensation updates have the form ?X. QX
• Static recovery
• Compensation updates are never used
• General dynamic recovery is more expressive than
  parallel recovery
• Parallel recovery and static recovery have the
  same expressive power

17
Map of the talk

• Comparing primitives for compensations
• A hierarchy of calculi
• Encoding parallel recovery
• An impossibility result
• Conclusions

18
Encoding parallel update

• Other constructs are mapped to themselves
• Each transaction has an associated name r
• Compensations are stored in the code, protected
  and guarded by r
• Output on r is added to the static compensation
  and regenerated by stored compensations

19
Example of the encoding
20
Sample execution
21
Properties of the encoding

• The encoding is defined by structural induction
  on the term
• The process to be encoded is weakly bisimilar to
  its encoding
• For processes that do not install compensations
  at top-level
• The encoding does not introduce divergency

22
Map of the talk

• Comparing primitives for compensations
• A hierarchy of calculi
• Encoding parallel recovery
• An impossibility result
• Conclusions

23
Conditions for compositional encoding

• Parallel composition mapped into parallel
  composition
• Well-behaved w.r.t. substitutions
• Transactions implemented by some fixed context
• With transaction name as a parameter
• Process to be encoded should testing equivalent
  to its encoding
• Only for well-formed processes
• Weaker than asking weak bisimilarity
• Divergency not introduced

24
Are the conditions reasonable?

• These or similar conditions have been proposed in
  the literature Gorla, Palamidessi
• Testing equivalence only for well-formed
  processes
• Processes that do not install compensations
  outside transactions
• Otherwise those compensations can be observed
• Those compensations can never be executed
• Sanity check our previous encoding satisfies
  these properties

25
Impossibility result

• There is no compositional encoding of general
  dynamic recovery into static recovery
• Idea of the proof
• With general dynamic recovery it is possible to
  understand the order of execution of parallel
  actions by looking at their compensations
• With static or parallel recovery this is not
  possible
• The processhas a trace a,b,t,b but no trace
  a,b,t,a
• This behaviour can not be obtained using static
  recovery

26
Map of the talk

• Comparing primitives for compensations
• A hierarchy of calculi
• Encoding parallel recovery
• An impossibility result
• Conclusions

27
Application dcp

• Dcp is an asynchronous pi-calculus with parallel
  recovery
• Dcp can be seen as a fragment of our calculus
  with parallel update of compensations
• The encoding works also in the asynchronous case,
  thus dcp can be mapped into its static fragment

28
Application webp and webp8

• Webp8 is an asynchronous fragment of our calculus
  with static recovery
• It is not possible to implement general dynamic
  recovery on top of it
• It is possible to implement parallel recovery
• Webp has timed transactions, which add an
  orthogonal expressiveness dimension

29
Application c-join

• C-join is a calculus with static recovery based
  on join
• Also some features of parallel recovery, since
  transactions can be merged
• Join patterns are more expressive than
  pi-calculus communication
• We conjecture that this gives the additional
  power required to implement general dynamic
  recovery

30
Application Sagas, StAC and BPEL

• They use parallel recovery for parallel
  activities, backward recovery for sequential ones
• More than parallel recovery, less than general
  dynamic recovery
• The counterexample used in the impossibility
  theorem does not apply
• Sagas and StAC have no communication, so also
  observations are different

31
Future work

• Many questions still open
• Nested vs flat
• What about backward recovery?
• We think that a similar approach can be used to
  answer them

32
End of talk

• Thanks!

• Questions?