Concurrency Control and Recovery in Transactional Process Management

Transcription

1 In: Proceedings of he ACM Symposium on Principles of Daabase Sysems (PODS 99), pages , Philadelphia, Pennsylvania, USA, May/June, Concurrency Conrol and Recovery in Transacional Process Managemen Heiko Schuld Gusavo Alonso Insiue of Informaion Sysems Swiss Federal Insiue of Technology (ETH) ETH Zenrum CH 8092 Zürich, Swizerland Hans-Jörg Schek Absrac The unified heory of concurrency conrol and recovery inegraes aomiciy and isolaion wihin a common framework, hereby avoiding many of he shorcomings resuling from reaing hem as orhogonal problems. This heory can be applied o he radiional read/wrie model as well as o semanically rich operaions. In his paper, we exend he unified heory by applying i o generalized process srucures, i.e., arbirary parially ordered sequences of ransacion invocaions. Using he exended unified heory, our goal is o provide a more flexible handling of concurren processes while allowing as much parallelism as possible. Unlike in he original unified heory, we ake ino accoun ha no all aciviies of a process migh be compensaable and he fac ha hese process srucures require ransacional properies more general han in radiional ACID ransacions. We provide a correcness crierion for ransacional processes and idenify he key poins in which he more flexible srucure of ransacional processes implies differences from radiional ransacions. 1 Inroducion In convenional daabases, concurrency conrol and recovery are well undersood problems. Unforunaely, his is no he case when ransacions are grouped ino eniies wih higher level semanics, such as ransacional processes [Alo97]. Some iniial work has been done in his direcion: sudying aomiciy (spheres of join compensaion [Ley95], or flexible ransacions [ELLR90, ZNBB94]) in a single process and analyzing concurrency conrol wihou considering recovery [AAHD97]. Pracical experience, however, shows ha concurrency conrol and recovery are relaed problems and hey boh need o be solved in order o produce complee, feasible soluions. In his paper, we presen a firs aemp o develop a heoreical framework in which o reason abou concurrency Par of his work has been funded by he Swiss Naional Science Foundaion under he projec Wise (Workflow based Inerne Services) of he Swiss Prioriy Programme Informaion and Communicaion Sysems. conrol and recovery in ransacional processes. The challenge we face is o design a single correcness crierion accouning for boh concurrency conrol and recovery which, a he same ime, copes wih he added srucure found in processes. In paricular, and unlike in radiional ransacions, processes inroduce flow of conrol as one of he basic semanic elemens. Thus, he correcness crieria mus ake ino consideraion ha processes already impose ordering consrains among heir differen operaions and among heir alernaive execuions, consrains ha will play a significan role in deermining how process execuion can be inerleaved. Similarly, processes inegrae invocaions o applicaions wih differen aomiciy properies. Therefore, we canno impose he srong requiremens used in oher models (like ConTracs [WR92, RSS97], or CREW [KR98] where he inverses of all process seps have o exis). The conribuion of he paper is hreefold. Firs, i clarifies he problem of concurrency conrol and recovery in ransacional processes wihou making unreasonable assumpions abou heir environmen. Second, saring wih he correcness of a single process based on flexible ransacions [ELLR90, ZNBB94] i provides a correcness crierion for concurren execuion of several processes generalizing and adaping he unified unified heory of concurrency conrol and recovery [SWY93, AVA + 94, VHYBS98] o ransacional processes hereby exending he applicabiliy of hese models. In conras o oher approaches proposing a variey of ransacion models (like TSME [GHS95, GHKM94]), his paper provides a single model covering all requiremens ha arise in he applicaion areas of ransacional process managemen. Third, i discusses several realisic environmens where hese ideas are being implemened. We believe ha ransacional processes are becoming more and more imporan in applicaions such as, for insance, elecronic commerce or virual enerprises, workflow managemen sysems, process suppor sysems, or specialized coordinaion ools. Therefore, we expec he resuls of his paper o be of pracical relevance in a variey of applicaions. The paper is organized as follows: In secion 2, we presen a sample applicaion scenario for ransacional processes. In secion 3, we develop a correcness crierion for ransacional processes and discuss is impac on concurrency conrol and recovery. Secion 4 concludes he paper. Permission o make digial or hard copies of all or par of his work for personal or classroom use is graned wihou fee provided ha copies are no made or disribued for profi or commercial advanage and ha copies bear his noice and he full ciaion on he firs page. To copy oherwise, o republish, o pos on servers or o redisribue o liss, requires prior specific permission and/or a fee. PODS 99 Philadelphia, PA, USA Copyrigh ACM /99/05...$ Moivaion Compuer Inegraed Manufacuring (CIM) environmens are a good example of he use of ransacional processes o coordinae differen subsysems [NSSW94]. In he example shown in figure 1, wo processes are used o conrol he de-

2 CAD Consrucion Wrie BOM Tes Technical Documenaion Consrucion Process Conflic! CNC Programs Read BOM CAD Documenaion NOT compensaable Produce Producion Process Transacional Process Scheduler Check Sock Transfer o sock Human Resources Transacional Subsysems CAD Sysem PDM Sysem Business Sofware (e.g. SAP R/3) Program Reposiory Tes and Norm DBMS Produc DBMS Documen DBMS Figure 1: Concurren execuion of a consrucion process and a producion process in he CIM scenario velopmen and producion of new producs 1. In his case, producion does no follow mass-producion echniques bu aims o cusomize each one of he producs o deliver. Thus, he developmen of he produc and is manufacure are srongly ied. The consrucion process conains all developing seps from he design of a new par o he final es and he subsequen echnical documenaion. I encompasses a CAD sysem, a produc daa managemen sysem (PDM), a es daabase as well as a echnical documenaion reposiory. The producion process includes all manufacuring seps from he ordering of maerials o he producion floor including he necessary scheduling. Thus, he producion process encompasses he PDM sysem, a business applicaion, a program reposiory and a produc DBMS. Aciviies of ransacional processes are service invocaions in hese underlying subsysems. As he bill of maerials (BOM) of a new produc generaed wihin he consrucion process provides he necessary inpu required by he producion process, dependencies beween boh processes exis. 2.1 Exending he Noion of Aomiciy The example above clearly shows why ransacional processes mus provide a more general noion of aomiciy han radiional ransacions. Consider he consrucion process in figure 1. If a failure is deeced during he es aciviy of his process, i is cerainly no desirable o undo all previous work including he long running design aciviy. I is more appropriae o undo only he PDM enry and documen he CAD drawing so as o faciliae laer reuse. This documenaion can be alernaively execued insead of he echnical documenaion of he whole par which would have been done if he es aciviy would have succeeded. The possibiliy of execuing alernaives in case of failures herefore generalizes he all-or-nohing semanics of aomiciy and leads o a more flexible noion of aomiciy used for ransacional processes. 2.2 Concurrency and Inerference An addiional prerequisie is o guaranee consisen ineracion beween processes. Consider a consrucion process and a producion process being execued in parallel as depiced in figure 1. This parallelizaion is imporan in pracice as i dramaically reduces he ime o marke of new producs. As depiced in figure 1, only he wo aciviies wihin he PDM sysem do conflic. For concurrency conrol purposes, he ordering of hese wo aciviies would be sufficien. However, when recovery has o be considered, furher dependencies exis. As no inverse for he producion aciviy exiss, i mus no be execued before he es erminaed successfully. If he es fails, he PDM enry is compensaed wihin he consrucion process and he BOM read by he producion process is invalidaed. Therefore, all aciviies of he producion process would have o be compensaed, oo. However, if producion of pars is already performed, his would lead o severe inconsisencies as no valid consrucion and BOM of hese pars exiss. 2.3 Transacional Subsysems A ransacional process scheduler coordinaes ransacional processes on op of ransacional subsysems and ensures correcness even in case of failures. We assume hese subsysems o have funcionaliy such as he aomiciy of service invocaions, and eiher he abiliy o compensae already commied services or o suppor a wo phase commi proocol. When he applicaion does no provide such funcionaliy, i will be provided by wrapping his applicaion sysem wih a ransacional coordinaion agen. In his paper we concenrae on ransacional process managemen on op of such ransacional, possibly agen-wrapped subsysems. The problem of wrapping hese sysems by ransacional coordinaion agens is imporan bu beyond he scope of his paper. Some aspecs of his problem are discussed in [NSSW94, SST98]. 1 This example reflecs he pracice followed by one of our indusrial parners in a recenly concluded research projec [SST98]. 317

3 3 Concurrency Conrol and Recovery in Transacional Processes In he following, we will consider ransacional processes execued by a ransacional process scheduler on op of subsysems supporing he execuion of local ransacions as shown in figure 1. In his secion, we derive a correcness crierion o reason abou correc concurrency conrol and recovery of hese ransacional processes in a single framework. To guaranee he propery of compensaabiliy, a compensaing aciviy is (i) iself no compensaable, however, i is (ii) reriable and herefore guaraneed o commi. Noe furher ha according o he flex ransacion model boh pivo aciviies and reriable 2 aciviies do no have a compensaing aciviy. Inuiively, a process is an arbirary collecion of aciviies in arbirary subsysems. For he process model, we adop and refine ideas of he flex ransacion model [ELLR90, ZNBB94]. More formally, 3.1 Process Model Each subsysem provides a limied se of ransacional services ha can be invoked by processes. Le  be he se of services (aciviies) provided by all subsysems. For each invocaion of an aciviy of Â, reurn values are provided. As aciviies are iself ransacions in he underlying subsysems, hey are by definiion aomic and herefore erminae eiher commiing or aboring. Aciviies differ in erms of heir erminaion guaranees: hey are eiher compensaable, reriable, or pivo (as in he flex ransacion model [MRSK92, ZNBB94]). In he case of compensaable aciviies, a compensaion service is provided by he underlying subsysem, reriable aciviies are guaraneed o successfully erminae afer a finie number of invocaions, and pivo aciviies are hose which are neiher compensaable nor reriable. These differen erminaion guaranees of aciviies will be defined more formally as follows using he noion of aciviy sequence o denoe he sequenial execuion of aciviies. Definiion 1 (Effec-free Aciviies) Le σ =< a i a j... a n > be a sequence of aciviies from Â. The sequence σ is effec-free if, for all possible aciviy sequences α and ω from Â, he reurn values of α and ω in he concaenaed aciviy sequence < α σ ω > are he same as in he aciviy sequence < α ω >. A special case of effec-free aciviies is he sequence σ =< a i i > consising of a compensaable aciviy a i and is compensaing aciviy i. More formally, Definiion 2 (Compensaabiliy and Compensaion) An aciviy a i  is compensaable if an aciviy a 1 i  exiss where he aciviy sequence σ =< a i i > is effecfree. The aciviy i is hen called he compensaing aciviy of a i. In order o formally define reriable aciviies, he invocaion of aciviies has o be labeled. Le a i (n) he n h invocaion of aciviy a i. Definiion 3 (Reriable Aciviy) An aciviy a i is reriable if some m N exiss wih a i (j) erminaing wih abor for 1 j < m while a i (m) is guaraneed o erminae wih commi. The guaranee ha here is always one invocaion which will commi ensures ha reriable aciviies will no fail. More formally, Definiion 4 (Failure of an Aciviy) An aciviy a i has failed if invocaion a i (1) has erminaed wih abor and no m N exiss where a i (m) is guaraneed o commi. 318 Definiion 5 (Process) A process, P, is a riple (A,, ), where A  is a se of aciviies, is a parial order over A wih (A A), and is a parial order defined over wih ( ) esablishing alernaive execuion pahs by specifying for each aciviy a A an ordering on he aciviies a A direcly following i. For noaional purposes, a process is assumed o have a unique idenifier, for insance, P i. Aciviies wihin P i are denoed as a c i 1, a p i 2,..., a r i n. The superscrip index denoes he propery of an aciviy, he subscrip indices denoe he process id and a unique id of he aciviy wihin he process (aciviy a r i n, for insance, is an aciviy of process P i wih id n and i is reriable). The commimen of process P i is denoed by C i, is abor by A i. If he propery of an aciviy is no relevan, we will omi his specificaion. The semanics of he precedence order wihin processes is a emporal one. This means ha for any wo aciviies, a ik and a il, if a ik a il, hen a il can only be execued afer a ik commied. The preference order defined over pairs of connecors saring boh from he same aciviy esablishes he order in which he connecors will be evaluaed. If here are wo order consrains in wih (a ih ij a ij ) (a ih ik a ik ) hen, if a ik is execued, eiher a ij mus have failed or boh a c i j and (a c i j ) 1 mus have been execued. Also, all aciviies succeeding a c i j mus have been compensaed before a ik is able o be execued. Thus, as an exension of he flex ransacion model, hese furher order consrains derived from have o be respeced when execuing alernaives. However, hese alernaive execuion pahs have he same semanics as he preference order of he flex ransacion model. Noe ha boh orders, and, are irreflexive, ransiive, and acyclic. To avoid indeerminism in he execuion, when, by ransiiviy, associaes several connecors, i can only define a oal order. ac 1 3 a r 1 6 Figure 2: Process P 1 wih precedence and preference order 2 In he conex of ransacional process managemen, we could also consider reriable aciviies o be as well compensaable in order o give a scheduler more opions for execuing alernaives in case of failures. For he sake of simpliciy, we however follow he less general flex ransacion model here.

4 Example 1 Consider process P 1 depiced in figure 2. The precedence order of P 1 is depiced wih solid lines, he preference order of P 1 wih doed lines. Given hese orders, and herefore also a r 1 6 can only be execued afer has failed or afer has failed and has been compensaed by 1 3. Therefore, as depiced in figure 3, four possible valid execuions of P 1 exis. Sandard execuion if fails a r 1 6 if fails a c a p 1 3 a r a r if fails Figure 3: Possible execuions of process P 1 We consider a single ransacional process o be well defined if i has well-formed flex srucure [ZNBB94]. The basic well-formed flex srucure consiss of a se of compensaable aciviies followed by one pivo aciviy which is again followed by a se of reriable aciviies. Addiionally, he pivo aciviy can recursively be succeeded by a complee well-formed flex srucure given ha an alernaive consising only of reriable aciviies exiss for i. In [ZNBB94] i has been shown ha well-formed flex srucures always guaranee he exisence of one execuion pah ha can be execued correcly while all oher pahs will leave no effecs. In he following, processes having wellformed flex srucures are called processes wih guaraneed erminaion (his is equivalen o he semi aomiciy in he flex ransacion model). The guaraneed erminaion propery of ransacional processes is a generalizaion of he all-or-nohing semanics of radiional ACID ransacions as i ensures ha a leas one of evenually many valid execuions (specified by he alernaives) is effeced. In wha follows, we will only consider processes wih guaraneed erminaion. For noaional purposes, he firs non-compensaable aciviy of a process wih guaraneed erminaion P i will be called sae-deermining aciviy s i0 of P i. All aciviies of P i preceding s i0 are compensaable. Therefore, backward recovery can be performed by successively applying compensaion if s i0 fails or if an abor A i of P i is performed before s i0 commied. Similarly, once s i0 has erminaed successfully, forward recovery is guaraneed. From here, a process wih guaraneed erminaion can be in any of wo saes. A process, P i, is said o be forward-recoverable, F REC, afer s i0 has been commied, oherwise P i is backward-recoverable, B REC. The sequence of compensaing aciviies o be execued for recovery purposes of a process in sae B REC is is backward recovery pah. The sequence of aciviies leading from any aciviy succeeding s i0 o he well-defined erminaion of a process is he forward recovery pah. The se of aciviies of a process P i o be execued for recovery purposes (eiher forward or backward) will be called he compleion of P i denoed by C(P i ). Noe ha in he case of P i being in sae B REC, C(P i ) consiss only of compensaing aciviies, while, if P i is in sae F REC, C(P i ) consiss of boh compensaing aciviies (local backward recovery o a sae-deermining elemen s ik ) 3, and reriable aciviies. While he failure of 3 As we consider basic well-formed flex srucures recursively, muliple local sae-deermining aciviies s ik of P i may exis. 319 one aciviy leads o he execuion of he nex alernaive given by he preference order, he abor A i of a process in F REC considers only he alernaive wih lowes prioriy which consiss only of reriable aciviies and hus guaranees safe erminaion. Similarly, he abor A i of a process P i in B REC considers only compensaion in backward order and no furher alernaive execuion pahs. The compleion C(P i ) of a process P i will be an imporan noion when we define complee process schedules below. Example 2 Consider again process P 1 depiced in figure 2. Obviously, P 1 is a process wih guaraneed erminaion as i has well-formed flex srucure. The pivo aciviy is he sae-deermining aciviy s 10 of P 1. Before he successful erminaion of, P 1 is in B REC and in his sae, he compleion C(P 1 ) consiss of { } if has been execued correcly. Afer successful erminaion of, P 1 is in F REC. Afer aciviy, for insance, has erminaed successfully, he compleion of P 1 evaluaes o C(P 1 ) = { 1 3 a r 1 6 }. 3.2 Process Schedules and Correcness Following [VHYBS98], he noion of conflicing aciviies is defined using he reurn values of aciviies. Definiion 6 (Commuaiviy) Two aciviies a ik, a jl  commue if for all aciviy sequences α and ω from Â, he reurn values in he concaenaed aciviy sequence < α a ik a jl ω > are idenical o he reurn values of he aciviy sequence < α a jl a ik ω >. Two aciviies are in conflic if hey do no commue. Furhermore, we consider commuaiviy beween all aciviies of  o be perfec [VHYBS98]. This means ha if wo aciviies a c and a jl conflic, hen we will also consider a conflic beween a α and a β j l for all possible combinaions of α, β { 1, 1}. Oherwise, if a c and a jl commue, we will assume a α and a β j l o commue for all possible combinaions of α, β { 1, 1}. Given he srucure of processes wih guaraneed erminaion and he informaion abou conflicing aciviies, a process schedule can be defined as follows. Definiion 7 (Process Schedule) A process schedule S is a riple (P S, A S, S ) where P S is a se of processes, A S  is a subse of all aciviies of all processes of P S wih A S {a ij a ij A i P i P S }, S is a parial order beween aciviies of A S wih S (A S A S ). For he order s he following has o hold: 1. P i : i S 2. (a ik, a jl ), i j, such ha a ik and a jl do no commue: a ik S a jl or a jl S a ik Noe ha by 7.1, a process schedule guaranees only legal execuions of each process P i P S hus respecing boh P i s precedence and preference order. Formally, he above definiion of a process schedule looks like he classical definiion of a schedule. However, i implicily includes informaion abou he properies of all aciviies (compensaable, pivo or reriable) and hus, also abou

5 P 1 a r 1 6 P 1 a r 1 6 Conflic Conflic Conflic Conflic Conflic Conflic P 2 a r 2 5 P 2 a r 2 5 S 1 2 S a c (a) (b) Figure 4: Serializable (a) and non-serializable (b) concurren execuion of processes P 1 and P 2 he differen saes of processes (B REC or F REC) and i includes he alernaive execuion of a process P i as even in a complee process schedule where all processes erminae commiing [BHG87], no necessarily all of P i s aciviies are considered. This does however no influence he noion of serializabiliy. A process schedule is serializable if i is conflic equivalen o a serial execuion of all processes. Hence, a serializable process schedule does no conain cyclic dependencies [BHG87]. Example 3 Consider he wo processes, P 1 and P 2, depiced in figure 4(b) being execued in parallel. As he pairs of aciviies (, ), (, ), and (, a r 2 5 ) do no commue (denoed by dashed arcs), hey have o be ordered in he process schedule S. Also, he inra-process orders of P 1 and P 2 mus be respeced in S. Therefore, process schedule S a ime 2 evaluaes o: S 2 = (P S, A S, ) wih he se of processes P S = {P 1, P 2 }, he se of aciviies A S = {,,,,,, }, and he order = {( ), ( ), ( ), ( )}. Obviously, process schedule S 2 is no serializable because of cyclic dependencies beween P 1 and P 2. Example 4 Consider again processes P 1 and P 2, now execued as depiced in figure 4(a). A ime 2, he process schedule S is serializable. Here, no cyclic dependencies beween P 1 and P 2 do exis as he order S evaluaes o S = {( S S ), ( S S S ), ( S ), ( S )}. 3.3 Compleed Process Schedules The serializabiliy of ransacional processes allows o reason abou correc concurrency conrol. In order o addiionally reason abou correc recovery when, for insance, a failure of he process scheduler occurs, we now make recoveryrelaed aciviies explici by applying he unified heory of concurrency conrol and recovery [SWY93, AVA + 94, VHYBS98] o ransacional processes. Therefore, we replace each abor aciviy A i of a process P i by he aciviies of is compleion C(P i ). This replacemen of abor aciviies leads o he noion of he compleed process schedule S. In order o guaranee correc recovery, all acive processes P i1,..., P in are assumed o abor, which mus be reaed 320 joinly by using a group abor operaion A(P i1,..., P in ). Noe ha abored processes may be in F REC. Therefore, no only compensaion of previously execued aciviies bu all aciviies of he forward-recovery pah of abored processes have o be considered, hus leading o crucial differences compared wih he sandard undo procedure for recovery. This is also refleced in he noion of compleed process schedule in conras o he expanded schedule of he radiional unified heory which conains only addiional compensaion compared wih he iniial schedule. The way a process schedule is compleed is depiced in figure 5. Afer A i has been replaced by all aciviies of C(P i ), a process P i can be considered as commied. Process Schedule S01 Crash ~ Compleed Process Schedule S regular aciviies aciviies of backward recovery pah aciviies of forward recovery pah Figure 5: Compleion of a process schedule by aciviies of he backward recovery pah and of he forward recovery pah of all acive processes More formally, he compleed process schedule S of a process schedule S is defined as follows: Definiion 8 (Compleed Process Schedule S) Le S = (P S, A S, S ) be a process schedule. The compleed process schedule S of S, is a riple ( P S, ÃS, S ) where 1. For he se of processes P S holds: PS = P S. 2. Ã S is a se of aciviies derived from A S in he following way: (a) For each process P i P S, if a ik A i and a ik is no he abor aciviy A i, hen a ik ÃS. (b) All acive processes are reaed as abored processes, by adding A(P n1,..., P ns ), a se-oriened abor, a he end of S, where (P n1,..., P ns ) are all acive processes in S. (c) For each abored process P j in P S, all aciviies a js C(P j ) of he compleion C(P j ) of P j are in S (a js ÃS). An abor aciviy A j is changed o C j ÃS.

6 S S S S S S a c 2 a c 2 a r 2 a c a p 1 2 S a c 1 a c 1 a c ac a p a p ar 3 2 ar Compleion Reducion S S S S S S S a c a c 2 a c 1 a c a p a p a r 1 a r 1 6 a r S a c a c 2 a r 1 a c a p a p a r 1 a r 1 6 a r (a) (b) Figure 6: Compleed process schedule S (a) and reduced process schedule S (b) of process schedule S 3. The parial order, S, is deermined as follows: (a) For every wo aciviies, a ik and a jl, if a ik S a jl in S, hen a ik S a jl in S. (b) For every wo aciviies, a ik and a il, of he compleion C(P i ) of every process P i ha does no commi in S, if a ik i a il C(P i ), hen a ik S a il in S. (c) All aciviies of he compleion C(P i ) of every process P i ha does no commi in S follow he P i original aciviies and mus precede C i in S. (d) If a group abor A(P n1,..., P ns ) S, hen every pair of conflicing aciviies of he compleions of hese processes, a ik C(P i ), a jl C(P j ) wih i, j {n 1,..., n s }, i j, has o be ordered in S (eiher a ik S a jl or a jl S a ik ). (e) Whenever a ik S A(P n1,..., P ns ) S a jl and some aciviy a q of he compleion C(P q ) of process P q {P n1,..., P ns } P S conflics wih a jl (a ik ), hen i mus be rue ha a q S a jl (a ik S a q ). (f) Whenever A(..., P i,...) S A(..., P j,...) for some i j, hen for all conflicing aciviies a ik of he compleion of P i and a jl of he compleion of P j, a ik C(P i ) and a jl C(P j ), i mus be rue ha a ik S a jl. The following example presens how a given process schedule is compleed. Example 5 Consider again process schedule S of example 4 wih P S = {P 1, P 2 } as depiced in figure 4(a). When he compleed process schedule S is deerminded a ime 2 where boh processes are acive, a group abor A(P 1, P 2 ) has o be added o S. The se of aciviies ÃS of S consiss of all aciviies of A S plus he aciviies { 1 3,, a r 1 6 } of he compleion C(P 1 ) and {a r 2 5 } of he compleion C(P 2 ). The order S of S is he union of S and {( S 1 3 S S a r 1 6 ), ( S a r 2 5 ), ( S a r 2 5 )}. The compleed process schedule S is depiced in figure 6(a). As no cyclic dependencies exis, he compleed process schedule S is serializable Unified Theory for Processes Like in he radiional unified heory, reducibiliy provides a crierion for correc concurrency conrol and recovery once we have compleed a process schedule by making recoveryrelaed aciviies explici. The idea of he reducion of a compleed process schedule is o eliminae boh an aciviy and is compensaing aciviy if hey form an effec-free aciviy sequence as well as o eliminae aciviies of abored processes ha are hemselves effec-free. Also, consecuive aciviies may be commued if hey do no conflic. More formally, Definiion 9 (Reducibiliy (RED)) A process schedule S = (P S, A S, S ) is reducible (RED) if is compleed process schedule S = ( PS, ÃS, S ) can be ransformed ino a serial process schedule S = ( P S, ÃS, S ) by applying he following hree ransformaion rules finiely many imes: 1. Commuaiviy Rule: If wo aciviies a ik, a jl ÃS such ha a ik S a jl and (a ik, a jl ) commue and here is no oher aciviy a q ÃS wih a ik S a q S a jl, hen he ordering a ik S a jl can be replaced by he ordering a jl S a ik. 2. Compensaion Rule: If wo aciviies a ik, ÃS such ha a ik S and here is no oher aciviy a jl ÃS wih a ik S a jl S be removed from S., hen a ik, can 3. Effec-free Aciviy Rule: If P i does no commi in S, hen all aciviies a ik ha are effec-free can be removed from S. Example 6 Considering again process schedule S of example 4 and is compleed process schedule S of example 5. When applying he reducion rules, only he wo consecuive aciviies and 1 3 can be removed from S in accordance o he compensaion rule. The reduced process schedule S shown in figure 6(b) is serializable as S of S conains aside of he iner-process orders of P 1 and P 2 only dependencies from process P 1 o process P 2. Therefore, process schedule S is RED.

7 Example 7 Consider now process schedule S 1 a ime 1 depiced in figure 7. When compleing S 1, all pairs of conflicing aciviies will be in he same order and he applicaion of he reducion rules leads o a serial process schedule S 1. Therefore, process schedule S 1 is RED. P 1 P 2 S Conflic a r 16 1 Conflic Figure 7: Prefix-reducible execuion of processes P 1 and P 2 RED is no prefix closed, which means, i canno be used for dynamic scheduling. In accordance o he radiional unified heory, he crierion can be furher resriced for his purpose leading o prefix-reducibiliy where each prefix of a process schedule has o be considered. More formally, Definiion 10 (Prefix-Reducibiliy (PRED)) A process schedule S = (P S, A S, S ) is prefix-reducible (PRED) if every prefix of S is reducible. Example 8 Consider again process schedule S of example 4 depiced in figure 4(a) and is prefix S 1 a ime 1. In S 1, process P 2 is in F REC while process P 1 is in B REC. When compleing S 1, he previously execued aciviy of P 1 has o be compensaed by while for P 2, he aciviies of he forward recovery pah have o be execued. By scheduling, a conflic cycle appears in S 1 ( 1 1 ) ha canno be eliminaed by he reducion rules as compensaion of is no available. Therefore, S 1 is no reducible and hus, S is no prefix-reducible. The compleed process schedule S 1 of S 1 is depiced in figure 8. a r 2 5 Noe ha he above example is srongly influenced by he fac ha aciviies wihou inverse do exis. Therefore, we have o consider no only compensaion for recovery purposes. If all inverses were available and he classical undo procedure of recovery could be applied, he prefix S 1 of S would be reducible. The compleion of S 1 would consider he compensaion of a 23, a 22, a 21, and a 11. Then, wih respec o he compensaion rule, all four aciviies and heir compensaion aciviy could be removed from S 1 leading o a reduced schedule S 1 consising only of C 1 and C 2. As reducion would be possible for all prefixes of S in his classical sense, S would be in PRED. Therefore, when considering ransacional processes wih guaraneed erminaion propery, he order in which non-compensaable aciviies are execued is crucial as we will see in secion 3.5. Example 9 Taking again a look a process schedule S 1 depiced in figure 7. I can be shown ha each prefix S of S 1 wih < 1 is reducible. Therefore, process schedule S 1 PRED. However, scheduling can also benefi from non-compensaable aciviies. They have he semanics of a quasi commi of a process, as for all aciviies a c of a process P i preceding such a non-compensaable aciviy s i, compensaion can no longer be considered. Therefore, afer he commimen of s i, no cyclic conflics can arise in he compleed process schedule by he compensaion aciviies. This is shown in he following example. Example 10 Consider process schedule S wih processes P 1 and P 3 depiced in figure 9. Alhough aciviies and a c 3 1 do conflic, no conflic cycle can appear by he compensaing aciviy a ime 1. As process process P 1 is already in F REC, compensaion of is no available. Therefore, given ha no furher conflics exis beween aciviies of P 3 and he aciviies of he forward recovery pah of P 1, he execuion depiced in figure 9 is correc wih respec o boh concurrency conrol and recovery. P 1 P 3 a c 3 1 Conflic a c 3 2 a c 3 3 a c 3 4 a r 1 6 is S1 S 1 Compleion S a c 3 1 a c 3 2 a c 3 3 a c S 1 S1 S1 a r 2 5 Figure 8: Compleed process schedule S 1 of S Figure 9: Correc inerleaving of processes exploiing he quasi-commi of non-compensaable aciviies 3.5 Discussion of PRED of Compleed Process Schedules In he previous secions, we inroduced he formalism needed o define prefix-reducibiliy wih respec o ransacional processes having guaraneed erminaion propery.

8 As our goal is o reason abou correc concurrency conrol and recovery, we have o prove ha each process schedule in PRED is in fac boh serializable and recoverable. As we have o deal wih wo differen saes of processes deermining he way recovery has o be performed, we have o adop he noion of recoverabiliy o he srucure of ransacional processes leading o he noion of processrecoverabiliy. More formally, Definiion 11 (Process-Recoverabiliy (Proc-REC)) A process schedule S is process-recoverable (Proc-REC), if for each pair of conflicing aciviies, a ik and a jl wih a ik S a jl S he following holds: 1. C i precedes C j in S (C i S C j ) 2. he nex non-compensaable aciviy a jm of P j following a jl succeeds in S he nex nex non-compensaable aciviy a in of P i following a ik (a in S a jm ). Noe ha in he above definiion, he radiional case where no non-compensaable aciviies exis is conained as hen, by definiion 11.1, only an order beween C i and C j wih C i S C j has o be imposed. Theorem 1 If a process schedule S is PRED, hen S is boh serializable and process-recoverable. The proof of heorem 1 is given in appendix A. In example 8, we have seen ha he order in which he sae-deermining elemens of conflicing processes are execued is crucial as i deermines wha is o be done in case of recovery (eiher forward or backward). We now formalize and generalize his dependency. Lemma 1 For each process schedule S in PRED wih wo conflicing aciviies a ik S a jl in S where process P i is acive, he following has o hold: 1. Each non-compensaable aciviy a jm of P j wih a jl j a jm has o succeed he commi C i of P i (C i S a jm ). 2. Aciviy a jl has o be compensaable (a c j l ). The proof of lemma 1 is given in appendix B. In schedule S 1 of example 8 wih he pair of conflicing aciviies ( S1 ), a p 2 2 is execued before and hus, P 2 is in F REC while process P 1 is sill in B REC leading o a conradicion of lemma 1.1 and a violaion of he PRED crierion. According o lemma 1, he commis of all non-compensaable aciviies of P j have o be deferred by he respecive subsysem unil process P i has commied (C i ) if a conflic beween some aciviy a ik and a jl wih a ik S a jl exiss in S. Afer P i has commied, all non-compensaable aciviies of P j are also allowed o commi as cyclic dependencies beween P i and P j can no longer appear. Thus, he commimen of all non-compensaable aciviies of P j has o be performed aomically by exploiing a wo phase commi proocol in order o ensure ha eiher all aciviies commi or none of hem. In he following, we analyze he implicaions, PRED has on he execuion of aciviies wihin he compleed process schedule. The following wo lemmas specify he resricions on he execuion of compensaing aciviies. Inuiively, all compensaing aciviies have o be in reverse order of he original aciviies. More formally: 323 Lemma 2 For each process schedule S in PRED wih wo conflicing aciviies a c and a c j l, if boh compensaing aciviies and j l are in he compleed process schedule S, hen hey have o be in reverse order of he wo corresponding aciviies in S. The proof of lemma 2 is given in appendix C. As we have o consider no only compensaing aciviies for recovery purposes, addiional resricions beween compensaing aciviies of C(P i ) for some P i in sae B REC and non-compensaable aciviies (a r j l ) of C(P j ) for some P j in sae F REC have o be considered. Lemma 3 For each process schedule S in PRED, if wo conflicing aciviies C(P i ) and a non-compensaable aciviy a r j l C(P j ) have o be execued when compleing S, hen has o precede a r j l in S ( a r j l ). The proof of lemma 3 is given in appendix D. Coming back o he iniial CIM example presened in secion 2, we now have a formal crierion o classify he execuion depiced in figure 1 as incorrec because he PRED crierion does no hold. In order o guaranee correcness, he producion aciviy would have o be deferred unil he commimen of he consrucion process. Unlike he radiional unified heory where only compensaion had o be considered for abored ransacions in he expanded schedule, here also new aciviies have o be scheduled when he compleed process schedule has o be buil. Thus, aside from already exising pairs of conflicing processes (if some undo operaion is in conflic wih an aciviy of anoher ransacion in he radiional model, a conflic beween boh ransacions mus have been exised before compensaion has been performed), new conflics beween processes may be inroduced. Therefore, unlike in he radiional unified heory, he compleed process schedule S has always o be considered when reasoning abou correcness of a process schedule for ransacional processes. In [AVA + 94], he crierion SOT (serializable wih ordered erminaion) has been inroduced in order o reason abou correc concurrency conrol and recovery of a schedule S wihou considering is expanded schedule S. However, as he aciviies of he compleion of a process are no known in advance, a SOT-like crierion (ha relies only on informaion of a given schedule S) does no exis for ransacional processes. Arbirary conflics can be inroduced o S when non-compensaable aciviies of C(P i ) of abored processes P i have o be considered. Therefore, when reasoning abou correc concurrency conrol and recovery of ransacional processes, he compleed process schedule S has always o be considered o evaluae he PRED crierion. 3.6 Increasing Parallelism of Conflicing Aciviies In he process model (definiion 5), we only allowed eiher sequenial execuion ( ) of aciviies or unresriced parallelism. Also, in definiion 7 of a process schedule, we only considered a (srong) emporal order ( S ) beween wo conflicing aciviies. In order o increase parallelism, he weak order aken from he composie sysems heory [ABFS97] could be applied wih respec o he hierarchical schedulers of he ype encounered when execuing ransacional processes on op of ransacional subsysems. In his configuraion, he oupu of he process scheduler is

9 used as inpu o several lower schedulers, he schedulers of he ransacional subsysems. Thus, his reflecs he case of fork schedules described in [AFPS99]. While he srong order enforces sequenial execuion, i.e., an aciviy is invoked only afer he previous one has erminaed, he weak order beween wo aciviies is more permissive, meaning ha boh aciviies can be execued in parallel as long as he overall effec is he same as if hey would have been execued as specified by he srong order. The differeniaion beween srong and weak order can be made boh wihin processes (inra-process order) and wihin conflicing aciviies of differen processes (iner-process order). Then, all pairs of conflicing aciviies have o be weakly ordered as indicaed by he composie ransacion model. The subsysem is hen responsible for keeping his weak order when execuing boh conflicing aciviies in parallel. In order o ensure his weak order, a subsysem has, for insance, o provide a proocol supporing commi order serializabiliy [BBG89]. Then, he commi order can be derived from he weak order beween conflicing aciviies. Oherwise (if he weak order is no suppored by he subsysem), as he weak order always conains he srong one, conflicing aciviies have o be execued wih respec o a srong order. The re-invocaion of reriable aciviies now may lead o a special reamen of oher aciviies execued in parallel. Suppose wo aciviies a r and a jl, wih a r < S a jl, have o be execued wihin he same subsysem. If he local ransacion T ik corresponding o a r erminaes aboring afer some operaions of T ik have already been execued, hen, in general, he local ransacion T jl (which corresponds o aciviy a jl ) running in parallel o T ik (wih respec o he given weak order) has o be abored, oo. However, as his is no due o a failure of T jl, i mus no lead o an excepion of P j leading o an oher alernaive. Moreover, afer T ik is resared, T jl has o be resared wihin he subsysem, oo, hence guaraneeing compliance o he weak order beween boh ransacions. The inegraion of he composie sysems ideas ino he process model and he process schedule are described in deail in [SAS99]. 4 Conclusion 324 This paper provides a framework o joinly reason abou correc concurrency conrol and recovery for ransacional processes in order o ensure boh a more general noion of aomiciy (guaraneed erminaion) by he flexible handling of failures wih appropriae alernaive execuions and correc inerleavings of parallel processes. Unlike oher approaches addressing only pars of his problem, we cover boh aomiciy and isolaion simulaneously and do concurrency conrol and recovery a he appropriae level, he scheduling of processes. Furhermore, wih he heory of composie sysems, we can ake ino accoun he ineracion beween hierarchical schedulers when execuing ransacional processes and increase parallelism by reaing hem according o he weak conflic order. Wih PRED, we have provided a correcness crierion for ransacional processes based on he noion of compleed process schedules. We have addiionally shown ha, due o he srucure of ransacional processes, he SOT correcness crierion canno be applied. Because of he execuion of non-compensaable aciviies during he compleion of a process, reasoning abou process recovery becomes more complex han in he radiional case where only compensaion has o be applied. Therefore, he compleed process schedule has o be considered. Furhermore, we have idenified imporan prerequisies of PRED schedules ha have o be respeced due o he fac ha some aciviies migh be non-compensaable. Therefore, aside of he aomiciy of single aciviies and he compliance of orderings, he deferred commi of all non-compensaable aciviies and heir aomic commi by exploiing a wo phase commi proocol has o be provided by he subsysems. The framework esablished in his paper no only covers various applicaions such as workflow managemen, process suppor sysems, and he provision of appropriae infrasrucures for elecronic commerce, virual enerprises, and he CIM scenario presened in secion 2, i is also compleely ransparen o he user. Wihin he Wise projec of ETH Zürich [AFH + 99], we have implemened a process scheduler for ransacional process managemen using a proocol which is based on he correcness crierion presened in his paper. This complemens he correcness checking of single processes wih respec o heir guaraneed erminaion propery which is also available wihin he Wise sysem. The wo ideas complee he effor o provide execuion guaranees for ransacional processes. Based on hem, we will in our fuure work expand he framework esablished in his paper o idenify ransacional execuion guaranees of subprocesses and o reason abou decoupled execuion guaranees of subprocesses. References [AAHD97] [ABFS97] [AFH + 99] [AFPS99] I. Arpinar, S. Arpinar, U. Halici, and A. Dogac. Correcness of Workflows in he Presence of Concurrency. In Proceedings of he Nex Generaion Informaion Technologies and Sysems Conference (NGITS 97), Israel, June G. Alonso, S. Blo, A. Feßler, and H.-J. Schek. Correcness and Parallelism in Composie Sysems. In Proceedings of he ACM Symposium on Principles of Daabase Sysems (PODS 97), Tucson, Arizona, May G. Alonso, U. Fiedler, C. Hagen, A. Lazcano, H. Schuld, and N. Weiler. WISE: Business o Business E-Commerce. In Proceedings of he 9 h Inernaional Workshop on Research Issues on Daa Engineering. Informaion Technology for Virual Enerprises (RIDE-VE 99), Sydney, Ausralia, March G. Alonso, A. Feßler, G. Pardon, and H.-J. Schek. Transacions in Sack, Fork and Join Composie Sysems. In Proceedings of he 7 h Inernaional Conference on Daabase Theory (ICDT 99), Jerusalem, Israel, January [Alo97] G. Alonso. Processes + Transacions = Disribued Applicaions. In Proceedings of he High Performance Transacion Processing Workshop (HPTS 97), Asilomar, California, Sepember [AVA + 94] [BBG89] G. Alonso, R. Vingralek, D. Agrawal, Y. Breibar, A. El Abbadi, H.-J. Schek, and G. Weikum. Unifying Concurrency Conrol and Recovery of Transacions. Informaion Sysems, 19(1): , C. Beeri, P.A. Bernsein, and N. Goodman. A model for concurrency in nesed ransacion

10 [BHG87] sysems. Journal of he Associaion for Compuing Machinery, 36(2): , April P. Bernsein, V. Hadzilacos, and N. Goodman. Concurrency Conrol and Recovery in Daabase Sysems. Addison-Wesley, [ELLR90] A. Elmagarmid, Y. Leu, W. Liwin, and M. Rusinkiewicz. A Mulidaabse Transacion Model for InerBase. In Proceedings of he 16 h VLDB Conference, pages , Brisbane, Ausralia, [Elm92] A. Elmagarmid, edior. Daabase Transacion Models for Advanced Applicaions. Morgan Kaufmann, [GHKM94] D. Georgakopoulos, M. Hornik, P. Krychniak, and F. Manola. Specificaion and Managemen of Exended Transacions in a Programmable Transacion Environmen. In Proceeding of he 10 h Inernaional Conference on Daa Engineering (ICDE 94), pages , Houson, Texas, February [GHS95] D. Georgakopoulos, M. Hornick, and A. Sheh. An Overview of Workflow Managemen: From Process Modeling o Workflow Auomaion Infrasrucure. Disribued and Parallel Daabases, 3: , [JK97] S. Jajodia and L. Kerschberg, ediors. Advanced Transacion Models and Archiecures. Kluwer Academic Publishers, [KR98] M. Kamah and K. Ramamriham. Failure Handling and Coordinaed Execuion of Concurren Workflows. In Proceedings of he 14 h Inernaional Conference on Daa Engineering (ICDE 98), pages , Orlando, Florida, February [Ley95] F. Leymann. Supporing Business Transacions via Parial Backward Recovery in Workflow Managemen Sysems. In Daenbanksyseme in Büro, Technik und Wissenschaf, pages 51 70, [MRSK92] S. Mehrora, R. Rasogi, A. Silberschaz, and H. Korh. A Transacion Model for Mulidaabase Sysems. In Proceedigs of he 12 h Inernaional Conference on Disribued Compuing Sysems (ICDCS 92), pages 56 63, Yokohama, Japan, June [NSSW94] M. Norrie, W. Schaad, H.-J. Schek, and M. Wunderli. CIM Through Daabase Coordinaion. In Proceedings of he Inernaional Conference on Daa and Knowledge Sysems, May [RSS97] [SAS99] A. Reuer, K. Schneider, and F. Schwenkreis. ConTracs Revisied, chaper 5. In: [JK97]. Kluwer Academic Publishers, H. Schuld, G. Alonso, and H.-J. Schek. Concurrency Conrol and Recovery for Transacional Processes. Technical repor, Deparmen of Compuer Science, Swiss Federal Insiue of Technology Zürich, [SST98] H. Schuld, H.-J. Schek, and M. Tresch. Coordinaion in CIM: Bringing Daabase Funcionaliy o Applicaion Sysems. In Proceedings of he 5 h European Concurren Engineering Conference (ECEC 98), Erlangen, Germany, April [SWY93] H.-J. Schek, G. Weikum, and H. Ye. Towards a Unifying Theory of Concurrency Conrol and Recovery. In Proceedings of he ACM Symposium on Principles of Daabase Sysems (PODS 93), pages , June [VHYBS98] R. Vingralek, H. Hasse-Ye, Y. Breibar, and H.-J. Schek. Unifying concurrency conrol and recovery of ransacions wih semanically rich operaions. Theoreical Compuer Science, (190): , [WR92] H. Wächer and A. Reuer. The ConTrac Model, chaper 7. In: [Elm92]. Morgan Kaufmann Publishers, [ZNBB94] A. Zhang, M. Nodine, B. Bhargava, and O. Bukhres. Ensuring Relaxed Aomiciy for Flexible Transacions in Mulidaabase Sysems. In Proceedings of he ACM SIGMOD Conference, pages 67 78, Appendix A Proof of Theorem 1 Serializabiliy: Assume ha process schedule S is no serializable. Then, a conflic cycle has o exis of he form P i S P j S... S P i in he commied projecion of S. Therefore, his cycle also exiss in he compleed process schedule S. Thus, i follows ha S canno be reducible and herefore also no PRED. Process-Recoverabiliy: Assume ha process schedule S is no process-recoverable. This can occur because one of he following four cases. In all hese cases, he nex non-compensaable aciviy of P i succeeding a ik is denoed by a in and a jm is he nex noncompensaable aciviy of P j succeeding a jl : Case 1: a ik S a jl S a in S a jm S C j S C i. Consider he prefix S of S ha excludes C i. The compleion C(P i ) of P i may conain an aciviy of he forward recovery pah conflicing wih any aciviy of process P j. As hese aciviies of C(P i ) are no known in advance, new conflics are possible leading o S no being in PRED. Case 2: a ik S a jl S a in S a jm S C j S A i. Consider he prefix S of S ha excludes A i. This prefix is exacly he same as we considered in case 1. Thus, for he same reasons, a conradicion o he assumpion of S being PRED arises. Case 3: a ik S a jl S a in S a jm S A i S C j. Consider he compleed process schedule S of S. The compleion C(P i ) of P i may conain an aciviy of he forward recovery pah conflicing wih any aciviy of process P j. As hese aciviies of C(P i ) are no known in advance, new conflics wih non-compensaable aciviies of P j are possible leading o S no being in PRED.

11 Case 4: a ik S a jl S a jm S a in. Consider he prefix S of S ha excludes a in. Then, if a ik is compensaable, he compensaion of a ik has o be execued in he compleed process schedule S of S. This leads o a conflic cycle in S which canno be eliminaed as compensaion of a jl is no longer available and conradics wih he iniial assumpion of S being PRED. If a ik is no compensaable, hen aciviies of he compleion C(P i ) of P i may exis ha inroduce cyclic conflics ha canno be eliminaed. This also conradics wih he iniial assumpion. B Proof of Lemma 1 Assume ha process schedule S is in PRED and ha in S, a pair of conflicing aciviies a ik and a jl exiss wih a ik S a jl and ha process P i is acive. 1. Assume ha a non-compensaable aciviy a jm is execued before P i has erminaed. Then, if some aciviy a in of P i has o be execued which is in conflic wih a jm, hey would have o be ordered in S as follows: a jm S a in leading o a conflic cycle in S. This cycle canno be eliminaed as: (i) a jm is a non-compensaable aciviy (ii) a ik canno be compensaed as his would, in urn, inroduce anoher conflic cycle in he compleed process schedule S (a c a jl a jm ) (iii) a jl canno be compensaed as i is followed by he non-compensaing aciviy a jm. Therefore, process schedule S is no in RED and hus no in PRED leading o a conradicion wih he iniial assumpion. 2. In his case, we have o differeniae wheher a ik is compensaable or non-compensaable. (i) Assume ha aciviy a ik is compensaable (a c ) while aciviy a jl is no compensaable (a p j l or a r j l ). Then, if he compensaion of a c has o be considered in he compleed process schedule S (when process P i is in B REC), a conflic cycle by a c a jl appears. In his case, S is no in RED and also no in PRED leading o a conradicion wih he iniial assumpion. C Proof of Lemma 2 Assume ha process schedule S is in PRED. Assume furher ha in he compleed process schedule S he compensaing aciviies and j l are execued in he same order as he wo conflicing aciviies a c and a c j l. Then, in S, he following holds: a c a c j l j l leading o a conflic cycle ha canno be eliminaed by one of he reducion rules. Therefore, S is no RED and hus also no PRED leading o a conradicion wih he iniial assumpion. D Proof of Lemma 3 Suppose ha process schedule S is in PRED wih a c S. Assume furher ha he wo conflicing aciviies and he non-compensaable aciviy a r j l are ordered in he compleed process schedule S as follows: a r j l. As commuaiviy is assumed o be perfec, a compensaing aciviy has he same conflics as is corresponding aciviy. Therefore, he conflic cycle a c a r j l in S exiss and canno be eliminaed by he reducion rules and leads o he conclusion ha S is no in RED and hus also no in PRED. This conradics wih he iniial assumpion. (ii) Assume ha boh aciviy a ik and aciviy a jl are no compensaable (hus, boh processes are in F REC). As process P i is acive in S, furher non-compensaable aciviies a in may exis in he compleion C(P i ) of P i. Assume furher ha a in is in conflic wih a jl. Therefore, he order a jl a in has o be imposed in he compleed process schedule S of S. This leads o cyclic conflics in S (a ik a jl a in ) ha canno be eliminaed as all involved aciviies are noncompensaable. In his case, S is no in RED and also no in PRED which conradics wih he iniial assumpion. 326