Data transfer analysis for a pair of asynchronous communication algorithms H.R. Simpson Abstract: A common form of asynchronous communication mechanism (ACM) provides a one- way data transfer connection between two concurrent processes in which the writer uses a control algorithm to release data within the mechanism and the reader uses a control algorithm to acquire data within the mechanism, without recourse to arbitration or exclusion which could impede the progress of either the writer or the reader. When execution of the control algorithms is distinct, the reader acquires the latest data item released by the writer. When execution of the control algorithms overlaps, the reader acquires either a data item which is being or has been released during the overlapped acquisition, or the data item which is the latest released prior to the start of acquisition. The particular data item acquired is determined by the interleaving of critical events in each algorithm. The paper formally analyses a pair of algorithms to determine the way in which the data item acquired depends on the precise ordering of interleaved algorithm events. New insights into the notion of data freshness in ACMs are gained, and the essential similarity between several well known pairs of control algorithms is exposed. The formal analysis of ACM algorithms complements the previously derived formal specifications for such ACMs. 1 Introduction The general form of the asynchronous communication mechanism (ACM) problem considered in this paper is shown in Fig. 1. The writing and reading processes execute independently, and from time to time interact with the ACM control variables to release and acquire data items within the ACM. The technical challenges posed by this problem are the maintenance of freshness (stale data items must not be acquired) and coherence (interleaved or concurrent access to the same data item must not occur), whilst avoiding any arbitration or exclusion which could impede the progress of either process. Many types of solution have been proposed. Some [1–3] involve multiple insertion or extraction of data items, but these seem unnecessarily complex and of little practical value. Others [4–7] work with a single insertion and extraction, plus control algorithms to release and acquire the data items within the ACM. An important subclass of these uses four slots in the ACM to hold: (i) the data being written prior to release; (ii) the data being read following acquisition; (iii) the latest data released but not yet acquired (if any); and (iv) an additional slot to provide manoeuvring space as the writer and reader asynchronously adjust their focus of attention within the mechanism. A recent paper [8] summarises a number of pairs of these release and acquisition algorithms. This paper starts by considering the formal specification for mechanisms in the class of interest, and then goes on to select and describe a particular algorithm pair for detailed analysis. Critical interactive events within each algorithm are identified, and a formal expression giving the point of data release is derived. This is followed by the derivation of a formal expression for the point of acquisition, and for the relationship between acquired and released data. It is shown that this type of analysis can also be applied to an important ‘parallel’ variant of the chosen algorithms, and indeed to other similar algorithm pairs. A strong motivation for the paper is to complete the formal identification and explora- tion of ACM properties started in [9] and further developed in [8]. The paper develops a series of linked concepts and abstract property definitions to limit the complexity at each stage in the analysis. These are summarised in an Appendix (Section 9). 2 Specification The ACM subclass considered here is an example of the pool protocol, one of a range of protocols recently proposed [9]. The properties of the protocols are expressed in real time logic (RTL) [10, 11], so a brief summary of RTL is presented before giving the formal specification for a pool. RTL is not chosen for its logical deductive power, but for the natural way in which it can express the timing relationships between events in iterative concurrent processes [9]. 2.1 RTL notation RTL works in terms of two interdependent ideas: actions and events. An event occurs at a point in time, whereas actions generally have duration and are characterised by their start and end events. Notationally, for any action A, " A is its start event, and # A is its end event. An action A may be decomposed into component actions (A1, A2, say), thus: A ¼ A1;A2 q IEE, 2005 IEE Proceedings online no. 20045031 doi: 10.1049/ip-cdt:20045031 The author is a Visiting Professor at Kingston University and at the University of Newcastle, and he is a Research Consultant at MBDA UK Ltd, Stevenage, Herts, SG1 ZDA, UK E-mail: [email protected]Paper first received 11th May and in revised form 23rd November 2004 IEE Proc.-Comput. Digit. Tech., Vol. 152, No. 5, September 2005 549
Transcript
Data transfer analysis for a pair of asynchronouscommunication algorithms
H.R. Simpson
Abstract: A common form of asynchronous communication mechanism (ACM) provides a one-way data transfer connection between two concurrent processes in which the writer uses a controlalgorithm to release data within the mechanism and the reader uses a control algorithm to acquiredata within the mechanism, without recourse to arbitration or exclusion which could impede theprogress of either the writer or the reader. When execution of the control algorithms is distinct, thereader acquires the latest data item released by the writer. When execution of the control algorithmsoverlaps, the reader acquires either a data item which is being or has been released during theoverlapped acquisition, or the data item which is the latest released prior to the start of acquisition.The particular data item acquired is determined by the interleaving of critical events in eachalgorithm. The paper formally analyses a pair of algorithms to determine the way in which the dataitem acquired depends on the precise ordering of interleaved algorithm events. New insights intothe notion of data freshness in ACMs are gained, and the essential similarity between several wellknown pairs of control algorithms is exposed. The formal analysis of ACM algorithmscomplements the previously derived formal specifications for such ACMs.
1 Introduction
The general form of the asynchronous communicationmechanism (ACM) problem considered in this paper isshown in Fig. 1. The writing and reading processes executeindependently, and from time to time interact with the ACMcontrol variables to release and acquire data items within theACM. The technical challenges posed by this problem arethe maintenance of freshness (stale data items must not beacquired) and coherence (interleaved or concurrent accessto the same data item must not occur), whilst avoiding anyarbitration or exclusion which could impede the progress ofeither process. Many types of solution have been proposed.Some [1–3] involve multiple insertion or extraction of dataitems, but these seem unnecessarily complex and of littlepractical value. Others [4–7] work with a single insertionand extraction, plus control algorithms to release andacquire the data items within the ACM. An importantsubclass of these uses four slots in the ACM to hold: (i) thedata being written prior to release; (ii) the data being readfollowing acquisition; (iii) the latest data released but notyet acquired (if any); and (iv) an additional slot to providemanoeuvring space as the writer and reader asynchronouslyadjust their focus of attention within the mechanism.A recent paper [8] summarises a number of pairs of theserelease and acquisition algorithms.This paper starts by considering the formal specification
for mechanisms in the class of interest, and then goes on to
select and describe a particular algorithm pair for detailedanalysis. Critical interactive events within each algorithmare identified, and a formal expression giving the point ofdata release is derived. This is followed by the derivation ofa formal expression for the point of acquisition, and for therelationship between acquired and released data. It is shownthat this type of analysis can also be applied to an important‘parallel’ variant of the chosen algorithms, and indeed toother similar algorithm pairs. A strong motivation for thepaper is to complete the formal identification and explora-tion of ACM properties started in [9] and further developedin [8]. The paper develops a series of linked concepts andabstract property definitions to limit the complexity at eachstage in the analysis. These are summarised in an Appendix(Section 9).
2 Specification
The ACM subclass considered here is an example of thepool protocol, one of a range of protocols recently proposed[9]. The properties of the protocols are expressed in realtime logic (RTL) [10, 11], so a brief summary of RTL ispresented before giving the formal specification for a pool.RTL is not chosen for its logical deductive power, but forthe natural way in which it can express the timingrelationships between events in iterative concurrentprocesses [9].
2.1 RTL notation
RTL works in terms of two interdependent ideas: actionsand events. An event occurs at a point in time, whereasactions generally have duration and are characterisedby their start and end events. Notationally, for any actionA, "A is its start event, and #A is its end event. An actionA may be decomposed into component actions (A1, A2,say), thus:
A ¼ A1; A2
q IEE, 2005
IEE Proceedings online no. 20045031
doi: 10.1049/ip-cdt:20045031
The author is a Visiting Professor at Kingston University and at theUniversity of Newcastle, and he is a Research Consultant at MBDA UKLtd, Stevenage, Herts, SG1 ZDA, UK
Component actions are contiguous, and are a completeexpression of the composite action of which they are part.A dot notation is used to identify the components of acomposite, so we have the following event equivalences:"A ,"A:A1; #A:A1 ,"A:A2; #A:A2 ,#A.
Both actions and events are recurrent as a process threadexecutes, and occurrences are distinguished by an indexnumber of type Index:
Index ¼ N [ f�1g
N is any natural number, and is used for actions and eventsoccurring during normal operation, i.e. operation afterinitialisation. Index value 21 denotes initialisation, and isneeded to identify essential actions and events which musttake place before normal operation starts.
At the heart of RTL is the three parameter occurrencepredicate y, with signature:
y : Event� Index� Time ! Bool
The predicate y, when true, expresses the condition that aparticular type of event with a particular index numberoccurs at a particular time. For example, we can writeyð"A;k; tÞ to define that iteration k of event "A occurs attime t.
Values are passed from writer to reader through theACM, and the type Item is used to denote the data itemswhich are transiently resident in the ACM. Two furtherpredicates (not part of standard RTL) are introduced to trackvalues through the ACM:
res : Action� Index� Item ! Bool
arg : Action� Index� Item ! Bool
The res predicate, when true, expresses the condition thatthe result returned by an action with a particular indexnumber is determined by the value of a particular data item.The arg predicate, when true, expresses the condition thatthe argument of an action with a particular index numberdetermines the value of a particular data item. The res and
arg predicates are used as a pair with a common itemparameter in order to define the value identity beween areading action and a writing action.
2.2 Top level specification
Figure 1 shows that the communicationmodel is based on theprinciple of data shared between the writer and the reader.The general form of thismodel [9] allowswriting and readingto be destructive or nondestructive, and the number ofintermediate items that can be retained between processescan be anything from zero upwards. The pool ACM, thesubject of this paper, is a particularly useful form of thegeneral model, in which there is a single intermediate dataitem and where writing is destructive and reading isnondestructive, so that neither writer nor reader can be heldup. At the top level of abstraction, the durations of the controloperations for releasing and acquiring data are assumed to beinfinitessimally short (but see Section 2.3 below).
Single identifiers W and R are used, respectively, todenote the writing and reading operations. The top levelpool specification [9] is given in Fig. 2 and expresses therelationship between input and output values. Read iwill getthe value written by write S(i); this is the initialisation value(index 21) if no value has yet been released during normaloperation. The definition of S makes use of an auxiliaryfunction Z(e,t). The definition of Z is in two parts separatedby the _ symbol on the right-hand side of the , symbol.The first part covers all time up to, but not including, thetime of the first occurrence of e (index 0) during normaloperation. The second part works by finding the index for esuch that there is no further occurrence of e before, but notat, t. We should note here that successive occurrences of ecannot be coincident, and that when an e occurs at t, this isthe event occurrence which is chosen by Z.
2.3 Intermediate specification
An expanded, and more realistic, form of specification canbe given [8] by explicitly recognising the control algorithmswhich release and acquire data within the ACM. Writing(W) and reading (R) are now expressed thus:
W ¼ D; C
R ¼ C; D
where D is a data action (insertion when writing, extractionwhen reading), and C is a control action (release whenwriting, acquire when reading).
Fig. 2 Pool specification
8i: Index; t: Time � yð"R; i; tÞ ) 9d : Item � res(R, i, d ) ^ arg(W, S(i ), d )
where:
{S(i ) gives index of latest data availability ð#WÞ for given data acquisition ð"RÞ}{SðiÞ ¼ �1 indicates that the initialisation data is acquired}
8i; s: Index �SðiÞ ¼ s , 9t : Time � yð"R; i; tÞ ^ s ¼ Zð#W; tÞwhere:
{Z(e, t) gives the index of the most recent event e before or at time t}{Zðe; tÞ ¼ �1 indicates that there has been no such event}
8z: Index; t: Time; e: Event � Zðe; tÞ ¼ z ,ðz ¼ �1 ^ :9t1 : Time � t1 � t ^ yðe; 0; t1ÞÞ_ðz � 0 ^ 9t1 : Time � t1 � t ^ yðe; z; t1Þ ^ :9t2 : Time � t1< t2 � t ^ yðe; zþ 1; t2ÞÞ
Fig. 1 Communication model
IEE Proc.-Comput. Digit. Tech., Vol. 152, No. 5, September 2005550
The expanded specification [8] is given in Fig. 3.The function Z from Fig. 2 can be used to determineJE, the latest completely released data item before the startof the acquisition action. This gives the earliest (or oldest)item that can be acquired by the reader. Since we do notexpress precisely what happens during the control actions, itis possible that the reader may also be able to pick up anincompletely released item with a (possibly incomplete)acquisition action when the control actions overlap. Thus Zcan also be used to determine JL, the latest incompletelyreleased or incompletely acquired (or both) item when thecontrol actions overlap. When there is no overlap, JE isequal to JL.The JE and JL functions can be brought together as shown
in Fig. 3 to define the range of written data items that can beacquired by the reader. This specification can be read asfollows: when the read control action with index i ends, thenthe value of the item acquired is that which was establisedby the write data action with index j, where j lies in the rangeset by JE(i) and JL(i). This expresses the inherent boundeduncertainty that arises from the (unavoidably) noninstanta-neous release and acquisition actions.
3 Algorithms
The ACM selected for analysis [4, 5] is one of the mostcompact known, and has already been comprehensivelymodel checked [12] in terms of the same critical interactiveevents as are needed for the RTL analysis in this paper.
3.1 Control algorithms and variables
The control algorithms and variables for the chosen ACMare given in Fig. 4. Data is passed through the four-slot arrayd, arranged as two pairs of slots. Access to d is controlled bythe shared variables w, r, s. Two local variables, wp and ri,are also used. Technically, wp is an own variable, as itsvalue must be retained between invocations of the releasealgorithm. The writer and reader execute an orthogonalavoidance strategy in which they can start and finish theirdata accesses at any time whilst avoiding any possibility ofdata corruption, and where the latest completely writtenvalue is made available for acquisition by the reader. Tomaintain coherence the writer is always directed to the pairnot being used for reading, and the reader is always directedto the slot in the pair not being used for writing. As regardsdata freshness, the reader always acquires access to data asspecified in Fig. 3.
The release algorithm, in addition to releasing access tothe latest data, acquires access to the next slot for writing.The acquire algorithm, in addition to acquiring access to thelatest data, releases a slot for further use. The open accessform of the algorithms [8] is shown, whereby eachalgorithm sets up a pointer, id and od, respectively, to theslot next to be accessed. In this open access formulation, aslot is explicitly allocated for write access (W.D) over thecomplete interval between successive W.C actions, and forread access (R.D) over the complete interval betweensuccessive R.C actions. An identical slot allocation strategy
Fig. 3 Expanded pool specification
8i: Index; t: Time � yð#R:C;i; tÞ )9d : Item; j : Index � res( R, i, d ) ^ arg(W, j, d ) ^ JEðiÞ � j � JLðiÞ
where:
{JE(i) gives the index of the earliest ‘fresh’ data }{JL(i) gives the index of the latest ‘fresh’ data}
8i; j: Index � JEðiÞ ¼ j , 9t : Time � yð"R:C; i; tÞ ^ j ¼ Zð#W:C; tÞ8i; j: Index � JLðiÞ ¼ j , 9t : Time � yð#R:C; i; tÞ ^ j ¼ Zð"W:C; tÞ
Fig. 4 Algorithms
Shared Data:d[bit, bit]: data :¼ ((init, null), (null, null)) {slots for data}
Shared Control Variables:w : bit :¼ 0 fpair last writtengr : bit :¼ 0 fpair being readgs[bit]: bit :¼ ð0; 0Þ fslot last written in each pairgWriter Local Variable:wp : bit :¼ 1 fpair being writtengReader Local Variable:ri : bit :¼ 1 fslot last written in pair last writtengWriter Access Pointer:id :" data :¼" data½1; 1� fpointer to slot for data insertiongReader Access Pointer:od :"data :¼"data½0;0� fpointer to slot for data extractiongRelease Algorithm:s½wp� :¼ :s½wp�; w :¼ wp; wp :¼ :r; id :¼"d[wp, :s[wp ]]Acquire Algorithm:r :¼ w; ri :¼ s½r�; od :¼"d[r,ri ]
is implicit in the closed access form. Control variables andoperations are the same for open and closed access, and anyformal analysis is equally applicable to both.
Figure 4 shows initial values for the ACM data andvariables. These values are based on the convention that,during initialisation prior to normal operation, the writerinserts the initial value and releases it, and then the readeracquires access to this value [8]. This ensures that id and odare set to legal and sensible values at system start time.
3.2 Interactive events
Critical interactive events within each algorithm occurwhenever a control value is written to, or read from, a sharedcontrol variable. When writing to a shared variable, thecritical event occurs shortly before the end of the writeoperation, at the point where the written value can first beseen. When reading a shared variable, the critical eventoccurs shortly after the beginning of the read operation, atthe point where the read value is effectively fixed. Sixevents, each referred to by a three letter mnemonic [12], canbe identified within the algorithms as shown in Fig. 5.
Previous work [8, 12] has shown that interacting eventscan always be regarded as distinct. When the controlvariables are implemented in memory shared between twosoftware processes, conventional arbitration will enforce anapparent order of closely occurring write and readoperations. When the control variables are directlyimplemented in hardware, then metastability [13–15] ispossible if a variable is read close to the point where it isbeing changed. Vanishingly small failure probabilities canbe achieved provided that the appropriate circuit designtechniques are used, together with sufficient delay betweeninterrogation of a shared variable and use of the value soobtained. The minimum delay needed can be engineered tobe well below the instruction interval of accessing
processors, so this form of shared control variable isperfectly feasible. For these hardware implementations, theapparent order of closely occurring events depends onwhether the value read stabilises to the old or new value ofthe changing shared variable.
Algorithm events can be directly related to specificationevents as shown in Fig. 6. In so doing [8], we define W.Cand R.C to cover only the durations which are of interestfrom the interaction viewpoint, and we exclude allcomponents (e.g. the data slot pointer assignments)which do not affect the interactive slot selection logic.Thus W.C and R.C each start and finish with an algorithmevent, and each contains a third (distinct) event within itsduration.
The analysis in this paper places no constraints on the rateof progress of each process, so in principle data accessactions can interleave control actions in any way including,for example, one or more complete data accesses by oneside within the duration of a single control action by theother. Identical interleaving effects are achieved in theatomic model shown in Fig. 7, where algorithm statementsare executed atomically and do not overlap. Such a modelfaithfully reflects the interleaving semantics but, contrary toconventional expectations, it does not imply any essentialatomicity requirement for implementations.
4 Analysis
Although the control algorithms are extremely simple,comprising just a few binary operations on a small numberof control variables, the effects of asynchronous interleavingmake it difficult to find the relevant abstractions to supportformal analysis. First, we examine the conditions whichdefine the point of data release. From this emerges aframework for dividing ACM operation into a cycle of fourphases. This allows the point of data acquisition to beexamined within this framework, finally resulting in aformal expression for the input to output data itemequivalence based on the algorithm events which make upthe release and acquisition control actions.
4.1 Data release
Inspection of the write control algorithm shows that twoevents contribute to the release of a new item of data: wisand wip. If the writer has just switched pairs, and so the datais the first to be newly assembled in the current selection ofthe current pair, then the new data is not visible until wip.However, if the writer is not switching pairs, then wip isirrelevant and the new data is visible at wis. The term pairsequence is introduced to denote the condition where thesame pair is used for successive write accesses or successiveread accesses; this includes, as a limiting case, pair
Fig. 5 Algorithm events
wis writer indicates slot occurs shortly before finishof ðs½wp� :¼ :s[wp ])
9t1 : Time � t1< t ^ yð"W:C; j; t1Þ ^ :9t2 : Time � t2< t ^ yð#W:C; j; t2Þ8i: Index; t: Time � yðrcp; i; tÞ , yð"R:C; i; tÞ8i: Index; t: Time � yðrcs; i; tÞ , yð#R:C; i; tÞ8i: Index; t: Time � yðrip; i; tÞ )
9t1 : Time � t1< t ^ yð"R:C; i; t1Þ ^ :9t2 : Time � t2< t ^ yð#R:C; i; t2Þ
IEE Proc.-Comput. Digit. Tech., Vol. 152, No. 5, September 2005552
sequences consisting of just a single write or read access.Thus, if we define a boolean auxiliary function P( j) toexpress whether the data is the first to be written in a writepair sequence, then the expression at the top of Fig. 8 givesthe effective point of data release #W, say, in terms of wipand wis.To derive an expression for P( j) in terms of previous
events, two further auxiliary functions are introduced: Q( j)expressing whether data is the last to be written in a writepair sequence, and G(i) expressing whether data is the firstto be read in a read pair sequence. P, Q and G are definedrecursively in terms of each other, as shown in Fig. 8, andare best understood by first considering the general casewhere i; j>0 (initial values are explained in Section 4.2).P( j) is always identical to Q( j 2 1), as the first write in apair sequence always follows the last write in the previouspair sequence. G(i) evaluates to true at the first rcpfollowing a wip for which P( j) is true, i.e. when the readerfirst recognises that new data has been released in the otherpair. Q( j) evaluates to true at the first wcp following an ripfor which G(i) is true, i.e. when the writer first recognisesthat data has been acquired in the pair being written. It isreadily confirmed that every term in each expression is itselfevaluated at a time which is the same or earlier than the timeat which it is used, and that recursive evaluation willnaturally proceed backwards in time until the initial valuesare reached. These expressions provide a direct and naturalway of expressing the dynamic operation of the poolimplementation logic.Figure 9 gives some example traces. In such diagrams,
there are two horizontal time lines, one for the writer andone for the reader, each being marked with control events,and where the heavy lines bridging between the time lines
indicate the association between data written and data read.Trace 1 shows alternating distinct control actions, whereboth writer and reader make two consecutive accesses to thesame pair before switching to the other pair. In trace 2, aparticular overlap pattern results in alternating access. Intrace 3, control actions are distinct and the writer and thereader both make two consecutive accesses to the same pair,as in trace 1; but now some (alternate) data items are neverused (data loss), and other (alternate) data items are usedtwice (data repetition). Each example trace is annotated toshow the points at which P, Q, G is true, and is relevant tointeraction with the other time line.
4.2 Initial values
Control variable initialisation is carried out by release andacquisition of the initial data item, both of which take placebefore the notional system start time [8]. Thus initial valuesfor P, Q, G at system start-up are determined by the pre-initialisation values of r, w, wp, together with the accesscontrol events occurring during system initialisation:
. P(0). This is always true as wp 6¼ w at system start-up, sothat writing is to a different pair to that written last(notionally by the initialisation write action with index21).This is consistent with the condition that r ¼ w ¼ wp priorto the initialisation actions, so that the initialisation releaseswitches writing to the other pair.. G(0). This is only true if rcp with index 0 occurs after wipwith index 0, thus indicating that the reader should switchpairs to obtain new data. Trace 1 of Fig. 10 illustrates this. Italso shows that the reader has access to the initial data itemat system start-up, even though it has not yet executed anacquire action during normal operation.
Fig. 7 Atomic model
Reader Local Variable:rt: bit {temporary variable}
Release Algorithm:s½wp� :¼ :s[wp ]; w :¼wp; wp :¼:r; id :¼ "d[wp, :s[wp ]]Acquire Algorithm:rt :¼ w; r :¼ rt; ri :¼ s½r�; od :¼ "d[r, ri ]Note: Variable identifiers carried forward from Fig. 4.
{P( j) is true iff first write in write pair sequence}{Q( j) is true iff last write in write pair sequence}{G( j) is true iff first read in read pair sequence}
. Q(0). This is only true if wcp with index 0 is able to detectthat the reader has acquired the (new) pair just written. Thissituation arises in practice if we obtain the event order wiprcp rip wcp during the first write release action (index 0).Trace 2 of Fig. 10 illustrates this. Earlier reads will sustainthe initial r ¼ w condition and will continue to read theinitial value without switching pairs.
4.3 Phases of operation
Data acquisition can start at any time relative to data release,and can overlap in any way. To ensure that all possibilitiesare considered, it is useful to introduce and define distinctphases of operation for the ACM. The existence of just fourphases can be inferred from Fig. 8, where it can be seen thatthe realisation of true values for P, G, Q follows a strictsequence. To support the discussion the notion of key eventsis introduced, identified by G@rcp, G@rip, Q@wcp,P@wip, and indicating the particular rcp, rip, wcp, wipevents where the associated G, Q, P is true. Assuming thatboth processes continue to progress, the four phases ofoperation develop as follows: consider G@rcp with index i(say); in due course this is followed by G@rip with indexi; in due course this is followed by Q@wcp with index j(say); in due course this is followed by P@wip with indexjþ 1; and in due course this is followed by G@rcp withindex k (say), where k> i. The sequence then repeats. Anynumber of further wip events can occur after a P@wipbefore it is followed by a G@rcp, and any number of further
rip events can occur after a G@rip before it is followed by aQ@wcp.
The four phases are named and formally defined as shownin Fig. 11. The identifiers indicate the start and endconditions of a transition. For example, QP(t) covers thetime from Q@wcp up to (but not including) P@wip. Thereare no temporal equalities for event timings in the formaldefinitions as interactive events are regarded as distinct (seeSection 3.2), and sequential events are always separated bya finite time interval. QP(t) and GG(t) cover transitionswithin a single process, whereas PG(t) and GQ(t) covertransitions between processes. Only one phase expressionevaluates to true at any one time, and for any phase the nextkey event to occur is the one which terminates it. Initially,QP(t) is defined as true from system start-up to the first wip(index 0); this is consistent with the initialisation constraintsfor P, G, Q.
4.4 Data acquisition
We can define an effective acquisition point "R (say) suchthat the data item to be read following "R is the data itemreleased at the immediately preceding #W; "R must liewithin or on the bounds of R.C. Slot selection by the readeralways occurs at #R.C (rcs), but this selection can only takeplace within the pair already selected at "R.C (rcp). Ittranspires that the crucial factor is the occurrence ofswitching wcp events (Q@wcp). A switching wcp eventsteers data to the pair not selected by the reader, and soprevents visibility of further data in the newly selected pair.
Fig. 9 Example traces (1)
Fig. 10 Example traces (2)
IEE Proc.-Comput. Digit. Tech., Vol. 152, No. 5, September 2005554
The analysis concentrates on situations where the controlsequences overlap; the nonoverlapping cases are relativelystraightforward and are covered by the overlap logic.First we examine the four possibilities for the phase in
which rcp ð"R:CÞ occurs:. rcp in QP. Q for the pair selected by the reader is known tobe true at the time when rcp occurs, so there will be no newdata in this pair after rcp, which must be regarded as "R.. rcp in GQ. Although Q is not yet true at rcp it is knownthat it will become so at the next wcp, at which point(Q@wcp) new data will be steered to the other pair. ThisQ@wcp may lie within R.C, in which case it must beregarded as "R, or it may not have occurred by rcs, in whichcase this rcs is the effective "R.. rcp in PG. This is logically impossible (see Fig. 11),given that rcp is the event which causes the phase to changefrom PG to GG.. rcp in GG. The ACM phase changes to GG at rcp,following the previous PG phase. Q is false for the selectedpair, so further data may be inserted in this pair. Q@wcpcannot occur before rip, as it is G@rip which triggers thetransition to Q@wcp. If Q@wcp occurs between rip and rcs,then this is "R, as no new data will be visible after this point.However, if Q@wcp has not occurred by rcs, then "R is atrcs (cf. rcp in GQ above).
These four cases are most readily distinguished by notingthat only when rcp is in QP is "R at rcp. For the other twopossible cases (rcp in GQ and rcp in GG), QP is false at rcp.The expression at the top of Fig. 12 shows the use of a
boolean auxiliary function E(i) to act as the discriminatorwhich determines that "R is at rcp.
When rcp is in GQ or GG, we need to establish, inrelation to R.C, where the next Q@wcp occurs. Between rcpand rcs there can only be one Q@wcp, as it is necessary forfurther rcp and rip events (following the next wip) tointervene before Q@wcp can occur again. Figure 12 definesa boolean function F(i) to determine whether a Q@wcpevent lies between rcp and rcs, and an integer function Jx(i)to determine the index number of this Q@wcp. Note that, inthe expression for Jx(i), the value j ¼ �1 is used tocomplete the expression when :FðiÞ, i.e. no Q@wcpbetween rcp and rcs. Figure 12 shows how F and Jx areused to give an expression for "R. For rcp in GQ, Q@wcpcan occur anywhere within R.C, but when rcp is in GG,Q@wcp cannot occur before rip.
Example traces can be used to illustrate these interactioneffects. Trace 1 of Fig. 13 shows that, provided it is knownat rcp that a Q@wcp event has already switched writing tothe alternate pair, then "R is fixed at rcp. Traces 2 and 3show event sequences where Q is still false at rcp but it isalready known that it will become true at the next wcp.Although in trace 2 we could nominate rcp as the effective"R, trace 3 shows that Q@wcp is the appropriate "R neededto cover both these situations. Trace 1 is easily modified toshow the nonoverlapping case, where Q@wcp is followedby one or more read control sequences which completebefore the next write control sequence starts.
Figure 14 shows situations where GG is true at rcp.Although P is shown as true at the wip event immediately
Fig. 11 Phases
{QP(t) is true iff ACM is in transition from Q@wcp to P@wip }{PG(t) is true iff ACM is in transition from P@wip to G@rcp}{GG(t) is true iff ACM is in transition from G@rcp to G@rip}{GQ(t) is true iff ACM is in transition from G@rip to G@wcp}
8t : Time � QPðtÞ , 9t1 : Time; j : N � t1 � t ^ yðwcp; j; t1Þ ^ Qð jÞ ^:9t2 : Time � t2< t ^ yðwip; jþ 1; t2Þ _ :9t0 : Time � t0< t ^ yðwip; 0; t0Þ
8t : Time � PGðtÞ , 9t1 : Time; j : N � t1 � t ^ yðwip; j; t1Þ ^ Pð jÞ ^:9t2 : Time;i : N � t1< t2< t ^ yðrcp; i; t2Þ
8t : Time � GGðtÞ , 9t1 : Time; i : N � t1 � t ^ yðrcp; i; t1Þ ^ GðiÞ ^:9t2 : Time � t2< t ^ yðrip; i; t2Þ
8t : Time � GQðtÞ , 9t1 : Time; i : N � t1 � t ^ yðrip; i; t1Þ ^ GðiÞ ^:9t2 : Time; j : N � t1< t2 < t ^ yðwcp; j; t2Þ
{E(i) is true iff QP is true at rcp with index i }{F(i) is true iff there is a Q@wcp event between rcp and rcs, both with index i }{Jx(i) gives the index of the Q@wcp event (if any) between rcp and rcs }
8i : N � EðiÞ , 9t : Time � yðrcp; i; tÞ ^ QPðtÞ8i : N � FðiÞ , 9t1 : Time � yðrcp; i; t1Þ^
9t : Time; j : N � t1< t ^ yðwcp; j; tÞ ^ Qð jÞ ^ :9t2 : Time � t2< t ^ yðrcs; i; t2Þ8i : N; j : Index � JxðiÞ ¼ j , FðiÞ ^ 9t : Time � yðwcp; j; tÞ ^ Qð jÞ _ :FðiÞ ^ ð j ¼ �1Þ
preceding rcp, the uninterrupted run of writes before the readcontrol sequence can be of any length, so P@wip may haveoccurred earlier than shown. Thus, by the time rcp occurs,new datamay be being released by either awis or awip event.Trace 1 shows the case where no new data is released duringthe read control sequence. Trace 2 shows that new data,without inhibiting the possibility of supersession by laterdata, can be written and released more than once before theend of acquisition provided that at least one wcp occursbefore rip. In both cases "R is at Q@wcp and the slot to beread is picked up by rcs at the end of the read controlsequence. Trace 2 is easily modified to show the non-overlapping case where the read control sequence followingG@rcp is not overlapped by any write control sequence.
If, in Fig. 13, traces 2 and 3, and Fig. 14, traces 1 and 2,Q@wcp is slipped to the right to occur after rcs, then thetraces illustrate the "R at rcs situation, which arises when:GG at rcp and :F during R.C. The precise position of wcpin relation to rcs is not critical in terms of the data acquired,consistent with the fact that these are noninteracting events;however, the definition of "R must allow for thenonoccurrence of Q@wcp before rcs.
4.5 Data transfer equivalence
Consistent with the style of specification used in Figs. 2 and3, the relationship between written and read items can bedefined as shown in Fig. 15. When E(i), so that acquisition isnotionally at the start of R.C, the data acquired is that which
was effectively released at wis with index Jp(i) (see Fig. 13,trace 1), unless we have the event order wip rcp rip wcpduring normal operation (cf. Fig. 10, trace 2), in which casethe data was released at wip, but also with index Jp(i). When:EðiÞ and JxðiÞ ¼ JpðiÞ (see Fig. 13, trace 2 and Fig. 14, trace1), the data acquired is that which was released at either wipor wis with index Jx(i), as P for this write control action maybe true or false. When :EðiÞ and JxðiÞ>JpðiÞ (see Fig. 13,trace 3 and Fig. 14, trace 2), it is always the data released atwis which is acquired. The released data acquired when j ¼JsðiÞ follows the same reasoning as for j ¼ JxðiÞ.
The data transfer equivalence defined in Fig. 15 can beshown to be consistent with the expanded specificationgiven in Fig. 3. First, we note that Fig. 15 defines j, the indexof the data item acquired, to lie in the range
JpðiÞ � j � JsðiÞ
Next we note that #R:C , rcs and "W:C , wis, so we cansay JLðiÞ ¼ JsðiÞ. Also, "R:C , rcp and #W:C , wcp,and wcp follows wip with the same index so that the latestwcp before rcp may on occasion be one less than the latestwip before rcp, leading to JEðiÞ � pðiÞ. Thus,
JEðiÞ � JpðiÞ � j � JsðiÞ ¼ JLðiÞ
Removing the Jp(i) and Js(i) terms gives
JEðiÞ � j � JLðiÞ
and so demonstrates the required compatibility with Fig. 3.
Fig. 13 Example traces (3)
Fig. 14 Example traces (4)
IEE Proc.-Comput. Digit. Tech., Vol. 152, No. 5, September 2005556
Compatibility between Figs. 15 and 2 can also be argued.The communication model corresponding to the specifica-tion in Fig. 2 does not recognise the existence of W.C andR.C. If we define the event mappings #W ,#W and" R ,"R, then the implementation exactly meets the poolspecification in Fig. 2. This is consistent with the idea thatthe details of release and acquisition are below the thresholdof concern for this level of abstraction.
4.6 Coherence
The freshness relationship between output and input data isexplicit in Figs. 2, 3 and 12, but coherence is only expressedimplicitly by the fact that the res and arg functions operateon a common item parameter (which must not be corruptedwhilst it is held within the ACM). The four phasespreviously identified can be used as the framework forexamining coherence:
. GG: G@rcp (index i) to G@rip (index i). During thisinterval, the reader does not access the data in the ACM, socoherence is not affected.. GQ: G@rip (index i) to Q@wcp (index j). One writecompletes during this interval. If wis (index j) occurs beforeGQ, then the writer does not access data in the ACM duringGQ, so coherence is not affected. Similarly, if wis (index j)occurs during GQ, there is no write access to the ACM afterthis wis. However, during the interval G@rip (index i) to wis(index j), both writer and reader may be accessing the ACMat the same time and zero or more reads may start during thisinterval. Coherence is preserved in that the reader,regardless of which pair is acquired, always chooses theslot which is not currently being written.. QP: Q@wcp (index j) to P@wip (index jþ 1). One writestarts and completes during this interval. Any read inprogress at the start of this interval, or which starts during
this interval, is in the opposite pair to the write, so coherenceis preserved.. PG: P@wip (index j) to G@rcp (index i). Zero or morewrites may start and one read completes during this interval.The writes are in one pair and the read is in the other, socoherence is preserved.
5 Discussion
The analysis has concentrated on a particular pair ofalgorithms. It is interesting to consider the extent to whichthis analysis, modified where necessary, can be applied toother solutions. It will be seen that the analysis has widerapplication, and that the formal expressions do indeedcapture the appropriate ACM properties for these othersolutions.
5.1 Alternative four-slot solutions
At least two alternative solutions [6, 7] have been proposed,derived independently, in which intermediate data is alsoheld in four slots organised into two pairs. These solutionswere originally expressed in a software programminglanguage form, rather than in the algebraic notation whichhas been used for the algorithms analysed in this paper.Furthermore, the solutions provided closed rather than openaccess. To facilitate comparison, the two solutions aretransformed into open access versions and are set out in thealgebraic notation using identical identifiers for identicalvariables wherever possible. In both cases the essence of theoriginal solution is preserved.
The transformed Tromp solution [6] is given in Fig. 16.The variable b determines whether or not the writer isswitching pairs. The operating principle is that the slot tobe written in a pair is only switched if the pair is notbeing switched. The algebraic form in Fig. 16 is such that
Fig. 16 Alternative algorithms [6]
Writer Local Variables:b : bit :¼ 1 { 1 iff writer switching pairs }x½bit� : bit :¼ ð0; 1Þ { slot to be written in each pair }
Release Algorithm:s½wp� :¼ b ^ s½wp� _ :b ^ x½wp�; w :¼ b ^ wp _ :b ^ w; b :¼ ðr ¼ wÞ ^ 1 _ ðr 6¼ wÞ ^ 0;wp :¼ b ^ :wp _ :b ^ wp; x½wp� :¼ b ^ x½wp� _ :b ^ :x½wp�; id :¼" d½wp; x½wp��Acquire Algorithm:r :¼ w; ri :¼ s½r�; od :" d½r; ri�Note: Variable identifiers carried forward from Fig. 4.
Fig. 15 Data transfer equivalence
8i : Index; t : Time � yð# R:C; i; tÞ )9d : Item; j : Index � resðR; i; dÞ ^ argðW; j; dÞ^
only one statement on either side of the b assignmentproduces a change in control variable value on eachiteration of the write control sequence. This preserves thelogic of an if r ¼ w statement in the original softwareform, whilst providing a series of unconditionallyexecuted statements.
The transformed Anderson and Gouda solution [7] isgiven in Fig. 17. The single local variable x ensuresalternating write access to the slots in both pairs. Bothalternative solutions leave the acquire algorithm unchanged.
5.2 Alternative solution analysis
Comparison of the two alternative solutions with thesolution in this paper shows that the only essentialdifference is the way in which the next slot to be writtenis selected when the pair is being switched. Tromp takes thelast written slot when the pair is being switched. Andersonand Gouda use a common variable for both pairs which willonly take the last written slot when there has been an oddnumber of intervening writes to the other pair. The solutionpresented in this paper always takes the slot which was notlast written. All three solutions are sound, so one canconclude that, on switching pairs, either slot in the new pairmay be selected. However, alternate slots must be usedwhen not switching pairs, as is evident in all three solutions.
Events can be assigned to algorithm statements (Fig. 5)precisely as before, and are the same, and occur in the sameorder, for all solutions. In this context it should be noted thatan event occurrence does not necessarily produce a changein a control variable; on occasion an assignment operationmay re-assign the old value and will therefore have noeffect. In particular, wis and wip in the Tromp solution aresuch that only one is effective in any one iteration of thewrite control action, so these could be combined into a
single event wis=wip, say. This, although it is an ingeneousfeature of the Tromp solution, does not invalidate the use ofseparate wis and wip in the interests of providing a commonanalytic framework for all solutions.
Pairwise behaviour is the same for all three solutions, sothe analysis and example traces in Figs. 6, and 8–15 alsocover the two alternatives.
5.3 Parallel variant
Figure 18 gives a parallel variant [5, 12], an algorithmform more suitable for hardware implementation. In therelease algorithm, the second and third operations ofthe original solution (Fig. 4) are carried out in parallel.This transformation is effective provided that w alwaystakes up the old value of wp when wp takes up the value of:r. In the acquire algorithm, both s variables are read, theappropriate one being chosen when the potentially meta-stable value of r has settled. Figure 18 also includes anatomic model version of the algorithms, which would beneeded for a software implementation of this parallelvariant.
To illustrate the application of the parallel variantalgorithms, consider an implementation form in which thealgorithm logic is activated by the leading and trailing edgesof a single activation pulse on each side. If the durations ofthe activation pulses are short in comparison with the dataaccess times, then multiple overlaps of the control actionscannot occur. To preserve fault free event sequences [12],the width of the pulses should be greater than the naturalswitching interval of the implementation electronics, i.e. thetime taken (d, say) to establish a new clear value when thereis no metastability. In release, if ws and wf are the start andfinish of the activation pulse then, in the absence of
Fig. 18 Parallel variant
Writer Local Variable:wt: bit { temporary variable }
Reader Local Variable:v[bit] : bit :¼ ð0; 0Þ { slot last written in each pair (copy) }
Release Algorithm:s½wp� :¼ :s½wp�; ðwp;wÞ :¼ ð:r;wpÞ; id :¼" d½wp;:s½wp��Acquire Algorithm:r :¼ w; v :¼ s; od :¼" d½r; v½r��Release Algorithm (Atomic Model):s½wp� :¼ :s½wp�; wt :¼ wp; wp :¼ :r; w :¼ wt; id :¼" d½wp;:s½wp��Acquire Algorithm (Atomic Model):rt :¼ w; r :¼ rt; v :¼ s; od :¼" d½r; v½r��Note: Variable identifiers carried forward from Figs. 4 and 7.
Fig. 17 Alternative algorithms [7]
Writer Local Variables:x : bit :¼ 1 {slot to be written in both pairs}
Release Algorithm:s½wp� :¼ x; w :¼ wp; wp :¼ :r; x :¼ :x; id :¼"d½wp; x�Acquire Algorithm:r :¼ w; ri :¼ s½r�; od :¼"d½r; ri�Note: Variable identifiers carried forward from Fig. 4.
IEE Proc.-Comput. Digit. Tech., Vol. 152, No. 5, September 2005558
metastability, wis is at wsþ d, wcp is at wf, and wip is atwf þ d. In acquisition, if rs and rf are the start and finish ofthe activation pulse then, in the absence of metastability, rcpis at rs, rip is at rsþ d; and rcs is at rf. Only one side of theACM can experience a (single) metastable event in anyparticular overlap situation, arising from either rip-wcp, orwip-rcp, or wis-rcs interaction, and this cannot affect controloperations on the other side during this iteration. However,in both release and acquisition, the data access pointer mustonly be used after an appropriate metastability resolutiondelay has been allowed.
5.4 Parallel variant analysis
The order of events in the acquisition logic is the same forboth sequential and parallel forms, i.e. rcp rip rcs. However,the release logic has an event order of wis wip wcp for thesequential form, but this changes to wis wcp wip for theparallel variant (noting that wip relates to the pair lastwritten and not to the immediately preceding wcp). Modelchecking [12] has shown that both event orders are sound.Changing the order of events modifies the event
equivalence, as previously defined in Fig. 6. Event wipnow maps to #W:C, and wcp now occurs between "W:Cand #W:C. The data release conditions, as defined in Fig. 8,are still valid. However, it is now impossible for G@rcp andG@rip, both with index i, to squeeze in between P@wip andQ@wcp, both with index j; this means that the Q(0)condition always evaluates to false and can be omitted forthe parallel variant. By the same reasoning, it is alsoimpossible now for P(i) and Q(i) both to be true, so when "Ris at wcp, "W is always at the immediately preceding wis(cf. section 4.5). The phases of ACM operation, as definedin Fig. 11, remain precisely as before. Likewise theexpressions defining data acquisition in Fig. 12 remain asbefore, and the data transfer equivalence in Fig. 15 isunchanged. The coherence analysis set out in Section 4.6remains valid.
6 Conclusion
The formal expressions in the paper provide the means foridentifying and defining abstract properties for a class offour-slot ACMs. This has provided new insights to ACMoperation and has produced a 4-phase cyclic framework forthe detailed analysis of algorithm execution. Commonalitybetween various well known solutions has been exposed.The freshness property of the ACM solutions has beenshown to be consistent with both extended and top levelspecifications.The analysis, by deriving a precise relationship between
the indices of acquired and released data items, providesnew detail in the expression of data freshness in this type ofACM. The effective point of data acquisition has beenshown to be identified with any one of three algorithmevents: rcp, wcp, rcs. It is surprising to find a releasealgorithm event within this set, where intuitively one wouldexpect to see only acquisition events.The paper has again [8, 9] demonstrated that the RTL
notation can be applied with advantage to this class of
ACM, but it has to be said that this must be done withconsiderable thought and care. The value of the formalnotation for this work lies in its clarity and precision, ratherthan in its ability to support mathematical manipulation, andthis is as yet an unexploited possibility. The application ofRTL does appear to force out abstractions which would nototherwise be easily discovered.
The algorithms analysed in the paper are all based on theorthogonal avoidance principle, whereby the writer hascontrol of the slots within a pair, and the reader has controlof the pairs. No attempt has been made to apply the formalanalysis to the alternative strategy where the writer controlsthe pairs and the reader controls the slots [16]. This remainsas a topic for further research.
7 Acknowledgments
Many colleagues have assisted by way of informaldiscussion and helpful comments on the material for thispaper: Len Griffiths, John Belling, Stephen Paynter, EricCampbell, Jim Armstrong, Richard Stables, Ian Clark, andthe referees. The parallel variant derives from hardwaredesign work carried out by Eric Campbell to provideimplementations in silicon. The intermediate data itemtechnique for relating input to output values is due toStephen Paynter and Jim Armstrong. This work forms partof an MBDA applied research programme.
8 References
1 Lamport, L.: ‘On interprocess communication. Part II: Algorithms’,Distrib. Comput., 1986, 1, (2), pp. 86–101
2 Peterson, G.L.: ‘Concurrent writing while reading’, ACM Trans.Program. Lang. Syst., 1983, 5, (1), pp. 46–55
3 Burns, J.E., and Peterson, G.L.: ‘Constructing multi-reader atomicvalues from non-atomic values’. Proc. 6th Annual ACM Symp. onPrinciples of Distributed Computing, 1987, pp. 222–231
6 Tromp, J.: ‘How to construct an atomic variable’. Proc. 3rd Int.Workshop on distributed algorithms, 1989, pp. 292–302
7 Anderson, J.H., and Gouda, M.G.: ‘A criterion for atomicity’, Form.Asp. Comput., 1992, 4, (3), pp. 273–298
8 Simpson, H.R.: ‘Freshness specification for a class of asynchronouscommunication mechanisms’, IEE Proc. Comput. Digit. Tech., 2004,151, (2), pp. 110–118
9 Simpson, H.R.: ‘Protocols for process interaction’, IEE Proc. Comput.Digit. Tech., 2003, 150, (3), pp. 157–182
10 Jahanian, F., and Mok, A.K.: ‘Safety analysis of timing properties ofreal-time systems’, IEEE Trans., 1986, 12, (9), pp. 890–904
11 Jahanian, F., Mok, A.K., and Stuart, D.A.: ‘Formal specification of realtime systems’. TR-88-25, Dept. Computer Sciences, The University ofTexas at Austin, 1988
12 Simpson, H.R.: ‘Correctness analysis for class of asynchronouscommunication mechanisms’, IEE Proc. Comput. Digit. Tech., 1992,139, (1), pp. 35–49
13 Chaney, T.J., and Molnar, C.E.: ‘Anomalous behavior of synchronizerand arbiter circuits’, IEEE Trans., 1973, 22, (4), pp. 421–422
14 Horstmann, J.U., Eichel, H.W., and Coates, R.L.: ‘Metastabilitybehavior of CMOS ASIC flip-flops in theory and test’, IEEE J. Solid-State Circuits, 1989, 24, (1), pp. 146–157
15 Kinniment, D.J., Bystrov, A., and Yakovlev, A.V.: ‘Synchronisationcircuit performance’, IEEE. J. Solid-State Circuits, 2002, 37, (2),pp. 202–209
16 Simpson, H.R.: ‘New algorithms for asynchronous communication’,IEE Proc. Comput. Digit. Tech., 1997, 144, (4), pp. 227–231
