1. 1 Formal Models for Distributed Negotiations Committed Join Calculus Roberto Bruni Dipartimento di Informatica Università di Pisa XVII Escuela de Ciencias Informaticas (ECI 2003), Buenos Aires, July 21-26 2003

2. Formal Models for Distributed Negotiations2 Our Focus In commercial applications, separately designed and implemented components must interact commit (intermediate) results of long-running activities upon (partial) agreements e.g. e-commerce, on-line auction systems Formal models should avoid ad-hoc proprietary solutions offer alternatives to centralized transaction managers hide the coordination layer (separation of concerns)

3. Formal Models for Distributed Negotiations3 Distributed Agreements Negotiations / Contracts commit, abort, compensation hierarchical decisions dynamic membership fully distributed control Process cooperation coordination / orchestration / choreography different platforms and policies Data integration unstructured documents in different formats

4. Formal Models for Distributed Negotiations4 Prerequisites for Modeling Contracts Local and global resources Local sub-contracts and decisions Global results posted upon commit Abort of ongoing contracts All participants must be informed Compensations can be activated Either abort or commit (no divergence) Dynamic joining of participants Contracts can be merged Nested structure of contracts

5. Formal Models for Distributed Negotiations5 Commitment We have seen different concepts in different areas DataBase transactions Transactional Workflows Transition synchronization PDLs with commit primitives Committed choice languages

6. Formal Models for Distributed Negotiations6 PDLs with commit Transactions in JavaSpaces and Linda create(x) and commit(x) prefixes event notification TraLinda typed messages (L / H) and atomic prefixing Long running transactions M INI -XLANG asynchronous  -calculus with transactional context context(P,Pf,Pc)

7. Formal Models for Distributed Negotiations7 Committed Choice Languages Logic programming Non determinism means exhaustive search of successful computations don’t know non-determinism results are produced at the end Concurrent logic / constraint languages limit backtracking to improve efficiency don’t care non-determinism (indeterminism) partial outputs during computation

8. Formal Models for Distributed Negotiations8 Guarded Horn Clauses Head  Guard | Body Reduce Head to Body if Guard succeeds don’t know when evaluating guards don’t care when selecting clauses whose guards are true Flat guards conjunction of primitive predicates Deep guards (e.g. AKL) both primitive and programmed predicates

9. Formal Models for Distributed Negotiations9 Our Proposal committed JOIN PDL presentation Non ACID Multiway Open Nesting Flexible Split / Join Programmable commit / abort / compensation Concurrency and distribution Distributed 2PC Different levels of abstraction

10. Formal Models for Distributed Negotiations10 Why an extension of JOIN Well-known asynchronous calculus Distributed implementations Jocaml Polyphonic C# Analogous to dynamic coloured Petri nets Running D2PC implementation CHAM semantics molecules form solutions enclosed in membranes nesting is free (via membranes) Typed serializability Ongoing Work!

11. Formal Models for Distributed Negotiations11 Committed JOIN Syntax M,N::= 0 | x  ŷ  | M|N P,Q ::=M | def D in P | P|Q | abort | [P:Q] D,E ::=J  P | D  E | J  P J,K ::= x  ŷ  | J|K messages programmable abort compensation contract boundaries merge definitions (boards): defined boards must be disjoint from ordinary defined names

12. Formal Models for Distributed Negotiations12 Committed JOIN Semantics 0  P|Q  P,Q DEDE  D,E def D in P  D  dn(D), P  dn(D) range(  ) fresh J  P, J   J  P, P 

13. Formal Models for Distributed Negotiations13 Committed JOIN Semantics 0  P|Q  P,Q DEDE  D,E def D in P  D  dn(D), P  dn(D) range(  ) fresh J  P, J   J  P, P  [P:Q]  {[ P,   Q  ]} compensation is kept frozen contract P can evolve in isolation

14. Formal Models for Distributed Negotiations14 Committed JOIN Semantics 0  P|Q  P,Q DEDE  D,E def D in P  D  dn(D), P  dn(D) range(  ) fresh J  P, J   J  P, P  [P:Q]  {[ P,   Q  ]} {[ M|def D in 0,   Q  ]}  M commit global resources

15. Formal Models for Distributed Negotiations15 Committed JOIN Semantics 0  P|Q  P,Q DEDE  D,E def D in P  D  dn(D), P  dn(D) range(  ) fresh J  P, J   J  P, P  [P:Q]  {[ P,   Q  ]} {[ M|def D in 0,   Q  ]}  M {[ abort |P,   Q  ]}  Q compensation on abort

16. Formal Models for Distributed Negotiations16 Committed JOIN Semantics 0  P|Q  P,Q DEDE  D,E def D in P  D  dn(D), P  dn(D) range(  ) fresh J  P, J   J  P, P  [P:Q]  {[ P,   Q  ]} {[ M|def D in 0,   Q  ]}  M {[ abort |P,   Q  ]}  Q J 1 |…|J n  P,  i {[ J i , S i,   Q i  ]}  J 1 |…|J n  P, {[  i S i, P ,   | i Q i  ]} merge n ongoing contracts

17. Formal Models for Distributed Negotiations17 JOIN vs cJOIN PROPOSITION cJOIN is a conservative extension of JOIN: P  J Q iff P  cJ Q (for P and Q JOIN processes)

18. Formal Models for Distributed Negotiations18 A Multi-Way Contract …,J  [P:Q],J   …,J  [P:Q],[P  :Q  ] …,J’  [P’:Q’],J’   …,J’  [P’:Q’],[P’  :Q’  ] … …,J 1 |J 2  M, [J 1  :Q  ],[J 2  :Q’  ]  …,J 1 |J 2  M,[M  :Q  |Q’  ] …,[M  :Q  |Q’  ]  …,M 

19. Formal Models for Distributed Negotiations19 Multi-Level Nesting …,J  [[P 1 :Q 1 ]|[P 2 :Q 2 ]:Q],J   …,J  [[P 1 :Q 1 ]|[P 2 :Q 2 ]:Q], [ [P 1  :Q 1  ] | [P 2  :Q 2  ] : Q  ] … …,[[M 1  :Q 1  ]|[P 2  :Q 2  ]:Q  ]  …,[ M 1  | [P 2  :Q 2  ] : Q  ] … …,[ M 1  | [M 2  :Q 2  ] : Q  ]  …,[ M 1  | M 2  : Q  ]  …,M 1 ,M 2 

20. Formal Models for Distributed Negotiations20 Nested Abort …,J  [[P 1 :Q 1 ]|[P 2 :Q 2 ]:Q],J   …,J  [[P 1 :Q 1 ]|[P 2 :Q 2 ]:Q], [ [P 1  :Q 1  ] | [P 2  :Q 2  ] : Q  ] … …,[ [abort :Q 1  ] | [P 2  :Q 2  ] : Q  ]  …,[ Q 1  | [P 2  :Q 2  ] : Q  ] … …,[ M 1  | [M 2  :Q 2  ] : Q  ]  …,[ M 1  | M 2  : Q  ]  …,M 1 ,M 2 

21. Formal Models for Distributed Negotiations21 Nested Abort II …,J  [[P 1 :Q 1 ]|P 2 :Q],J   …,J  [[P 1 :Q 1 ]|P 2 :Q], [ [P 1  :Q 1  ] | P 2  : Q  ] … …,[[P 1  :Q 1  ]|abort :Q  ]  QQ

22. Formal Models for Distributed Negotiations22 Hotel Booking H  def WaitBooking  [ def request  o   o  $  | price  $   price  $  | confirm  v   BookedRoom  v   price  $   abort in offeringRoom  request,confirm  : Q ]  BookedRoom  v   … in WaitBooking | …

23. Formal Models for Distributed Negotiations23 Hotel Booking H  def WaitBooking  [ def request  o   o  $  | price  $   price  $  | confirm  v   BookedRoom  v   price  $   abort in offeringRoom  request,confirm  : Q ]  BookedRoom  v   … in WaitBooking | … C  def BookingHotel  [def hotelMsg  r,c   def offer  $   c  visa  | HotelFound  offer  $   abort in r  offer  in searchRoom  hotelMsg  : Q’ ] in BookingHotel | …

24. Formal Models for Distributed Negotiations24 Hotel Booking H  def WaitBooking  [ def request  o   o  $  | price  $   price  $  | confirm  v   BookedRoom  v   price  $   abort in offeringRoom  request,confirm  : Q ]  BookedRoom  v   … in WaitBooking | … C  def BookingHotel  [def hotelMsg  r,c   def offer  $   c  visa  | HotelFound  offer  $   abort in r  offer  in searchRoom  hotelMsg  : Q’ ] in BookingHotel | … HB  def searchRoom  hm  | offeringRoom  r,c   hm  r,c  in H | C

25. Formal Models for Distributed Negotiations25 Hotel Booking …, WaitBooking, BookingHotel   …, […, offeringRoom  request,confirm  : Q ], […, searchRoom  hotelMsg  : Q’]  …, […, hotelMsg  request,confirm  : Q | Q’]  …, […, request  offer  : Q | Q’]  …, […, offer  $ , price  $  : Q | Q’]  …, […, confirm  visa , HotelFound, price  $  : Q | Q’]  …, […, BookedRoom  visa , HotelFound : Q | Q’]  …, BookedRoom  visa , HotelFound

26. Formal Models for Distributed Negotiations26 Trip Booking I H as before F  def WaitBooking  [ def request  o   o  $  | price  $   price  $  | confirm  v   BookedFlight  v   price  $   abort in offeringFlight  request,confirm  : Q ]  BookedFlight  v   … in WaitBooking | … local name, different from homonym name in H

27. Formal Models for Distributed Negotiations27 Trip Booking II C  def hotelOK  fc  | flightOK  hc   fc | hc  BookingHotel  [def hotelMsg  r,c   def offer  $   c  visa  | hotelOK  flightConf   offer  $   abort  flightConf  HotelFound in r  offer  in searchRoom  hotelMsg  : Q’ ]  BookingFlight  [def flightlMsg  r,c   def offer  $   c  visa  | flightOK  hotelConf   offer  $   abort  hotelConf  FlightFound in r  offer  in searchFlight  flightMsg  : Q’’ ] in BookingHotel | BookingFlight | … TB  def searchRoom  hm  | offeringRoom  r,c   hm  r,c   searchFlight  fm  | offeringFlight  r,c   fm  r,c  in H | F | C both needed to commit

28. Formal Models for Distributed Negotiations28 Matching the Prerequisites Local and global resources Local sub-contracts and decisions Global results posted upon commit Abort of ongoing contracts All participants must be informed Compensations can be activated Either abort or commit (no divergence) Dynamic joining of participants Contracts can be merged Nested structure of contracts membranes and scoping rules nesting commit reaction several variants of abort would limit the expressiveness merge definitions (boards) multi-level

29. Formal Models for Distributed Negotiations29 ZS nets, JOIN and cJOIN ZS nets can be encoded in JOIN by attaching the dynamic creation of a local DTC to transitions Implementation of D2PC (transparent to users) Tokens must carry several channel names Each firing must undergo local DTCs approval cJOIN primitives allow a straightforward encoding No further protocol is needed Tokens carry just one contract identifier Firings directly correspond to reactions

30. Formal Models for Distributed Negotiations30 ZS nets in JOIN We encode basic nets, which are expressive enough: fork open join close compute [[ E open e ]] = E  def D in e(put, { lock }) | state({ E }) [[ e calc e’ ]] = e(p, L)  e’(p, L) [[ e fork e’, e’’ ]] = e(p, L)  def D in e’(p, L  { lock }) | e’’(put, L  { lock }) | state(  ) [[ e’, e’’ join e ]] = e’(p’, L’) | e’’(p’’, L’’)  e(p’, L’  L’’) | p’’(L’’  L’,  ) [[ e close E ]] = e(p, L)  p(L, { E }) given a net (T,S) we define an agent def [[ T ]] in [[S]], where default compensation

31. Formal Models for Distributed Negotiations31 DTC in JOIN the definition D is the following state(H) | put(L, F)  commit(L \ { lock }, L, { lock }, F, H ) state(H)  failed() | release(H) commit({ l }  L, L’, L’’, F, H)  commit(L, L’, L’’, F, H) | l(L’, lock, fail ) commit(L, L’, L’’, F, H) | lock(L’’’, l, f )  commit(L  (L’’’ \ L’), L’  L’’’, L’’  { l }, F, H ) commit( , L, L, F, H)  release(F) commit(L, L’, L’’, F, H) | fail()  failed() | release(H) failed() | put(L, F)  failed() failed() | lock(L, l, f)  failed() | f() failed() | fail()  failed()

32. Formal Models for Distributed Negotiations32 ZS nets in cJOIN We encode basic nets, which are expressive enough: fork open join close compute [[ E open e ]] = E  [ def z  0 in e  z  : E ] [[ e calc e’ ]] = e  z   e’  z  [[ e fork e’, e’’ ]] = e  z   e’  z  | e’’  z  [[ e’, e’’ join e ]] = e’  z’  | e’’  z’’   e  z’  [[ e close E ]] = e  z   E given a net (T,S) we define an agent def [[ T ]] in [[S]], where dummy definition (JOIN way of declaring a local id) z’ and z’’ have now identical scope and meaning

33. Formal Models for Distributed Negotiations33 Committed Join Features Negotiations can be defined in terms of concurrent sub-negotiations Cooperation between contracts are given by merging definitions Global resources produced inside a negotiation are made available at commit time Commit means termination Explicit abort and compensation

34. Formal Models for Distributed Negotiations34 Some results on cJoin cJoin is a conservative extension of Join P  J Q iff P  cJ Q. (P and Q Join processes) Zero-safe nets can be encoded as cJoin processes N=(T,S) a ZS net. (S,  )  * (S’,  ) iff def [T] in [S]  * def [T] in [S]

35. Formal Models for Distributed Negotiations35 cJOIN and Logic Languages Commit primitives of cJoin can be used to implement committed choices of AKL explicit encoding of search strategies and unification via continuation passing and compensation

36. Formal Models for Distributed Negotiations36 Serializability A simple type system that guarantees serializability Shallow processes the start of a sub-negotiation can be postponed until all the cooperating sub-negotiations needed to commit can be generated inside its parent negotiation Proof via correspondence w.r.t. big step semantics

37. Formal Models for Distributed Negotiations37 Encoding of cJOIN in JOIN Aim: Define an implementation of cJOIN in JOIN Associate to every cJOIN process a JOIN process that simulate its behavior Ideas: Identification of basic forms for definitions Definition of a type system to single out canonical processes Reuse controllers of the D2PC protocol

38. Formal Models for Distributed Negotiations38 Abstract Semantics Expected Result Define the abstract representative of a cJOIN process a JOIN process describing all the stable behaviors of the original process def a  x  |b  y   [def c  z   b  z  in a  y  | c  x  : a  x  |b  y  ] in a  1  |b  2  def a  x  | b  y   a  y  | b  x  in a  1  |b  2 

39. Formal Models for Distributed Negotiations39 Comparatives studies Comparison with other approaches for modeling long-running activities Transactional context of M INI -XLANG distinguish two kinds of compensations Goals Find limitations / restrictions Show the encoding of other common constructors (such as those in WMS)

40. Formal Models for Distributed Negotiations40 References Committed actions for mobile calculi (PhD Thesis Proposal, Manuscript, 2003) H. Melgratti Nested commits for mobile calculi: extending Join (Manuscript) R. Bruni, H. Melgratti, U. Montanari