The Principle of Commitment Ordering, or Guaranteeing Serializability in a Heterogeneous Environment of Multiple Autonomous Resource Managers Using Atomic Commitment Yoav Raz Digital Equipment Corporation, 151 Taylor St. (TAYI), Littleton, Ma 01460 Abstract I Introduction Commitment Ordering (CO) is a serializability con- Distributed transaction management services are in- cept, that allows global serializability to be effec- tended to provide coordination for transactionsthat span tively achieved across multiple autonomous Re- multiple resource managers (RMs). source Managers (RMs). The RMs may use A RM is a software component that managesresources different (any) concurrency control mechanisms. under transactions’ control. A resource is any medium Thus, CO provides a solution for the long standing with well defined states that are being modified and re- global serializability problem. RM autonomy means trieved while obeying transaction’s (“ah or nothing”) se- that no concurrency control information is shared mantics (atomicity). This means that effects of failed with other entities, except Atomic Commitment transactions are undone, which requires that resources’ (AC) protocol (e.g. Two Phase Commitment - 2PC) statesbe recoverable (i.e. if a resource is modified by a messages. CO is a necessary condition for guaran- transaction, the state it had when the transaction started teeing global serializability across autonomous can be restoredbefore the transaction ends). A resource RMs. CO generalizes the popular Strong-Strict Two is typically (but not necessarily) a data item. The scope Phase Locking concept (S-S2PL; “release locks of any specific resource(e.g. granularity units, versions, applied on behalf of a transaction only after the or replications) is defined as a part of a RM’s semantics. transaction has ended”). While S-S2PL is subject Examples of resource managers are database systems to deadlocks, CO exhibits deadlock-free executions (DBSs), queue managers,cache managers,some types when implemented as nonblocking (optimistic) of managemententities/objects (e.g. see [EMA], [OSI- concurrency control mechanisms. SMO]) etc. A RM may impose a certain property of the generated transaction histories (transaction event schedules) to guarantee correctnessand certain levels of fault toler- Permission IO copy withoti fee all or part of this material is granted ance. However, the global history, i.e. the combined his- provided that copies are MI ma& or dislributed for direct commercial tory of all the RMs involved, does not necessarilyinherit advantage, the VLDB copyright notice and the ti!le of the publication and its dale appear, and nolice ir given thal copying is by permission such a property even if it is provided by all the RMs. of the Very Large Database Endowment. To copy olherwise, or IO re- The serializability (SER) property is an example. pubbh, requires a fee and/or special permission from the endowment. Serializability is the most commonly accepted general criterion for the correctnessof concurrent transactions Proceedings of the 18th VLDB Conference (e.g. see [Bern 871, [Papa 863, and supported in most Vancouver, British Columbia, Canada 1992 RMs. When transactions involve more than one RM, 292 this property may be violated in general, unless special guarantees global serializability is Strong Strict Two measuresare taken, or certain conditions exist to guar- Phase Locking (S-S2PL; “release locks issued on behalf antee it. This issue is dealt with, for example, in [Brei of a transaction only after the transaction has ended”). 901, [Brei 911, [Elma 871, [Geor 911, [Glig 851, [Litw This fact has been known for several years, and has been 891 and rPu 881. [Weih 891 deals with the relationships the major correctnessfoundation for distributed transac- between local and global serializability in the frarne- tions. Various technical documents about distributed work of abstract data types. Achieving global transaction management (e.g. [OSI-CCR]) have men- serializability with reasonable performance, especially tioned it. The observation that local S-S2PL guarantees across RMs that implement different concurrency con- global serializability appears explicitly at least in vu trol mechanisms,has been considered a difficult prob- 881, [Brei 901 and [Brei 9112.The disadvantageof this lem (e.g. [Shet 901, [Silb 913). approachis that all the RMs involved have to implement S-S2PL based concurrency control, even if other types Global serializability can be guaranteed,in principle, by are preferablefor someRMs. several methods if the RMs involved share relevant concurrency control information. Timestamp Ordering In this paper we examine the relationships between his- (TO) is an example (e.g. [Bern 871, borne 901). If all tories of individual RMs and the global history that the RMs involved support TO-based concurrency con- comprises them, and generalize the above observation. trol and share the same timestamps,then the entire sys- We define a history property named Commitment Or- tem can exhibit a coherent behavior basedon TO, which dering (CO), and show that guaranteeing it is a neces- guaranteesglobal serializability. However, this technol- sary and sufficient condition for guaranteeing global ogy requires a certain RM synchronization as well as serializability under the conditions of RM autonomy. timestamp propagation, and is currently unavailable in CO can be implemented as standalone serializability heterogeneousenvironments. Another known method, mechanismsas well as being incorporated with other based on locking, allows RM autonomy. We define a concurrency control mechanisms.Since CO can be en- RM to be autonomous if it does not share any resources forced solely by controlling the order of transactions’ and concurrency control information (e.g. timestamps) commit events, it can be combined with any other with another entity (external to the RM), and is being concurrency control mechanism without affecting the coordinated (at the nonapplication level’) solely via mechanism’s resource accessscheduling strategy. This Atomic Commitment (AC) protocols (to achieve global allows selecting and optimizing concurrency control for atomicity). Most systems that support distributed trans- each RM according to the nature of transactions in- action services provide AC protocols and related inter- volved. Enforcing CO does not require aborting more faces. These protocols guaranteeatomicity even in the transactionsthan those needed to be aborted for global presence of certain types of recoverable failures. It serializability violation prevention, which is determined means that either a distributed transaction is committed, exclusively by the resource accessorders, and is inde- i.e. its effects on all the resourcesinvolved becomeper- pendent of the commit orders. S-S2PL basedRMs pro- manent, or it is aborted (rolled back), i.e. its effects on vide CO already, since S-S2PL is a special caseof CO. all the resourcesare undone. The most commonly used In summary, serializability of transaction histories atomic commitment protocols are variants of the Two across (any) different RM types, which may use differ- Phase Commitment protocol (2PC - [Gray 781, [Lamp ent concurrency control mechanismsbut provide the CO 761). Examples are Digital Equipment Corporation’s property, is guaranteedwithout any global coordination Distributed Transaction Manager - DECdtm ([DEC- or services but AC. Thus, the CO solution is fully dis- dun]), Logical Unit Type 6.2 of International Business tributed. Machines Corporation ([LU6.2]), and the IS0 - OS1 standard for Distributed Transaction Processing ([OSI- Section 2 is an overview and reformulation of DTP]). A well known local (i.e. local to each RM) serializability theory, which provides the foundation for concurrency control mechanism that together with AC analyzing CO. Section 3 defines CO and describes its ‘Typically, a RM is unaware of any resource state dependency with states of resources external to the RM, implied by applica- tions. This is also true in the cases where RMs are coordinataed by multi-database systems, which provide applications with integrated views of resources. 2 [Brei 911 uses the term rigorousness for S-S2PL. [Brei 911 also redefines CO (naming it strong recoverabifify) and uses it to show that applying S-S2PL locally guarantees global serializability. No algorithm for enforcing CO (beyond SS2PL) is given there. 293 properties. Section 4 examines CO schedulersand pre- The events of interest are the following2: sents generic CO algorithms. Section 5 deals with multi l The operation of reading a resource; ri[x] denotes RM histories, atomic commitment, and relationships be- that transaction Ti has retrieved (read) the (partial) tween local and global properties. Section 6 shows that stateof the resourcex. CO is exactly the property required to guaranteeglobal serializability across autonomous RMs. Section 7 pro- l The operation of writing a resource; wi[x] means vides a conclusion. This paper is an abridged version of that transaction Ti has modified (written) the state [Raz 903. of the resourcex. Ending a transaction; ei means that Ti has ended (has been either committed or aborted) and will not 2 Histories and their properties - introduce any further operations. an overview A transactionobeys the following transaction rules (axi- oms): This section summarizesand reformulates known con- l TRl cepts and results of concurrency control theory (seealso A transactionTi has exactly a single event