[erlang-questions] question re. message delivery

[Joe Armstrong]

What I said was "message passing is assumed to be reliable"

The key word here is *assumed* my assumption is that if I open a TCP socket
and send it five messages numbered 1 to 5 then If I successfully read
message
5 and have seen no error indicators then I can *assume* that messages 1 to
4 also arrived in order.

Actually I have no idea if this is true - but it does seem to be a
reasonable
assumption.

Messages 1 to 4 might have arrived got put in a buffer prior to my reading
them and accidentally reordered due to a software bug. An alpha particle
might have hit the data in message 3 and changed it -- who knows?

Having assumed that message passing is reliable I build code based on
this assumption.

I'm not, of course, saying that the assumption is true, just that I trust
the
implementers of the system have done a good job to try and make it true.
Certainly any repeatable counter examples should have been investigated
to see if there were any errors in the system.

All this builds on layers of trust. I trust that erlang message passing is
ordered and reliable in the absence of errors.

The Erlang implementers trust that TCP is reliable.

The TCP implementors trust that the OS is reliable.

The OS implementors trust that the processor is reliable.

The processor implementors trust that the VLSI compilers are correct.

Software runs on physical machines - so really the laws of physics apply not
maths. Physics takes into account space and time, and the concept of
simultaneity does not exist, no so in maths.

It seems to me that software is built upon chains of trust, not upon
mathematical chains of proof.

I've just been saying "what we want to achieve" and not "how we can achieve
it".

The statements that people make about the system should be in terms
of belief rather than proof.

 I'd say "I believe we have reliable message passing"
It would be plain daft to say "we have reliable message passing" or
"we can prove it be correct" since there is no way of validating this.

Call me old fashioned but I think that claims that, for example,
"we have unlimited storage" and so on are just nuts ...

Just say it how it is - we believe this to be the case, and here is our
evidence ...

Cheers

/Joe





On Mon, Sep 25, 2017 at 11:05 PM, Miles Fidelman <mfidelman@REDACTED
> wrote:

> Hi Joe,
>
> Thanks for the reply.  But... it raises a few follow-up questions &
> comments:
>
> Joe Armstrong <erlang-questions@REDACTED> <erlang-questions@REDACTED>
> wrote:
>
> I think I should add - that "in the absence of errors message passing
> is ordered"
>
> I think we should deliberately separate errors which are detected by
> sockets closing, pings timing out etc. from the message passing behaviour.
>
> Imagine a client sends numbered messages 1,2,3,4,5 in order to a server.
> If no errors have been observed and the server receives message 5 we can
> assume that messages 1..4 have also been received in order.
>
> It's the error cases that raise all the interesting questions!  What
> happens if message 5 arrives, but message 4 doesn't, or if it arrives
> later?  Those define the special cases that application logic might have to
> handle!
>
> ------- context of question -----
>
> I was re-reading your thesis the other day (I think a quora interchange
> with Alan Kay sparked me to do so), and these lines particularly caught my
> eye:
>
> *"2. Message passing between a pair of processes is assumed to be ordered
> **meaning that if a sequence of messages is sent and received between any pair
> **of processes then the messages will be received in the same order they were
> **sent."
> **"Note that point two is a design decision, and does not reflect any under-
> **lying semantics in the network used to transmit messages. The underlying
> **network might reorder the messages, but between any pair of processes these
> **messages can be buffered, and re-assembled into the correct order before
> **delivery. This assumption makes programming message passing applications
> **much easier than if we had to always allow for out of order messages."**
>
> but... **"Message passing is assumed to be unreliable with no guarantee of delivery."
>
> *
>
> Somehow, I don't see how this makes "programming message passing
> applications much easier" - maybe it makes the underlying run-time easier,
> but not the applications.  An awful lot of applications can go south very
> quickly if messages are lost (account balances in transaction processing
> systems comes to mind as the obvious example).  If the underlying
> environment doesn't provide BOTH reliable delivery AND ordered delivery,
> one pretty much has to write one's own protocol to guaranty reliable,
> ordered message transmission.
>
> Which leads back to the questions of what, in detail, does Erlang do, and
> how much of that behavior is guaranteed going forward!
>
> ------- end context ---------
>
> <Note:  When I ask about a message "showing up" there's the obvious
> distinction between making it from one processor/node to another, as
> opposed to being placed in the receiving processes inbox, ready to be read?>
>
> What happens if messages 1, 2, 3, 5 (but not 4) show up (are there
> sequence numbers available to the internal message passing mechanisms)?
>
> What happens if 1, 2, 3, 5 show up, and 4 shows up just a tad later - but
> before 5 has been read by the receiving process?
>
> What about if 1,2,3,5 have all been read, and then 4 shows up?
>
> The client will never know how many messages the server has received
> unless the server tells it.
>
> Well, doesn't that have to do with whether there are sequence numbers
> embedded in the message passing mechanism?
>
> This is what the system is supposed to do - how it does it will depend
> on time (ie how it does it today will differ from how it was done 10 years ago)
>
>
> Well... it also depends on how the semantics of message passing are
> defined.
>
>
> In the old days there was just a single socket between a client and
> server - so we assumed that what you wrote to the socket
> got reead in the order it was send. This true at the application level
> packets might get fragmented but they are not reordered.
> (In lower levels of the TCP stack, out of order packages are reordered
> and missing packets resent).
>
> So In the absence of errors (meaning the TCP socket had not closed)
> what comes out of a socket has the same ordering as what went in.
> (Note: not true for UDP)
>
> I guess we also make assumptions that the underlying layers are also
> reliable - So Erlang messaging should be  reliable if TCP is reliable.
>
> Hence my question about mechanisms.  The BEAM Book gives all the gory
> details about how messages are passed (now) in both single-processor &
> multi-processor environments; but details are not provided on how the
> distributed case is handled.
>
> By the way, TCP may be reliable, but if the connection is broken and a new
> connection established, stuff can get dropped - it's a higher level
> decision as to whether lost traffic is resent.  And that's where "design
> decisions" come in - what gets implemented in the run-time system, and what
> is left to applications.
>
> The subject is complicated by a load of theorems saying that various
> things are mathematically impossible (distributed consensus, exactly
> once delivery if messages) -
>
> Add multicore processors and multiple sockets between nodes and
> the situation because a lot more complicated.
>
> Precisely what sparks my interest.
>
> Inquiring minds want to know!  :-)
> Best,
>
> Miles
>
>
> Cheers
>
> /Joe
>
>
> On Mon, Sep 25, 2017 at 6:02 PM, Miles Fidelman
> <> wrote:
> >* On 9/24/17 11:53 PM, Raimo Niskanen wrote:
> *
> >>* On Sun, Sep 24, 2017 at 11:24:31PM -0700, Miles Fidelman wrote:
> *>>* See below....
> *>>>* On 9/24/17 6:10 PM, zxq9 wrote:
> *>>* On 2017年09月24日 日曜日 16:50:45 Miles Fidelman wrote:
> *>>* Folks,
> *>>* I've just been re-reading Joe Armstrong's thesis, and I'm reminded of a
> *>* question that's been nagging me.
> *>>* As I understand it, message delivery is not guaranteed, but message
> *>* order IS. So how, exactly does that work?  What's the underlying
> *>* mechanism that imposes sequencing, but allows messages to get lost?
> *>* (Particularly across a network.)  What are the various scenarios at play?
> *>>* This is sort of backwards.
> *>>* Message delivery is guaranteed, assuming the process you are sending a
> *>* message to exists and is available, BUT from the perspective of the
> *>* sender there is no way to tell whether the receiver actually got it,
> *>* has crashed, disappeared, fell into a network blackhole, or whatever.
> *>* Monitoring can tell you whether the process you are trying to reach
> *>* is available right at that moment, but that's it.
> *>>* The point is, though, that whether the receiver is unreachable, has
> *>* crashed, got the message and did its work but was unable to report
> *>* back about it, or whatever -- its all the same reality from the
> *>* perspective of the sender. "Unavailable" means "unavailable", not matter
> *>* what the cause -- because the cause cannot be determined from the
> *>* perspective of the sender. You can only know this with an out of
> *>* context check of some sort, and that is basically the role the runtime
> *>* plays for you with regard to monitors and links.
> *>>* The OTP synchronous "call" mechanism is actually a complex procedure
> *>* built from asynchronous messages, unique reference tags, and monitors.
> *>>* Note that I didn't ask about the synchronous calls, I asked about raw
> *>* interprocess messages.
> *>>* What IS guaranteed is the ordering of messages *relative to two processes*
> *>>* If A sends B the messages 1, 2 and 3 in that order, they will certainly
> *>* arrive in that order (assuming they arrive at all -- meaning that B is
> *>* available from the perspective of A).
> *>>* But that's the question.  Particularly when sent via network, 1, 2, 3
> *>* may be sent in that order, but, at the protocol level, they may not
> *>* arrive in that order.
> *>>* What protocol level?
> *>>* Erlang distribution has to use or implement a reliable protocol.  Today
> *>* TCP, but anything is possible.  Note that this protocol is between two
> *>* nodes, both containing many processes.  But the emulator relies on the
> *>* transport protocol being reliable.
> *>>>* No.  It doesn't.  It could simply send UDP packets.  I'm asking about
> *>* implementation details.  In Joe's thesis, he says that the behavior is a
> *>* "design choice."  I'm asking about the implementation details.  How does
> *>* BEAM actually handle message delivery - locally, via network?
> *>>* With a reliable transport protocol - say TCP - if the message-containing
> *>* packets arrived as 1, 3, 2, the protocol engine would wait for 2 to
> *>* arrive and deliver 1,2,3 in that order.  If It received 1 & 3, but 2 got
> *>* lost, it would request a re-transmit, wait for it to arrive, and again,
> *>* deliver in that order.
> *>>* But the implication of Erlang's stated rules is that an unreliable
> *>* transport protocol is being used, if you send 1, 2, 3, and what arrives
> *>>* What?  What is stated?
> *>>* From Joe Armstrong's Thesis:
> *>>* "Message passing is assumed to be unreliable with no guarantee of delivery."
> *>>* "Since we made no assumptions about reliable message passing, and must write
> *>* our application so that it works in the presence of unreliable message
> *>* passing it should indeed work in the presence of message passing errors. The
> *>* initial ecort involved will reward us when we try to scale up our systems."
> *>>* "2. Message passing between a pair of processes is assumed to be ordered
> *>* meaning that if a sequence of messages is sent and received between any pair
> *>* of processes then the messages will be received in the same order they were
> *>* sent."
> *>>*  "Note that point two is a design decision, and does not reflect any under-
> *>* lying semantics in the network used to transmit messages. The underlying
> *>* network might reorder the messages, but between any pair of processes these
> *>* messages can be buffered, and re-assembled into the correct order before
> *>* delivery. This assumption makes programming message passing applications
> *>* much easier than if we had to always allow for out of order messages."
> *>>* ---
> *>* I read this as saying, messages will be delivered in order, but some may be
> *>* missing.
> *>>* I'm really interested in this design decision, and how it's implemented.
> *>* (I'm also interested in the logic of why it's easier to program around
> *>* missing messages than out-of-order messages.)
> *>>* Miles
> *>>* --
> *>* In theory, there is no difference between theory and practice.
> *>* In practice, there is.  .... Yogi Berra
> *>>>* _______________________________________________
> *>* erlang-questions mailing list
> *
> > >* http://erlang.org/mailman/listinfo/erlang-questions <http://erlang.org/mailman/listinfo/erlang-questions>
> *>
>
>
> --
> In theory, there is no difference between theory and practice.
> In practice, there is.  .... Yogi Berra
>
>
> _______________________________________________
> erlang-questions mailing list
> erlang-questions@REDACTED
> http://erlang.org/mailman/listinfo/erlang-questions
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://erlang.org/pipermail/erlang-questions/attachments/20170926/d4cc3e86/attachment.htm>