\section{Causality test cases}
\label{sec:examples}

In this section, we discuss three of the causality test cases and the thread
inlining from \cite{Manson:2005:JMM:1047659.1040336}.  In presenting the
examples, we unroll loops, correct typos and simplify the code.

\subsection{Causality test case 8}

\begin{comment}
Consider the program variant:

x=0; r=x; if(r<2){y=1} || x=5

[[ y=1 ]] contains (Wy1)

[[ if(r<2){y=1} ]] contains (r<2|Wy1)

[[ r=x; if(r<2){y=1} ]] contains (Rx5)  (x<2|Wy1)  //with no order

[[ x=0; r=x; if(r<2){y=1} ]] contains (Wx0)  (Rx5)  (x<2|Wy1) //does not work, since violates (6a) 𝜆Φ′(𝑒) implies 𝜆Φ(𝑒)[𝑣/𝑥].

Another example:
So consider the single threaded program

x=4; x=5; r=x; if(r==4){y=1}

Clearly, this should not be able to give us Wy1.
Here is why that is not possible:

[[ y=1 ]] contains (Wy1)

[[ if(r==4){y=1} ]] contains (r==4|Wy1)

[[ r=x; if(r==4){y=1} ]] contains (Rx5)  (x==4|Wy1) // with no order

[[ x=5; r=x; if(r==4){y=1} ]] contains (Wx5)-->(Rx5)  (5==4|Wy1) // 5 is forced.
\end{comment}

Test case 8 asks whether:
\begin{displaymath}
   \PW{x}{0}\SEMI
   \PW{y}{0}\SEMI
  (\IF{x<2}\THEN \PW{y}{1}\FI
  \PAR
  \PW{x}{y})
\end{displaymath}
may read $1$ for both $x$ and $y$.  This behavior is allowed, since
``interthread analysis could determine that $x$ and $y$ are always either $0$
or $1$.''  This breaks the dependency between the read of $x$ and the write
to $y$ in the first thread, allowing the write to be moved earlier.

The semantics of TC8 includes
\begin{tikzdisplay}[node distance=1em]
  \event{ix}{\DW{x}{0}}{}
  \event{iy}{\DW{y}{0}}{right=of ix}
  \event{rx1}{\DR{x}{1}}{right=2.1em of iy}
  \event{wy1}{\DW{y}{1}}{right=of rx1}
  \event{ry1}{\DR{y}{1}}{right=2.1em of wy1}
  \event{wx1}{\DW{x}{1}}{right=of ry1}
  \po{ry1}{wx1}
  %\po[out=30,in=150]{ix}{rx1}
  \rf[in=-25,out=-160]{wx1}{rx1}
  \rf[out=20,in=160]{wy1}{ry1}
  \wk[out=-25,in=-150]{ix}{wx1}
  \wk[out=25,in=155]{iy}{wy1}
\end{tikzdisplay}
Where we require $(\DW{x}{0})\lt(\DR{x}{1})$ but not $(\DR{x}{1})\lt(\DW{y}{1})$.
To see why this execution exists, consider the left thread with syntax sugar
removed:
\begin{displaymath}
  \PR{x}{r}\SEMI \IF{r<2}\THEN \PW{y}{1}\FI
\end{displaymath}
\begin{math}
  \sem{\IF{r<2}\THEN \PW{y}{1}\FI}
\end{math}
includes
\begin{math}
  (r<2\mid\DW{y}{1}).
\end{math}
% \begin{tikzdisplay}[node distance=1em]
%   \event{wy1}{r<2\mid\DW{y}{1}}{}
% \end{tikzdisplay}
Thus, by the definition of prefixing read,
\begin{math}
  \sem{\PR{x}{r}\SEMI \IF{r<2}\THEN \PW{y}{1}\FI}
\end{math}
includes
\begin{math}
  (\DR{x}{1}) \prefix (r<2\mid\DW{y}{1})[x/r]
\end{math}
which simplifies to
\begin{math}
  (\DR{x}{1}) \prefix (x<2\mid\DW{y}{1}),
\end{math}
which, by Definition~\ref{def:prefix}, includes:
\begin{tikzdisplay}[node distance=1em,baselinecenter]
    \event{rx1}{\DR{x}{1}}{}
    \event{wy1}{x<2\mid\DW{y}{1}}{right=of rx1}
  \end{tikzdisplay}
% Here we have used the \textsc{[non-ordering read]} clause of Definition~\ref{def:prefix}:
% ``$\bForm'$ implies $\bForm[\aVal/\aLoc] \land \bForm$, if $\aAct$ reads $\aVal$ from $\aLoc$,''
% where $a=(\DR{x}{1})$,  $\bForm=\bForm'=(x<2)$.  We can use this case since
% $x<2$ implies $1<2\land x<2$.

Prefixing with $(\DW{x}{0})$ allows us to discharge the assumption $x<2$,
arriving at:
\begin{tikzdisplay}[node distance=1em,baselinecenter]
    \event{ix}{\DW{x}{0}}{}
    \event{rx1}{\DR{x}{1}}{right=of ix}
    \event{wy1}{\DW{y}{1}}{right=of rx1}
    %\po{ix}{rx1}
  \end{tikzdisplay}
% Here we have used the \textsc{[ordering read]}
% clause of \ref{def:prefix}:
% ``$\bForm'$ implies $\bForm[\aVal/\aLoc]$, if $\aAct$ reads $\aVal$ from $\aLoc$ and $\cEv\lt'\aEv$,''
% where $a=(\DW{x}{0})$,  $\bForm=(x<2)$ and $\bForm'=\TRUE$.  As long as
% require
% \begin{math}
%   (\DW{x}{0})\lt
%   (\DR{x}{1}),
% \end{math}
% we can use this case since $\TRUE$ implies $0<2$.

Test case 1 is similar.

This reasoning does not apply if the thread reads a value of $2$ or greater.
Consider
\begin{math}
  (\DR{x}{2}) \prefix (x<2\mid\DW{y}{1}).
\end{math}
Definition~\ref{def:prefix}(\ref{pre-read}a) requires that the predicate
of the write action must imply $(x<2)[2/x]$, which is equivalent to $\FALSE$.

\begin{comment}
Consider the program variant:

x=0; r=x; if(r<2){y=1} || x=5

[[ y=1 ]] contains (Wy1)

[[ if(r<2){y=1} ]] contains (r<2|Wy1)

[[ r=x; if(r<2){y=1} ]] contains (Rx5)  (x<2|Wy1)  //with no order

[[ x=0; r=x; if(r<2){y=1} ]] contains (Wx0)  (Rx5)  (x<2|Wy1) //does not work, since violates (6a) 𝜆Φ′(𝑒) implies 𝜆Φ(𝑒)[𝑣/𝑥].

Another example:
So consider the single threaded program

x=4; x=5; r=x; if(r==4){y=1}

Clearly, this should not be able to give us Wy1.
Here is why that is not possible:

[[ y=1 ]] contains (Wy1)

[[ if(r==4){y=1} ]] contains (r==4|Wy1)

[[ r=x; if(r==4){y=1} ]] contains (Rx5)  (x==4|Wy1) // with no order

[[ x=5; r=x; if(r==4){y=1} ]] contains (Wx5)-->(Rx5)  (5==4|Wy1) // 5 is forced.
\end{comment}

\subsection{Causality test case 9}

Test case 9 asks whether:
\begin{displaymath}
   \PW{x}{0}\SEMI
   \PW{y}{0}\SEMI
  (\IF{x<2}\THEN \PW{y}{1}\FI
  \PAR
  \PW{x}{y}
  \PAR
  \PW{y}{2}\SEMI)
\end{displaymath}
may read $1$ for both $x$ and $y$.  This behavior is also allowed.  This is
``similar to test case $8$, except that $x$ is not always $0$ or
$1$. However, a compiler might determine that the read of $x$ by thread $1$
will never see the write by thread $3$ (perhaps because thread $3$ will be
scheduled after thread $1$)''

Reasoning as for test case 8, the semantics of test case 9 includes:
\begin{tikzdisplay}[node distance=1em]
  \event{ix}{\DW{x}{0}}{}
  \event{iy}{\DW{y}{0}}{right=of ix}
  \event{rx1}{\DR{x}{1}}{right=2.2 em of iy}
  \event{wy1}{\DW{y}{1}}{right=of rx1}
  \event{ry1}{\DR{y}{1}}{right=2.2em of wy1}
  \event{wx1}{\DW{x}{1}}{right=of ry1}
  \event{wx2}{\DW{x}{2}}{below=3ex of $(ix)!0.5!(iy)$}%{right=2.5em of wx1}
  \po{ry1}{wx1}
  \po[out=30,in=150]{ix}{rx1}
  \rf[in=-25,out=-160]{wx1}{rx1}
  \rf[out=20,in=160]{wy1}{ry1}
  \wk[out=-25,in=-150]{ix}{wx1}
  \wk[out=25,in=155]{iy}{wy1}
  \wk{ix}{wx2}
  % \wk[out=-25,in=-150]{ix}{wx2}
\end{tikzdisplay}

Thus, with respect to the introduction of new threads, our model appears to
be more robust than the event structures semantics of
\cite{DBLP:conf/lics/JeffreyR16}, which fails on this test case.

\subsection{Causality test case 14}

Test case 14 asks whether:
\begin{displaymath}
   a\GETS 0\SEMI
   b\GETS 0\SEMI
   \PW{y}{0}\SEMI
  (\IF{a}\THEN b\GETS 1\ELSE \PW{y}{1}\FI
  \PAR
  \WHILE(y+b==0) \THEN\SKIP\FI\; a\GETS1)
\end{displaymath}
may read $1$ for $a$ and $b$, yet $0$ for $y$.  Here $a$ and $b$ are regular
variables and $y$ is volatile, which is equivalent to release/acquire in this
example.  This behavior is also disallowed, since ``in all sequentially
consistent executions, [the read of $a$ gets $0$] and the program is
correctly synchronized. Since the program is correctly synchronized in all SC
executions, no non-SC behaviors are allowed.''

Unrolling the loop once, we have:
\begin{displaymath}
   a\GETS 0\SEMI
   b\GETS 0\SEMI
   \PW{y}{0}\SEMI
  (\IF{a}\THEN b\GETS 1\ELSE \PW{y}{1}\FI
  \PAR
  \IF{y\lor b}\THEN a\GETS 1\FI)
\end{displaymath}
We argue that any execution with $(\DR{a}{1})$, $(\DR{b}{1})$, and
$(\DR{y}{0})$ must be cyclic.  The closure requirements require that
\begin{math}
  (\DW{a}{1})\lt(\DR{a}{1})
  \;\text{and}\;
  (\DR{b}{1})\lt(\DR{b}{1}).
\end{math}
Ignoring initialization, least ordered execution that includes all of these
actions is:
\begin{tikzdisplay}[node distance=1em]
  \event{ra1}{\DR{a}{1}}{}
  \event{wb1}{\DW{b}{1}}{below=of ra1}
 % \nonevent{wy1}{\DW{y}{1}}{left=of wb1}
  \event{rb1}{\DR{b}{1}}{right=4.5em of ra1}
  \event{ry0}{\DR{y}{0}}{right=of rb1}
  \event{wa1}{\DW{a}{1}}{below=of rb1}
  \po{ra1}{wb1}
  \po{rb1}{wa1}
  \rf{wa1}{ra1}
  \rf{wb1}{rb1}
\end{tikzdisplay}
where the read of $a$ is ordering for $(\DW{b}{1})$ but
not $(\DW{y}{1})$, and the read of $b$ is ordering for $(\DW{a}{1})$ but the
read of $y$ is not.  $(\DW{y}{1})$ is crossed out, since its
precondition must imply $(\lnot a)[1/a]$, which is equivalent to $\FALSE$.
To avoid order from $(\DR{y}{0})$ to $(\DW{a}{1})$, we
have strengthened the predicate on $(\DW{a}{1})$ from $(y\lor b)$ to
$(y=0\land b=1)$.  Note that we cannot use this trick symmetrically to remove
the order from $(\DR{b}{1})$ to $(\DW{a}{1})$, since $b=1$ does not follow
from the initialization of $b$.

% \subsection{Thread inlining}

% One property one could ask of a model of shared memory is thread
% inlining: any execution of $\sem{P\SEMI Q}$ is an execution of $\sem{P
%   \PAR Q}$. This is \emph{not} a goal of our model, and indeed is not
% satisfied, due to the different semantics of concurrent and sequential
% memory accesses. We demonstrate this by considering an example from
% the Java Memory Model~\cite{Manson:2005:JMM:1047659.1040336}, which shows that Java does not
% satisfy thread inlining either.

% The lack of thread inlining is related to the different dependency
% relations introduced by sequential and concurrent access.
% The program
% \begin{math}
%   (\PW{x}{0}\SEMI \PW{y}{x}+1)
% \end{math}
% %\verb`(x := 0; y := x+1;)`
% has execution:
% \begin{tikzdisplay}[node distance=1em]
%   \event{wx0}{\DW{x}{0}}{}
%   \event{wy1}{\DW{y}{1}}{right=of wx0}
% \end{tikzdisplay}
% but
% \begin{math}
%   (\PW{x}{1}\PAR \PW{y}{x}+1)
% \end{math}
% %\verb`(x := 1; || y := x+1;)`
% has:
% \begin{tikzdisplay}[node distance=1em]
%   \event{wx1}{\DW{x}{1}}{}
%   \event{rx1}{\DR{x}{1}}{right=2.5em of wx1}
%   \event{wy2}{\DW{y}{2}}{right=of rx1}
%   \rf{wx1}{rx1}
%   \po{rx1}{wy2}
% \end{tikzdisplay}
% That is, in the sequential case there is no dependency from the
% write of $x$ to the write of $y$, but in the concurrent case there
% is such a dependency.

% This can be used to construct a counter-example to thread inlining, based on~\cite[Ex~11]{Manson:2005:JMM:1047659.1040336}:
% \begin{displaymath}
%   (\PW{x}{0}\SEMI \IF{x} \THEN \PW{z}{1} \ELSE  \PW{x}{1} \FI) \PAR (\PW{y}{x}) \PAR (\PW{x}{y})
% \end{displaymath}
% % \begin{verbatim}
% %   x := 0; if (x == 1) { z := 1; } else { x := 1; } || y := x; || x := y;
% % \end{verbatim}
% This has no execution containing $(\DW z1)$. Any attempt to build such an execution
% results in a cycle:
% \begin{tikzdisplay}[node distance=1em]
%   \event{rx1a}{\DR{x}{1}}{}
%   \event{wz1}{\DW{z}{1}}{right=of rx1a}
%  % \nonevent{wx1a}{\DW{x}{1}}{right=of wz1}
%   \event{rx1b}{\DR{x}{1}}{below=of wz1}%{right=2.5em of wx1a}
%   \event{wy1}{\DW{y}{1}}{right=of rx1b}
%   \event{ry1}{\DR{y}{1}}{right=2.5em of wy1}
%   \event{wx1b}{\DW{x}{1}}{right=of ry1}
%   \po{rx1a}{wz1}
%  % \po[out=25, in=150]{rx1a}{wx1a}
%   \po{rx1b}{wy1}
%   \po{ry1}{wx1b}
%   \rf{wy1}{ry1}
%   \rf[out=160, in=30]{wx1b}{rx1a}
%   \rf[out=160, in=30]{wx1b}{rx1b}
% \end{tikzdisplay}
% Inlining the thread \verb|(y := x)| gives~\cite[Ex~12]{Manson:2005:JMM:1047659.1040336}:
% \begin{displaymath}
%   (\PW{x}{0}\SEMI \IF{x} \THEN \PW{z}{1} \ELSE  \PW{x}{1} \FI \SEMI \PW{y}{x}) \PAR (\PW{x}{y})
% \end{displaymath}
% % \begin{verbatim}
% %   x := 0; if (x == 1) { z := 1; } else { x := 1; } y := x; || x := y;
% % \end{verbatim}
% with execution:
% \begin{tikzdisplay}[node distance=1em]
%   \event{rx1a}{\DR{x}{1}}{}
%   \event{wz1}{\DW{z}{1}}{right=of rx1a}
%  % \nonevent{wx1a}{\DW{x}{1}}{right=of wz1}
%   \event{wy1}{\DW{y}{1}}{right=of rx1a}
%   \event{ry1}{\DR{y}{1}}{right=2.5em of wy1}
%   \event{wx1b}{\DW{x}{1}}{right=of ry1}
%   \po{rx1a}{wz1}
%  % \po[out=25, in=150]{rx1a}{wx1a}
%   \po{ry1}{wx1b}
%   \rf{wy1}{ry1}
%   \rf[out=160, in=30]{wx1b}{rx1a}
% \end{tikzdisplay}
% To see why this execution exists, consider the program fragment:
% \begin{displaymath}
%   \IF{x} \THEN \PW{z}{1} \ELSE  \PW{x}{1} \FI \SEMI \PW{y}{x}
% \end{displaymath}
% % \begin{verbatim}
% %   if (x == 1) { z := 1; } else { x := 1; } y := x;
% % \end{verbatim}
% % Removing the syntax sugar, this is:
% % \begin{verbatim}
% %   r1 := x; if (r1 == 1) {
% %     z := 1; r2 := x; y := r2; skip
% %   } else {
% %     x := 1; r3 := x; y := r3; skip
% %   }
% % \end{verbatim}
% Desugaring, we have:
% \begin{displaymath}
%   r_1 \GETS x\SEMI \IF{r_1} \THEN
%     \PW{z}{1}\SEMI r_2 \GETS x\SEMI y \GETS r_2
%   \ELSE
%     x \GETS 1\SEMI r_3 \GETS x\SEMI y \GETS r_3
%   \FI
% \end{displaymath}
% Now, $\sem{z := 1\SEMI r_2 := x\SEMI y := r_2}$
% includes pomset:
% \begin{tikzdisplay}[node distance=1em]
%   \event{wz1}{r_1=1 \mid \DW{z}{1}}{}
%   \event{wy1}{r_1=x=1 \mid \DW{y}{1}}{right=of wz1}
% \end{tikzdisplay}
% and $\sem{x := 1\SEMI r_3 := x\SEMI y := r_3}$
% includes pomset:
% \begin{tikzdisplay}[node distance=1em]
%   \event{wx1a}{r_1\neq 1 \mid \DW{x}{1}}{}
%   \event{wy1}{r_1\neq 1 \mid \DW{y}{1}}{right=of wx1a}
% \end{tikzdisplay}
% so  $\sem{\IF{r_1 = 1} \THEN z := 1\SEMI r_2 := x\SEMI y := r_2 \ELSE x := 1\SEMI r_3 := x\SEMI y := r_3 \FI}$ includes:
% \begin{tikzdisplay}[node distance=1em]
%   \event{wz1}{r_1=1 \mid \DW{z}{1}}{}
%   \event{wx1a}{r_1\neq1 \mid \DW{x}{1}}{right=of wz1}
%   \event{wy1}{(r_1=x=1) \lor (r_1\neq1) \mid \DW{y}{1}}{below=3ex of $(wz1)!0.5!(wx1a)$}
% \end{tikzdisplay}
% which means $\sem{\IF{r_1 = 1} \THEN z := 1\SEMI r_2 := x\SEMI y := r_2 \ELSE x := 1\SEMI r_3 := x\SEMI y := r_3 \FI}[x/r_1]$ includes:
% \begin{tikzdisplay}[node distance=1em]
%   \event{wz1}{x=1 \mid \DW{z}{1}}{}
%   \event{wx1a}{x\neq1 \mid \DW{x}{1}}{right=of wz1}
%   \event{wy1}{(x=x=1) \lor (x\neq1)) \mid \DW{y}{1}}{below=3ex of $(wz1)!0.5!(wx1a)$}%{right=of wx1a}
% \end{tikzdisplay}
% Now $(x=x=1) \lor (x\neq1)$ is a tautology, so this is just:
% \begin{tikzdisplay}[node distance=1em]
%   \event{wz1}{x=1 \mid \DW{z}{1}}{}
%   \event{wx1a}{x\neq1 \mid \DW{x}{1}}{right=of wz1}
%   \event{wy1}{\DW{y}{1}}{right=of wx1a}
% \end{tikzdisplay}
% and so $\sem{r_1 \GETS x\SEMI \IF{r_1 = 1} \THEN z := 1\SEMI r_2 := x\SEMI y := r_2 \ELSE x := 1\SEMI r_3 := x\SEMI y := r_3 \FI}$ includes:
% \begin{tikzdisplay}[node distance=1em]
%   \event{rx1a}{\DR{x}{1}}{}
%   \event{wz1}{1=1 \mid \DW{z}{1}}{right=of rx1a}
%   \event{wx1a}{1\neq1 \mid \DW{x}{1}}{right=of wz1}
%   \event{wy1}{\DW{y}{1}}{right=of wx1a}
%   \po{rx1a}{wz1}
%   \po[out=25, in=150]{rx1a}{wx1a}
% \end{tikzdisplay}
% which simplifies to:
% \begin{tikzdisplay}[node distance=1em]
%   \event{rx1a}{\DR{x}{1}}{}
%   \event{wz1}{\DW{z}{1}}{right=of rx1a}
%  % \nonevent{wx1a}{\DW{x}{1}}{right=of wz1}
%   \event{wy1}{\DW{y}{1}}{right=of wz1}
%   \po{rx1a}{wz1}
%  % \po[out=25, in=150]{rx1a}{wx1a}
% \end{tikzdisplay}
% as required. The rest of the example is straightforward, and shows that our semantics
% agrees with the JMM in not supporting thread inlining.

% \subsection{RFUB}
% \url{http://www.open-std.org/jtc1/sc22/wg21/docs/papers/2018/p1217r0.html}
% \begin{verbatim}
% RFUB Example 1
% Thread 1:
% r1 = x.load(memory_order_relaxed);
% y.store(r1, memory_order_relaxed);

% Thread 2:
% bool assigned_42(false);
% r1 = y.load(memory_order_relaxed);
% if (r1 != 42) {
%     assigned_42 = true;
%     r1 = 42;
% }
% x.store(r1, memory_order_relaxed);
% assert_not(assigned_42);
% \end{verbatim}

% Then
% \begin{math}
%   y\GETS x
%   \PAR
%   r\GETS y\SEMI
%   \IF{r \NOTEQ 1} \THEN z\GETS 1\SEMI r\GETS 1\SEMI x\GETS r \ELSE x\GETS r \FI
% \end{math}
% has execution
% \begin{equationsmall}
%   \label{rfub}
%   \begin{tikzcenter}[node distance=1em]
%     \event{a1}{\DR{x}{1}}{}
%     \event{a2}{\DW{y}{1}}{below=of a1}
%     \po{a1}{a2}
%   \end{tikzcenter}
%   \Biggm\|
%   \DR{y}{1}
%   \prefix
%   \left(
%     \begin{tikzcenter}[node distance=1em]
%       \event{b1}{r\NOTEQ1\mid\DW{z}{1}}{}
%       \event{b2}{r\NOTEQ1\mid\DW{x}{1}}{below=of b1}
%     \end{tikzcenter}
%     \biggm\|
%     \begin{tikzcenter}[node distance=1em]
%       \event{c1}{r\EQ1\mid\DW{x}{1}}{}
%     \end{tikzcenter}
%   \right)
% \end{equationsmall}
% With an internal read of $y$, we have
% \begin{displaymathsmall}
%   \begin{tikzcenter}[node distance=1em]
%     \event{a1}{\DR{x}{1}}{}
%     \event{a2}{\DW{y}{1}}{below=of a1}
%     \po{a1}{a2}
%   \end{tikzcenter}
%   \Biggm\|
%     \begin{tikzcenter}[node distance=1em]
%       \event{b1}{y\NOTEQ1\mid\DW{z}{1}}{}
%       \event{b2}{\DW{x}{1}}{below=of b1}
%     \end{tikzcenter}
% \end{displaymathsmall}
% but the precondition $y\NOTEQ1$ cannot be satisfied locally.
% With an external read of $(\DR{y}{1})$, we can discharge the precondition, but in this
% case, the predicate becomes $1\NOTEQ 1$.
% \begin{displaymathsmall}
%   \begin{tikzcenter}[node distance=1em]
%     \event{a1}{\DR{x}{1}}{}
%     \event{a2}{\DW{y}{1}}{below=of a1}
%     \po{a1}{a2}
%   \end{tikzcenter}
%   \Bigm\|
%     \begin{tikzcenter}[node distance=1em]
%       \nonevent{b1}{1\NOTEQ1\mid\DW{z}{1}}{}
%       \event{b2}{\DW{x}{1}}{below=of b1}
%       \event{b0}{\DR{y}{1}}{left=of b1}
%       \po{b0}{b1}
%     \end{tikzcenter}
% \end{displaymathsmall}

% \subsection{Blockers}
% \label{app:blockers}

% Unfortunately by itself, this is not enough. The problem is the final
% clause saying that there does not exist an $\aLoc$-\emph{blocking}
% event $\cEv$ between $\bEv$ and $\aEv$. Unfortunately, concurrency can
% turn events that were not $\aLoc$-blockers into an $\aLoc$-blocker,
% \emph{even if the new thread does not mention $\aLoc$.}
% We give an example to show this in \refapp{blockers}.
% This is a problem in that it means the preliminary model violates
% \emph{scope extrusion}~\cite{Milner:1999:CMS:329902},
% in that we can find programs $\aCmd$ and $\bCmd$ such that
% $\sem{\VAR\aLoc\SEMI(\aCmd\PAR\bCmd)}$ is not the same as
% $\sem{(\VAR\aLoc\SEMI\aCmd)\PAR\bCmd}$, even if $\bCmd$ does not mention~$\aLoc$.

% Recall the preliminary definition of reads-from in \S\ref{sec:pomsets}, which
% defined an $\aLoc$-blocker to be and event $\cEv$ that writes to $\aLoc$ such that
% $\bEv \lt \cEv \lt \aEv$.  Were we to adopt this definition, then concurrent
% threads could turn events that were not $\aLoc$-blockers into an
% $\aLoc$-blocker, even if the new thread does not mention $\aLoc$.

% To see this, consider the program
% \begin{math}
%   (
%   \aLoc\GETS1\SEMI
%   \bLoc\GETS\aLoc
%   \PAR
%   \aLoc\GETS\cLoc+1\SEMI
%   \bLoc\GETS\aLoc
%   \PAR
%   \IF{z=2}\THEN\aReg\GETS\aLoc\FI
%   )
% \end{math}
% with execution:
% \begin{tikzdisplay}[node distance=1em]
%   \event{wx1}{\DW{\aLoc}{1}}{}
%   \event{rz1}{\DR{\cLoc}{1}}{right=of wx1}
%   \event{wx2}{\DW{\aLoc}{2}}{right=of rz1}
%   \event{rz2}{\DR{\cLoc}{2}}{right=of wx2}
%   \event{rx1}{\DR{\aLoc}{1}}{right=of rz2}
%   \event{rx1a}{\DR{\aLoc}{1}}{below=of wx1}
%   \event{wy1}{\DW{\bLoc}{1}}{below=of rx1a}
%   \event{rx2a}{\DR{\aLoc}{2}}{below=of wx2}
%   \event{wy2}{\DW{\bLoc}{2}}{below=of rx2a}
%   \rf{wx1}{rx1a}
%   \po{rx1a}{wy1}
%   \rf{wx2}{rx2a}
%   \po{rx2a}{wy2}
%   \po{rz1}{wx2}
%   \po{rz2}{rx1}
%   \rf[out=20,in=160]{wx1}{rx1}
% \end{tikzdisplay}
% and the program
% \begin{math}
%   (
%   \cLoc\GETS\bLoc\SEMI
%   \cLoc\GETS\bLoc
%   )
% \end{math}
% with execution:
% \begin{tikzdisplay}[node distance=1em]
%   \event{ry1}{\DR{\bLoc}{1}}{}
%   \event{wz1}{\DW{\cLoc}{1}}{right=of ry1}
%   \event{ry2}{\DR{\bLoc}{2}}{right=of wz1}
%   \event{wz2}{\DW{\cLoc}{2}}{right=of ry2}
%   \po{ry1}{wz1}
%   \po{ry2}{wz2}
% \end{tikzdisplay}
% If these are placed in parallel, then a possible execution is:
% \begin{tikzdisplay}[node distance=1em]
%   \event{wx1}{\DW{\aLoc}{1}}{}
%   \event{rz1}{\DR{\cLoc}{1}}{right=of wx1}
%   \event{wx2}{\DW{\aLoc}{2}}{right=of rz1}
%   \event{rz2}{\DR{\cLoc}{2}}{right=of wx2}
%   \event{rx1}{\DR{\aLoc}{1}}{right=of rz2}
%   \event{rx1a}{\DR{\aLoc}{1}}{below=of wx1}
%   \event{wy1}{\DW{\bLoc}{1}}{below=of rx1a}
%   \event{rx2a}{\DR{\aLoc}{2}}{below=of wx2}
%   \event{wy2}{\DW{\bLoc}{2}}{below=of rx2a}
%   \rf{wx1}{rx1a}
%   \po{rx1a}{wy1}
%   \rf{wx2}{rx2a}
%   \po{rx2a}{wy2}
%   \po{rz1}{wx2}
%   \po{rz2}{rx1}
%   \event{ry1}{\DR{\bLoc}{1}}{below=of wy1}
%   \event{wz1}{\DW{\cLoc}{1}}{right=of ry1}
%   \event{ry2}{\DR{\bLoc}{2}}{below=of wy2}
%   \event{wz2}{\DW{\cLoc}{2}}{right=of ry2}
%   \po{ry1}{wz1}
%   \po{ry2}{wz2}
%   \rf{wy1}{ry1}
%   \rf{wz1}{rz1}
%   \rf{wy2}{ry2}
%   \rf{wz2}{rz2}
% \end{tikzdisplay}
% and now the $(\DW{\aLoc}{2})$ event is an $\aLoc$-blocker,
% so $(\DR{\aLoc}{1})$ cannot
% read from $(\DW{\aLoc}{1})$.

% In the final definition of reads-from in \S\ref{sec:pomsets} we
% ruled out $\aLoc$-blockers by requiring that any
% event $\cEv$ that writes to $\aLoc$ has
% either $\cEv \gtN \bEv$ or $\aEv \gtN \cEv$.
% With this definition, in order for $(\DR{\aLoc}{1})$ to read from
% $(\DW{\aLoc}{1})$, we either need $(\DW{\aLoc}{2}) \gtN (\DW{\aLoc}{1})$
% or $(\DR{\aLoc}{1}) \gtN (\DW{\aLoc}{2})$, for example:
% \begin{tikzdisplay}[node distance=1em]
%   \event{wx1}{\DW{\aLoc}{1}}{}
%   \event{rz1}{\DR{\cLoc}{1}}{right=of wx1}
%   \event{wx2}{\DW{\aLoc}{2}}{right=of rz1}
%   \event{rz2}{\DR{\cLoc}{2}}{right=of wx2}
%   \event{rx1}{\DR{\aLoc}{1}}{right=of rz2}
%   \event{rx1a}{\DR{\aLoc}{1}}{below=of wx1}
%   \event{wy1}{\DW{\bLoc}{1}}{below=of rx1a}
%   \event{rx2a}{\DR{\aLoc}{2}}{below=of wx2}
%   \event{wy2}{\DW{\bLoc}{2}}{below=of rx2a}
%   \rf{wx1}{rx1a}
%   \po{rx1a}{wy1}
%   \rf{wx2}{rx2a}
%   \po{rx2a}{wy2}
%   \po{rz1}{wx2}
%   \po{rz2}{rx1}
%   \rf[out=20,in=160]{wx1}{rx1}
%   \wk[out=-150,in=-30]{rx1}{wx2}
%   \wk{wy1}{wy2}
% \end{tikzdisplay}
% then putting this in parallel as before results in:
% \begin{tikzdisplay}[node distance=1em]
%   \event{wx1}{\DW{\aLoc}{1}}{}
%   \event{rz1}{\DR{\cLoc}{1}}{right=of wx1}
%   \event{wx2}{\DW{\aLoc}{2}}{right=of rz1}
%   \event{rz2}{\DR{\cLoc}{2}}{right=of wx2}
%   \event{rx1}{\DR{\aLoc}{1}}{right=of rz2}
%   \event{rx1a}{\DR{\aLoc}{1}}{below=of wx1}
%   \event{wy1}{\DW{\bLoc}{1}}{below=of rx1a}
%   \event{rx2a}{\DR{\aLoc}{2}}{below=of wx2}
%   \event{wy2}{\DW{\bLoc}{2}}{below=of rx2a}
%   \rf{wx1}{rx1a}
%   \po{rx1a}{wy1}
%   \rf{wx2}{rx2a}
%   \po{rx2a}{wy2}
%   \po{rz1}{wx2}
%   \po{rz2}{rx1}
%   \rf[out=20,in=160]{wx1}{rx1}
%   \wk[out=-150,in=-30]{rx1}{wx2}
%   \wk{wy1}{wy2}
%   \event{ry1}{\DR{\bLoc}{1}}{below=of wy1}
%   \event{wz1}{\DW{\cLoc}{1}}{right=of ry1}
%   \event{ry2}{\DR{\bLoc}{2}}{below=of wy2}
%   \event{wz2}{\DW{\cLoc}{2}}{right=of ry2}
%   \po{ry1}{wz1}
%   \po{ry2}{wz2}
%   \rf{wy1}{ry1}
%   \rf{wz1}{rz1}
%   \rf{wy2}{ry2}
%   \rf{wz2}{rz2}
%   \wk[out=30,in=150]{wz1}{wz2}
% \end{tikzdisplay}
% but this is \emph{not} a valid 3-valued pomset,
% since $(\DW{\aLoc}{2}) \lt (\DR{\aLoc}{1})$ but also $(\DR{\aLoc}{1}) \gtN (\DW{\aLoc}{2})$,
% which is a contradiction.

% \subsection{Word tearing}

% \todo{Remove this section, since it's not needed for transactions?}

% In \S\ref{sec:transactions}, we shall be considering transactional memory,
% and in \S\ref{sec:transactions} show that we can model a simplified version
% of an information flow attack on transactions. In order to model transactions,
% we need to consider actions that can write many memory locations at once,
% since this is part of the semantics of commitment. To lead up to this, we first
% consider a simpler scenario of many-location writes and reads, which is word
% tearing.

% In word tearing, a program contains a write instruction with data larger
% than the hardware word size, for example copying a byte array, or assigning
% a 64-bit float on a 32-bit architecture. For example, consider the program:
% \begin{verbatim}
%   (x := [0, 0];) || (x := [1, 1];) || (r := x;)
% \end{verbatim}
% This has executions in which the read of $x$ only reads from one of the writes,
% for example:
% \begin{tikzdisplay}[node distance=1em]
%   \event{wx00}{\DW{x}{[0,0]}}{}
%   \event{wx11}{\DW{x}{[1,1]}}{right=2.5em of wx00}
%   \event{rx00}{\DR{x}{[0,0]}}{right=2.5em of wx11}
%   \rf[out=20, in=160]{wx00}{rx00}
% \end{tikzdisplay}
% but also has executions in which the read of $x$ reads from both writes,
% for example:
% \begin{tikzdisplay}[node distance=1em]
%   \event{wx00}{\DW{x}{[0,0]}}{}
%   \event{wx11}{\DW{x}{[1,1]}}{right=2.5em of wx00}
%   \event{rx01}{\DR{x}{[0,1]}}{right=2.5em of wx11}
%   \rfx[out=20, in=160]{wx00}{x[0]}{rx01}
%   \rfx[out=-20, in=-160]{wx11}{x[1]}{rx01}
% \end{tikzdisplay}
% Word tearing can occur, for example, in Java extended floating point~\cite{jmm},
% LLVM 64-bit instructions on 32-bit hardware~\cite{llvm}, or in
% JavaScript SharedArrayBuffers~\cite{js-sab}.

% \newcommand{\rfControl}[4][]{\draw[rf,#1](#2) .. controls (#3) .. (#4);}
% \begin{tikzdisplay}[node distance=1em]
%   \event{wx0}{\DW{x}{0}}{}
%   \event{wx1}{\DW{x}{1}}{right=of wx0}
%   \event{wy0}{\DW{y}{0}}{right=2.5em of wx1}
%   \event{wy1}{\DW{y}{1}}{right=of wy0}
%   \event{rx1}{\DR{x}{1}}{right=2.5 em of wy1}
%   \event{ry0}{\DR{y}{0}}{right=of rx1}
%   \event{ry1}{\DR{y}{1}}{right=2.5 em of ry0}
%   \event{rx0}{\DR{x}{0}}{right=of ry1}
%   \rf[out=20,in=160]{wx1}{rx1}
%   \rf[out=20,in=160]{wy0}{ry0}
%   \rf[out=340,in=200]{wy1}{ry1}
%   \coordinate (a) [below=of wy1];
%   \rfControl[out=340,in=200]{wx0}{a}{rx0}
%   \wk{wx0}{wx1}
%   \wk{wy0}{wy1}
%   \po{rx1}{ry0}
%   \po{ry1}{rx0}
% \end{tikzdisplay}

% Batty section 4:
% \cite[\S4]{DBLP:conf/esop/BattyMNPS15},
% Example LB+ctrldata+ctrl-double (language must allow)
% r1=loadrlx(x) //reads 42
% if (r1 == 42)
%   storerlx(y,r1)

% r2=loadrlx(y) //reads 42
% if (r2 == 42)
%   storerlx (x,42)
% else
% storerlx (x,42)

% a:RRLX x=42 sb,dd,cd
% c:RRLX y=42 sb,cd
%   This is forbidden on hardware if compiled naively, as the architectures respect read-to-write control dependencies, but in practice compilers will collapse con- ditionals like that of the second thread, removing the control dependencies from the read of y to the writes of x and making the code identical to the previous example. As that example is allowed and observable on hardware (and we pre- sume that it would be impractical to outlaw such optimisation for C or C++), the language must also allow this execution. But this execution has a cycle in the union of reads-from and dependency, so we cannot simply exclude all those.
% Then one might hope for some other adaptation of the C/C++11 model, but the following example shows at least that there is no per-candidate-execution solution.
% Example LB+ctrldata+ctrl-single (language can and should forbid)
% r1=loadrlx(x) //reads 42 if (r1 == 42)
% storerlx (y,r1) r2=loadrlx (y) //reads 42 if (r2 == 42)
% a:RRLX x=42 sb,dd,cd
% rf
% b:WRLX y=42
% c:RRLX y=42 sb,cd
% rf
% d:WRLX x=42
% rf rf
% b:WRLX y=42 d:WRLX x=42
%   storerlx (x,42)

% \section{Examples}
% \label{sec:examples}

%\input{logic}

% \subsection{Release/acquire synchronization}
% \label{app:ra}

% % In relaxed memory models, synchronization actions act as memory fences: that
% % is, they are a barrier to reordering memory accesses.  In this section, we
% % present a simple model of release/acquire fencing. In
% % \S\ref{sec:transactions}, we show that this can be scaled up to a model of
% % transactional memory.

% % We assume there are sets $\Rel$ and $\Acq \subseteq\Act$.  We say that
% % $\aAct$ is a \emph{release action} if $\aAct\in\Rel$ and $\aAct$ is an
% % \emph{acquire action} if $\aAct\in\Acq$.
% % In a pomset, a release event is one labeled with a release action,
% % and an acquire event is one labeled by an acquire action.
% % To give the semantics of fences, we add extra constraints
% % to Definition~\ref{def:prefix} of prefixing %$\aAct\prefix\aPSS$
% % (recalling that $\cEv$ is the %$\aAct$-labeled
% % event being introduced):
% % \begin{itemize}
% % \item $\cEv \le \aEv$ whenever $\cEv$ is an acquire event or $\aEv$ is a release event, and
% % \item if $\cEv$ is an acquire event then $\aEv$ is independent of $\aLoc$,
% %   for every $\aLoc$.
% % \end{itemize}
% % The first constraint ensures that events are ordered before a release and
% % after an acquire.  The second constraint ensures that thread-local reads do
% % not cross acquire fences.

% % We can develop a simple model of release/acquire synchronization using the
% % following actions: % we will use
% % % releasing writes and acquiring reads:
% % \begin{itemize}
% % \item $(\DWRel{\aLoc}{\aVal})$, a release action that writes $\aVal$ to $\aLoc$, and
% % \item $(\DRAcq{\aLoc}{\aVal})$, an acquire action that reads $\aVal$ from $\aLoc$.
% % \end{itemize}
% % The semantics of programs with releasing write and acquiring read are similar
% % to regular write and read, with $\DWRel\aLoc\aVal$ replacing
% % $\DW\aLoc\aVal$ and $\DRAcq\aLoc\aVal$ replacing $\DR\aLoc\aVal$:
% % \begin{eqnarray*}
% %   \sem{^\mRA\aLoc\GETS\aExp\SEMI \aCmd} & = & \textstyle\bigcup_\aVal\; \bigl((\aExp=\aVal) \guard (\DWRel\aLoc\aVal) \prefix \sem{\aCmd}[\aExp/\aLoc]\bigr) \\
% %   \sem{^\mRA\aReg\GETS\aLoc\SEMI \aCmd} & = & \textstyle\bigcup_\aVal\; (\DRAcq\aLoc\aVal) \prefix \sem{\aCmd}[\aLoc/\aReg]
% % \end{eqnarray*}

% To see the need for the first constraint on prefixing, consider the program:
% \[
%   \VAR x\GETS0\SEMI \VAR f\GETS0\SEMI
%   (x\GETS 1\SEMI f^\mRA\GETS1 \PAR^\mRA r\GETS f; s\GETS x)
% \]
% This has an execution:
% \begin{tikzdisplay}[node distance=1em]
%   \event{wx0}{\DW{x}{0}}{}
%   \event{wf0}{\DW{f}{0}}{right=of wx0}
%   \event{wx1}{\DW{x}{1}}{below=of wx0}
%   \event{wf1}{\DWRel{f}{1}}{right=of wx1}
%   \event{rf1}{\DRAcq{f}{1}}{right=2.5em of wf1}
%   \event{rx1}{\DR{x}{1}}{right=of rf1}
%   \po{wx0}{wf1}
%   \po{wf0}{wf1}
%   \po{wx1}{wf1}
%   \po{rf1}{rx1}
%   \rf{wf1}{rf1}
%   \rf[out=20,in=160]{wx1}{rx1}
%   \wk{wx0}{wx1}
% \end{tikzdisplay}
% but \emph{not}:
% \begin{tikzdisplay}[node distance=1em]
%   \event{wx0}{\DW{x}{0}}{}
%   \event{wf0}{\DW{f}{0}}{right=of wx0}
%   \event{wx1}{\DW{x}{1}}{below=of wx0}
%   \event{wf1}{\DWRel{f}{1}}{right=of wx1}
%   \event{rf1}{\DRAcq{f}{1}}{right=2.5em of wf1}
%   \event{rx0}{\DR{x}{0}}{right=of rf1}
%   \po{wx0}{wf1}
%   \po{wf0}{wf1}
%   \po{wx1}{wf1}
%   \po{rf1}{rx1}
%   \rf{wf1}{rf1}
%   \rf[out=-20,in=160]{wx0}{rx0}
%   \wk{wx0}{wx1}
% \end{tikzdisplay}
% since $(\DW x0) \gtN (\DW x1) \lt (\DR x0)$, so this pomset does not satisfy the
% requirements to be $x$-closed.
% If we replace the release
% with a plain write, then the outcome $(\DRAcq f1)$ and $(\DR x0)$ is possible:
% \begin{tikzdisplay}[node distance=1em]
%   \event{wx0}{\DW{x}{0}}{}
%   \event{wf0}{\DW{f}{0}}{right=of wx0}
%   \event{wx1}{\DW{x}{1}}{below=of wx0}
%   \event{wf1}{\DW{f}{1}}{right=of wx1}
%   \event{rf1}{\DRAcq{f}{1}}{right=2.5em of wf1}
%   \event{rx0}{\DR{x}{0}}{right=of rf1}
%   \wk{wf0}{wf1}
%   \po{rf1}{rx0}
%   \rf{wf1}{rf1}
%   \rf[out=-20,in=160]{wx0}{rx0}
%   \wk{wx0}{wx1}
% \end{tikzdisplay}
% since no order is required between $(\DW x1)$ and $(\DW f1)$.
% Symmetrically, if we replace the acquire of the original program
% with a plain read, then the outcome $(\DR f1)$ and $(\DR x0)$ is possible.
% % \begin{verbatim}
% %   x := 0; rel f := 0; ||
% %   acq r := f; if (r == 0) { x := x+1; rel f := 1; } ||
% %   acq s := f; if (r == 1) { x := x+1; rel f := 2; }
% % \end{verbatim}
% % This has an execution:
% % \begin{tikzdisplay}[node distance=1em]
% %   \event{wx0}{\DW{x}{0}}{}
% %   \event{wf0}{\DWRel{f}{0}}{below=of wx0}
% %   \event{rf0}{\DRAcq{f}{0}}{right=2.5 em of wx0}
% %   \event{rx0}{\DR{x}{0}}{below=of rf0}
% %   \event{wx1}{\DW{x}{1}}{below=of rx0}
% %   \event{wf1}{\DWRel{f}{1}}{below=of wx1}
% %   \event{rf1}{\DRAcq{f}{1}}{right=2.5 em of rf0}
% %   \event{rx1}{\DR{x}{1}}{below=of rf1}
% %   \event{wx2}{\DW{x}{2}}{below=of rx1}
% %   \event{wf2}{\DWRel{f}{2}}{below=of wx2}
% %   \po{wx0}{wf0}
% %   \po{rf0}{rx0}
% %   \po{rx0}{wx1}
% %   \po{wx1}{wf1}
% %   \po{rf1}{rx1}
% %   \po{rx1}{wx2}
% %   \po{wx2}{wf2}
% %   \rf{wf0}{rf0}
% %   \rf{wx0}{rx0}
% %   \rf{wf1}{rf1}
% %   \rf{wx1}{rx1}
% % \end{tikzdisplay}
% % but \emph{not}:
% % \begin{tikzdisplay}[node distance=1em]
% %   \event{wx0}{\DW{x}{0}}{}
% %   \event{wf0}{\DWRel{f}{0}}{below=of wx0}
% %   \event{rf0}{\DRAcq{f}{0}}{right=2.5 em of wx0}
% %   \event{rx0}{\DR{x}{0}}{below=of rf0}
% %   \event{wx1}{\DW{x}{1}}{below=of rx0}
% %   \event{wf1}{\DWRel{f}{1}}{below=of wx1}
% %   \event{rf1}{\DRAcq{f}{1}}{right=2.5 em of rf0}
% %   \event{rx0b}{\DR{x}{0}}{below=of rf1}
% %   \event{wx1b}{\DW{x}{1}}{below=of rx0b}
% %   \event{wf2}{\DWRel{f}{2}}{below=of wx1b}
% %   \po{wx0}{wf0}
% %   \po{rf0}{rx0}
% %   \po{rx0}{wx1}
% %   \po{wx1}{wf1}
% %   \po{rf1}{rx0b}
% %   \po{rx0b}{wx1b}
% %   \po{wx1b}{wf2}
% %   \rf{wf0}{rf0}
% %   \rf{wx0}{rx0}
% %   \rf{wf1}{rf1}
% %   \rf{wx0}{rx0b}
% % \end{tikzdisplay}
% % since $(\DW x0) \lt (\DW x1) \lt (\DR x0)$, so this pomset does not satisfy the
% % requirements to be an rf-pomset.

% % The notion rf-pomset is sufficient to capture hardware models and
% % release/acquire access in C++, where reads-from implies happens-before
% % \cite{alglave}.  To model C++ relaxed access, it
% % would be necessary to use a more general notion of rf-pomset, where
% % $(\bEv,\aLoc,\aEv) \in \RF$ does not necessarily imply $\bEv \lt \aEv$, instead
% % requiring that $(\mathord\lt \cup \mathord\RF)$ be acyclic.

% %% To see the need for the second constraint on prefixing, consider the program:
% %% \begin{displaymath}
% %%   (
% %%   x\GETS1\SEMI
% %%^\mRA f\GETS 1\SEMI
% %%^\mRA r\GETS f\SEMI
% %%   y\GETS x
% %%   )
% %%   \PAR
% %%   (
% %%^\mRA s\GETS f\SEMI
% %%   x\GETS2\SEMI
% %%^\mRA f\GETS 2\SEMI
% %%   )
% %% \end{displaymath}
% %% whose semantics includes execution:
% %% \begin{displaymath}
% %% \begin{tikzpicture}[node distance=1em]
% %%   \event{wx1}{\DW{x}{1}}{}
% %%   \event{wf1}{\DWRel{f}{1}}{right=of wx1}
% %%   \event{rf1}{\DRAcq{f}{2}}{below=of wf1}
% %%   \event{wx2}{\DW{x}{2}}{right=of rf1}
% %%   \event{wf2}{\DWRel{f}{1}}{right=of wx2}
% %%   \event{rf2}{\DRAcq{f}{2}}{above=of wf2}
% %%   \event{wy1}{\DW{y}{1}}{right=of rf2}
% %%   \po{wx1}{wf1}
% %%   \rf{wf1}{rf1}
% %%   \po{rf1}{wx2}
% %%   \po{wx2}{wf2}
% %%   \rf{wf2}{rf2}
% %%   \po{rf2}{wy1}
% %% \end{tikzpicture}
% %% \end{displaymath}
% %% This execution exists because
% %% \begin{math}
% %%   \sem{y\GETS x}
% %% \end{math}
% %% includes
% %% \begin{math}
% %%   (x=1\mid \DW{y}{1})
% %% \end{math}
% %% and the precondition $x=1$ is fulfilled by the preceding write $x\GETS1$.  In
% %% implementation term, this execution is reading $1$ from $x$ in a ``stale
% %% cache.''  The alternative execution that attempts to read $1$ from the $x$ in
% %% ``main memory,'' has an explicit $(\DR{x}{1})$ between $(\DRAcq{f}{2})$ and
% %% $(\DW{y}{1})$, and thus will fail to be $x$-closed.

% %% To prevent thread-local writes from crossing release/acquire pairs, we
% %% require that pomsets in the semantics of acquire have no free locations.
% %% This corresponds to the idea that acquires flush the read cache, and
% %% therefore reads must reload values from main memory after an acquire.

% % In addition, we must change the semantics of write from
% % \S\ref{sec:sets-of-pomsets} to ensure that an action is generated for every
% % write that might be published by a subsequent release action.
% % Formally, $\sem{\aLoc\GETS\aExp\SEMI \aCmd}$ only includes pomsets
% % from $\sem{\aCmd}[\aExp/\aLoc]$ that contain a write to
% % $\aLoc$ that is not preceded by a release.

% \subsection{Relaxed memory}
% \label{sec:relaxed-memory}

% % In \S\ref{sec:info-flow-attack} we presented an information flow attack
% % on relaxed memory, similar to Spectre in that it relies on speculative
% % evaluation. Unlike Spectre it does not depend on timing attacks,
% % but instead is based on the sensitivity of relaxed memory to data
% % dependencies. % For this reason, we present a simple model of relaxed
% % % memory, which is strong enough to capture this attack.

% Our model includes concurrent memory accesses, which can introduce concurrent
% reads-from.
% Since we are allowing events to be partially ordered, this gives a simple
% model of relaxed memory.

% This model does not introduce thin-air reads (TAR).
% For example the TAR pit
% \((
%   x\GETS y \PAR y \GETS x
% )\)
% fails to produce a value for $x$ from thin air
% since this produces a cycle in $\le$, as shown on the left below:
% \begin{align*}
% \begin{tikzpicture}[node distance=1em]
%   \event{ry42}{\DR{y}{42}}{}
%   \event{wx42}{\DW{x}{42}}{below=of ry42}
%   \event{rx42}{\DR{x}{42}}{right=2.5em of ry42}
%   \event{wy42}{\DW{y}{42}}{below=of rx42}
%   \po{ry42}{wx42}
%   \po{rx42}{wy42}
%   \rf{wx42}{rx42}
%   \rf{wy42}{ry42}
% \end{tikzpicture}
% &&
% \begin{tikzpicture}[node distance=1em]
%   \event{ry1}{\DR{y}{1}}{}
%   \event{wx1}{\DW{x}{1}}{below=of ry1}
%   \event{rx1}{\DR{x}{1}}{right=2.5em of ry1}
%   \event{wy1}{\DW{y}{1}}{below=of rx1}
%   \po{ry1}{wx1}
%   \rf{wx1}{rx1}
%   \rf{wy1}{ry1}
% \end{tikzpicture}
% \end{align*}
% This cycle can be broken by removing a dependency. For example
% \((
%   x\GETS y \PAR r\GETS x\SEMI y \GETS r+1-r
% )\)
% has the execution on the right above.
% % \begin{tikzdisplay}[node distance=1em]
% %   \event{ry1}{\DR{y}{1}}{}
% %   \event{wx1}{\DW{x}{1}}{below=of ry1}
% %   \event{rx1}{\DR{x}{1}}{right=2.5em of ry1}
% %   \event{wy1}{\DW{y}{1}}{below=of rx1}
% %   \po{ry1}{wx1}
% %   \rf{wx1}{rx1}
% %   \rf{wy1}{ry1}
% % \end{tikzdisplay}
% Note that $(\DR x1) \not\le (\DW y1)$, so this does not introduce a cycle.

% Although it is not the primary focus of this paper, our model may be an
% attractive model of relaxed memory.  Many prior models either permit
% thin-air executions that our model forbids or forbid desirable executions
% that our model permits.
% %% In \S\ref{sec:logic}, we develop a logic which allows us to prove that our
% %% semantics forbids thin air examples that are permitted by prior speculative
% %% models
% %% \cite{Manson:2005:JMM:1047659.1040336,Jagadeesan:2010:GOS:2175486.2175503,DBLP:conf/popl/KangHLVD17}.
% % Our model passes all of the causality test cases
% % \cite{PughWebsite}.
% %% Significantly, this
% %% includes test case 9, which is forbidden by \cite{DBLP:conf/lics/JeffreyR16},
% %% one of the few models that disallows the thin air example from
% %% \S\ref{sec:logic}.  We present this test case in the appendix, where we also
% %% discuss the thread inlining examples from
% %% \cite{Manson:2005:JMM:1047659.1040336}.

% % In \refapp{logic}, we present a variant of the TAR-pit
% % example %from \S\ref{sec:relaxed-memory}
% % that is allowed under prior speculative semantics
% % \cite{Manson:2005:JMM:1047659.1040336,Jagadeesan:2010:GOS:2175486.2175503,DBLP:conf/popl/KangHLVD17}.
% % We develop a logic that allows us to prove that the problematic execution is
% % forbidden in our model.  \citet{DBLP:conf/esop/BattyMNPS15} showed that the
% % thin-air problem has no per-candidate-execution solution for C++.  This
% % result does not apply to our model, which has a different notion of
% % dependency.

% % as the semantics of a conditional can depend on the semantics
% % of both branches.

% \citet{PughWebsite} developed a set of twenty {causality test cases} in the
% process of revising the Java Memory Model (JMM)
% \cite{Manson:2005:JMM:1047659.1040336}.  Using hand calculation, we have
% confirmed that our model gives the desired result for all twenty cases,
% unrolling loops as necessary.  Our model also gives the desired results for
% all of the examples in \citet[\textsection 4]{DBLP:conf/esop/BattyMNPS15} and
% all but one in \citet[\textsection 5.3]{SevcikThesis}:
% redundant-write-after-read-elimination fails for any
% sensible non-coherent semantics.  Our model agrees with the JMM on the
% ``surprising and controversial behaviors'' of \citet[\textsection
% 8]{Manson:2005:JMM:1047659.1040336}, and thus fails to validate thread
% inlining.
% In \refapp{tc}, we discuss three of the causality test cases and the thread
% inlining example from \cite{Manson:2005:JMM:1047659.1040336}.%  In presenting the
% examples, we unroll loops, correct typos and simplify the code.

% \subsection{Causality test cases}
% \label{app:tc}

% \citet{PughWebsite} developed a set of twenty {causality test cases} in the
% process of revising the Java Memory Model (JMM)
% \cite{Manson:2005:JMM:1047659.1040336}.  Using hand calculation, we have
% confirmed that our model gives the desired result for all twenty cases,
% unrolling loops as necessary.  Our model also gives the desired results for
% all of the examples in \citet[\textsection 4]{DBLP:conf/esop/BattyMNPS15} and
% all but one in \citet[\textsection 5.3]{SevcikThesis}:
% redundant-write-after-read-elimination fails for any
% sensible non-coherent semantics.  Our model agrees with the JMM on the
% ``surprising and controversial behaviors'' of \citet[\textsection
% 8]{Manson:2005:JMM:1047659.1040336}, and thus fails to validate thread
% inlining.

% Local Variables:
% mode: latex
% TeX-master: "paper"
% End:


%!TEX root = /Users/stevenmartell/Documents/CURRENT PROJECTS/iSCAM-trunk/fba/BC-herring-2011/WRITEUP/BCHerring2011.tex
\section{Bayesian prior for the dive survey spawn index proportionality constant $q$}\label{Appendix::q_prior}

\subsection{The process}

A Bayesian prior for the herring dive survey spawn index proportionality constant (q) is developed using a process that combines expert knowledge (in some cases best guesses) and data associated with factors influencing the prior.  The process, used to develop acoustic and trawl survey priors for New Zealand fisheries stock assessments \citep[e.g.,][]{CordueInPrep}, is comprised of the following steps:

\begin{enumerate}
\item	List all factors affecting $q$.
\item	For each factor, determine the statistical distribution that best describes the uncertainty associated with that factor.  Where available, the distribution is based on data (not data that will be used in the assessment); otherwise it is based on expert knowledge.
\item	The prior distribution for $q$ is estimated by integrating across the distributions for each factor.  This can be approximated by generating joint random samples from the distributions.
\item	Finally, a parametric model is fit to the resulting distribution of replicate random samples to approximate the $q$ prior.
\end{enumerate}

\subsection{Factors affecting $q$ and their distributions}
The factors that contribute to the spawn index $q$ prior include: the proportion of the total spawn that is surveyed; the amount of egg loss that occurs prior to the spawn survey; bias in the estimate of mean egg density; and drift in spawn survey observations over time. The distributions for each of these factors should reflect uncertainty in their average affect over years, not capture inter-annual variation in them.

\subsubsection{Proportion of total spawn surveyed}
The proportion of the total spawn that is surveyed has a natural upper bound of 1, though its central tendency is not known. Reasons for not surveying herring spawns include non-detection (early or late in season or very deep and not observed) or lack of resources to conduct the survey.  For the latter case the spawns will be reported, and this occurrence is rare. The proportion of the total spawn that is not-detected is likely higher in more remote locations and when spawning abundance is low. With limited information, we assume a uniform distribution on 0.9 Ð 1.0 for the average proportion of total spawn surveyed.

\subsubsection{Egg loss prior to survey}

This factor accounts for egg loss due to predation (seabirds, invertebrates, marine mammals) and translocation between the time of egg deposition and the spawn surveys.  The amount of egg loss prior to spawn surveys is determined by the daily egg loss rate and the number of days between a spawn and the subsequent survey.

The herring egg loss literature, recently summarized by \cite[][their Appendix 7]{HayEggLoss}, is used to estimate a distribution for daily egg loss rates. All studies conducted on the west coast of North America that estimated total egg loss over the incubation period (or daily egg loss rates) were considered for inclusion in the egg loss rate distribution. Those criteria substantially reduce the available literature (Table \ref{AppendixC:Table3}). Egg loss estimates from the selected studies were standardized to instantaneous (daily) rates (Table \ref{AppendixC:Table4}). A normal distribution for the daily egg loss rate, based on the mean and standard deviation of the selected estimates, is assumed.

The second component of the egg loss distribution is the average number of days between the spawn event and the surveys.  Information to inform the distribution of this factor was available in the B.C. herring spawn survey database.  Only ÒdiveÓ survey records were selected, and numerous error checks imposed to remove erroneous data (Table \ref{AppendixC:Table4}).  For each spawn record, the number of days between the spawn event and subsequent survey was estimated as the difference between the mid-spawn date and the mid-survey date. The mean time between a spawn deposition event and the subsequent survey ranges from 6.4 to 9.2 days across the stock assessment regions (Table \ref{AppendixC:Table6}).  A normal distribution for the average time between egg deposition and surveys is assumed, based on the mean and standard deviation of the mean values for the stock assessment regions (mean=7.7; standard deviation =1.13).

\subsubsection{Bias in mean egg density}

The equation predicting egg density from dive survey observations was calculated from field studies conducted through much of the B.C. coast in the mid 1980s.  These studies included diver observations of egg layers and percent cover by vegetation classes and subsequent laboratory egg counts of the observed quadrats.  While the egg density prediction equation is unbiased, the unexplained residual error is large and the error in the mean egg densities predicted at the stock assessment region/year level were often greater than expected based on the assumption of unbiased iid observations. To allow for potential bias in predicted mean egg density at the stock assessment region level, we assume a normal distribution for this factor with mean 1 and standard deviation 0.2.

\subsubsection{Drift in dive survey observations}

The studies to calibrate field observations of herring spawns to egg density estimates were primarily conducted during the mid 1980s by research divers.  Since then, Fisheries Officers and subsequently research divers have conducted the coast wide herring spawn surveys. While there is considerable effort to ensure standardization of the surveys, it is possible that there has been drift in how observations are made.  There is no direct information on how survey observations may have changed over time, however Hay (in press) suggests that if drift has occurred itÕs direction is to observations that result in lower density estimates (i.e. there has been an increase in ÒtraceÓ observations.)  For now, we do not include this factor in calculating a prior distribution for the spawn survey $q$.

Table \ref{AppendixC:Table1} summarizes the factors affecting the q prior and their assumed distributions.

\begin{table}[htdp]
\caption{Factors affecting the $q$ prior and their assumed distributions.}
\begin{center}
\begin{tabular}{llc}
\hline
Factor affecting the $q$ prior &	Distribution & Parameters of distribution\\
\hline
Proportion of total spawn surveyed ($p_i$)&Uniform &0.9Ð-1.0\\
%%
\multicolumn{3}{l}{Egg loss prior to survey:}\\
\multicolumn{1}{r}{Instantaneous daily egg loss rate ($Z_i$)}& Normal &Mean 0.0642  Std. dev 0.0187\\
\multicolumn{1}{r}{Days between spawn deposition and survey ($d_i$)}&Normal & Mean 7.7  Std. dev. 1.13\\
%%
Bias in mean egg density ($b_i$)&	Normal	&Mean 1  Std. dev.  0.2\\
\hline
\end{tabular}
\end{center}
\label{AppendixC:Table1}
\end{table}%

%%Table 1 roughly here
%%Table 2 roughly here

\subsection{Simulating the dive survey spawn index $q$}

Monte-Carlo simulations were conducted, randomly sampling from each factorsÕ distribution.  The factors will operate independently so covariance structure does not need to be considered. For each of 10,000 replicates (i), a random draw was made for each factor to generate a point in the joint distribution for the $q$ prior ($\tilde{q}_i$):
\[
\tilde{q}_i = p_i b_i \exp(-d_i Z_i)
\]

For the \iscam\ herring stock assessments, a lognormal prior for the spawn index $q$ is assumed (i.e., $\ln(q)$ is assumed normally distributed). The distribution of the simulated $\tilde{q}_i$  is reasonably approximated by a lognormal distribution (Figure \ref{AppendixC:fig1}). Means and standard deviations for the simulated  and the natural log of the $\tilde{q}_i$  are presented in Table \ref{AppendixC:Table2}

\begin{table}
\caption{Estimated means and standard deviations for the simulated q prior and natural log of the q prior.}\label{AppendixC:Table2}
\begin{center}
\begin{tabular}{lll}
\hline
 & $\tilde{q}_i$ & $\ln(\tilde{q}_i)$\\
 \hline
 Mean &0.587 & -0.569\\
 Std &0.155 & 0.274 \\
 \hline
\end{tabular}
\end{center}
\end{table}

\begin{figure}[!tbp]
	% Requires \usepackage{graphicx}
	\centering
	\includegraphics[width=\textwidth]{../FIGS/qprior.pdf}\\
	\caption{Distribution of the log of the simulated spawn index q estimates, overlaid with a normal distribution based on the mean and standard deviation of the simulated values.}\label{AppendixC:fig1}
\end{figure}

\begin{table}[htdp]
\caption{Summary of west coast North America herring egg loss literature.}
\begin{center}
\begin{tabular}{|p{0.65\textwidth}|p{0.35\textwidth}|}
\hline
\textbf{Study and summary of pertinent egg loss estimates:}&
\textbf{Rationale for inclusion/exclusion from prior estimation:}\\
\hline
\cite{bishop2001predation} &\\ Estimated 31\% of herring egg deposition was consumed by 5 species of birds (1994, Prince William Sound), based on a bioenergetics model. & Not included because study estimated only bird predation effect.\\
\hline
\cite{haegele1991egg} &\\
Estimated 58\% herring egg loss over 14 day incubation period (Lambert Channel 1989).  Bird and invertebrate predation accounted for 7.1\% egg loss; the remainder from physical removal and translocation could not be directly estimated.
&
Included because comprehensive B.C. study. \\
\hline
\cite{Haegele1989egg} & \\
Estimated 19.5\% egg loss from predation based on predator counts and consumption rates (birds and invertebrates).  From egg counts, total egg loss estimated at 68.8\% over a 14 day incubation period (their Table 3 egg loss equations).  Modelled changes in observations of egg layers over the incubation period:  egg layers on sea grasses= 2.17 Ð 0.07 (day); egg layers on filamentous algae= 3.47 Ð 0.13 (day).  Equations result in 45\% and 52\% decrease in egg layers over 14 days incubation period, respectively.
&
Included because comprehensive B.C. study. \\
\hline
\cite{outram1958magnitude}  & \\
Seabird predator exclusion study, West coast Vancouver Island (1951 Ð 1953).  Overall, estimated 39\% egg loss due to seabirds over the incubation period. Total egg loss over incubation period ranged from 56\% to 99\% (based on change in egg biomass for the control plots). Study was restricted to eelgrass beds.
&
Not included because study restricted to eel grass beds\\
\hline
\cite{palsson1984egg}  & \\
Estimated daily egg loss rates from 16.9\% to 51.8\% (positively correlated with egg density just after spawning).  Large predators account for 20\% to 50\% of daily egg loss.  Initial egg densities were very low, ranging from 400 to 80,000 eggs/m2 across 9 study sites.  PaulsonÕs thesis cites additional egg loss literature that is not included here because the studies generally focussed on a limited range of habitat types.
&
Not included because study egg densities were much lower than densities generally seen in B.C. spawns.\\
\hline
\cite{rooper1999habitat}& \\
Surveys conducted 1991, 1992, 1994 and 1995.  Depth is factor that best accounts for egg loss rates (higher egg loss in shallower waters).  Mean daily egg loss rates (Z) were (their Table 2):
\begin{itemize}
\item 1990 Ð 0.076
\item 1991 Ð 0.042
\item 1994 Ð 0.096
\item 1995 Ð 0.096
\end{itemize}
Note that population was much lower in 1994 and 1995.
&
Comprehensive study in Prince William Sound.  Estimates for 1990 and 1991 only are included because population had crashed by 1994 and abundance was low.
\\
\hline
\end{tabular}
\end{center}
\label{AppendixC:Table3}
\end{table}

\begin{table}[htdp]
\caption{Estimates of the instantaneous daily egg loss rate (Z) from herring egg loss studies conducted in the Pacific Northwest. The Z estimates for the Haegele and Schweigert (1989, 1991) studies were calculated from their reported egg loss rates over the study period.}
\begin{center}
\begin{tabular}{llll}
\hline
Publication	&Study Location&	Year	&Z\\
\hline
Haegele \& Schweigert (1991) &	SoG &	1989	&0.056\\
Haegele \& Schweigert (1989)&WCVI&	1988&	0.083\\
Rooper et al. (1999)&	PWS	&1991	&0.076\\
Rooper et al. (1999)&	PWS	&1992	&0.042\\
\hline
& & Mean & 0.0642\\
& & Std & 0.0187\\
\hline
\end{tabular}
\end{center}
\label{AppendixC:Table4}
\end{table}%

\begin{table}[htdp]
\caption{Criteria for selecting herring spawn survey data records for estimating days between spawning and surveys. The "number of records" is the records retained after each successive selection criterion. }
\begin{center}
\begin{tabular}{lc}
\hline
Selection criterion	 &Number of Records\\
\hline
Total dive survey records (1985-2010)	&3457\\ \hline
Spawn and survey start/end dates completed &	3188\\ \hline
End spawn date $\leq$ start spawn date &\\
End spawn date Ð start spawn date $<$ 20 &\\
Survey days $\leq$ 14	3130 &  3130\\ \hline
End spawn date-end survey date$\leq$ 2 &\\
End survey date- end spawn date $<$ 20&	3074\\
\hline
\end{tabular}
\end{center}
\label{AppendixC:Table5}
\end{table}%

\begin{table}[htdp]
\caption{Average number of days between spawn deposition and spawn survey by stock assessment region and year.}
\begin{center}
\begin{tabular}{llllllll}
\hline
Year&A2W&HG&PRD&CC&SoG&WCVI&A27\\
\hline
1985&& & & &5.2&6.6&8.8\\
1986& & &6.0&5.5&5.8&9.2&2.2\\
1987& & & & &10.6& & \\
1988& &7.4&11.2&8.3&11.0&8.2& \\
1989& &8.2&10.8&5.8&14.5&8.6&10.7\\
1990&8.9&12.2&8.3&7.9&12.8&7.6&7.8\\
1991&10.5&5.9&7.5&11.0&12.4&9.2&2.3\\
1992&3.6&0.1&6.6&10.0&8.1&9.4&5.7\\
1993&12.2&9.3&4.9&9.1&13.1&7.6&16.8\\
1994&4.8&12.2&10.8&8.7&12.8&6.2& \\
1995& &10.3&6.1&7.9&9.3&6.4&11.1\\
1996& &7.9&5.7& &10.2&4.5&7.9\\
1997& &8.6&10.3&6.1&9.4&7.5&2.8\\
1998&10.5&13.3&5.5&12.4&10.4&6.4&4.2\\
1999& &10.0&8.1&6.4&8.0&4.9& \\
2000&6.5&10.8&10.8&7.4&8.8&6.1&6.9\\
2001&9.0&7.4&8.3&6.8&8.0&6.9&3.8\\
2002&6.5&9.0&5.7&5.6&9.9&5.5&2.3\\
2003& &7.5&6.2&5.0&9.5&7.0&7.3\\
2004&8.6&14.0&8.2&4.1&9.5&7.1&8.2\\
2005&6.3&9.4&8.8&9.2&5.8&5.1&3.3\\
2006& & &7.6&6.5&11.7&3.1&5.8\\
2007& &6.0&10.8&0.7&9.3&3.4& \\
2008& &7.4&7.2&4.3&9.5&3.8&2.0\\
2009&5.3&6.0&9.6&5.3&4.2&5.5&5.6\\
2010& & & & &7.1&5.2& \\
\hline
Mean&7.8&8.7&8.3&6.8&9.2&6.6&6.4\\
\hline
\end{tabular}
\end{center}
\label{AppendixC:Table6}
\end{table}%

\clearpage