Protection and synchronisation in a message-switched system

In any computer system it is valuable to have methods for enforcing expected behaviour at runtime. (Capabilities and object-oriented architectures are mechanisms commonly used to address the problem.) In a message-switched system, all inter-process communication is done by the transmission of messages, and the problem of enforcing expected behaviour can be reduced to the problem of enforcing expected patterns of message transmission.

In this paper we give a method, called the Task Graph Language, for expressing expected patterns (policy) of message transmission. Such an expression is quite independent of the actual programs which pass messages, and can be used at runtime to check the validity of observed behaviour. The mechanism we provide to perform the runtime checking of observed vs. expected behaviour is called Token Lists.

This mechanism requires no esoteric hardware support and it can be used in both distributed and centralized systems. From another perspective, the user is provided with two independent, hence mutually redundant, ways to express his intent (the programs which pass messages and the Task Graph Language description), and the two expressions of intent are compared or matched at runtime as a checking mechanism. From still another perspective, the Task Graph Language and Token Lists permit a centralized representation of distributed control.