Concurrency
Concurrency in AEL, the Agent Engineering Language, will be built on agents that own their state and exchange messages. On microcontrollers it will be safe, with bounded mailboxes, timers, cooperative scheduling, supervision and restarts. This page describes the model; the operations themselves will belong to the Standard library and core types.
Status
Planned for AEL Beta 0.0.1. AEL is not available yet.
One handler at a time
- An agent's private state will be used by at most one handler at a time. A handler will keep sole use of that state, even while it waits for a reply or a timer.
- While one handler waits, other handlers will run.
- Agents will share no changeable state. They will cooperate by sending each other messages.
- A start-up handler will prepare its agent and return. Work that repeats will be driven by a timer or by messages, never by a start-up handler that loops forever.
Mailboxes
Every agent will receive messages through a mailbox of fixed capacity.
- A mailbox will hand over its messages in the order it accepted them. Messages from different senders will have no other order than that.
- Sending will never wait. The result will say whether the message was accepted, or the mailbox was full or closed.
- A message that was not accepted will come back to the sender, which will be able to retry, send it elsewhere or drop it. It will never be lost and never owned twice.
- Accepted will mean queued: it will not mean the receiver has handled the message.
Requests and replies
A request will be a message that expects one reply.
- Before the request is sent, room for its reply will be reserved. If that fails, nothing will be sent and you will get your request back.
- Every request will have a finite deadline.
- A request will end exactly once: with its reply, an error, a timeout or a cancellation.
- A reply that arrives late, or twice, will be discarded safely and will not be able to complete the request a second time.
Cancellation
Cancelling work, directly or through a timeout, will:
- stop it from starting new child work;
- release the messages it had queued;
- cancel the child work already running.
Cancellation will not be able to undo an effect outside the program, such as a payment already sent to another service. Such an effect will be reported as uncertain, for your code to reconcile.
Timers
- Timers will measure time that only moves forward, and survive the wraparound of a hardware counter.
- On a microcontroller the number of timers will be fixed when you build, and running out of timers will be a typed result, not a crash.
- A timer that is cancelled or reused will never be able to wake the wait it used to belong to.
Time describes timers, deadlines and schedules in the standard library.
Cooperative scheduling
A handler will run until it waits for something: a reply, a message or a timer. Nothing will interrupt a handler that never waits, so:
- keep the work between two waits bounded;
- keep a hardware watchdog for the case where a handler does not return;
- on a microcontroller, let interrupt handlers only record that something happened, and do the work in an ordinary handler.
These rules will keep agents from racing on shared state and keep messages from being lost or owned twice. On their own, they will not guarantee that work meets a deadline.
Waiting for several results
You will be able to start several pieces of work and then wait for all of them, take the first to finish, or wait until enough of them succeed. The number of such children will be bounded, and when one result decides the outcome, the remaining children will be cancelled and cleaned up before the outcome is reported.
Supervision
Failures will come in three kinds, and supervision will treat them differently:
| Failure | Handling |
|---|---|
A Result error | Returned to the caller like any value. |
| A fault that the supervisor may recover from | The agent restarts, within limits you set. |
| A fatal defect, such as corrupted state | No restart. The program stops, or a board goes to its safe state. |
A restart policy will state how many restarts are allowed, with what delay between them, and what happens when the allowance runs out. On a restart:
- the agent's state will be reset, or restored from a saved checkpoint;
- the messages waiting in its mailbox will be discarded with failure replies unless you choose to keep or replay them;
- replies meant for the agent before its restart will not be able to reach the restarted agent;
- the restart will spend from the same budget and keep the same deadline as the original work.
An agent that drives an actuator will restart only through a safe state that you define.
On microcontrollers
On the smallest boards, every agent, mailbox and timer will be known when you build, each with its fixed capacity, and nothing will need a heap. Microcontroller boards describes how the boards will run this model.
Ownership across waits
A value in a message will move to the receiver. References will never travel in messages and never survive a wait; see Ownership.