---
title: Causal-Consistency Path Search (CPS)
url: https://www.emergentmind.com/topics/causal-consistency-path-search-cps
type: topic
---

# Causal-Consistency Path Search (CPS)

Causal-Consistency Path Search (“CPS”, *Editor’s term*) can be understood as a family of formalisms and algorithms in which causal consistency is analyzed by searching over admissible causal paths, partial-order extensions, per-process serializations, or, dually, by detecting cycle witnesses of inconsistency. In the cited literature, this perspective appears in generalized causal consistency for arbitrary sequential objects, in graph-type and proof-net characterizations of higher-order causal processes, in Datalog reductions for checking distributed database executions, and in DPOR-style stateless model checking of transactional traces [1802.00706], [2403.09297], [2011.09753], [2211.09020].

## 1. Conceptual scope and historical setting

Historically, causal consistency had been studied mainly for read/write memory. The central shift introduced in “Extending Causal Consistency to any Object Defined by a Sequential Specification” is that causality is represented by a global partial order over operations, rather than by read-from and write-from relationships alone, and that each process is allowed to interpret the concurrent history through its own causally consistent serialization [1802.00706]. This produces a multi-view rather than single-view notion of consistency: different processes may legitimately observe different total orders extending the same partial order.

That reformulation is the clearest abstract basis for CPS. The search problem is no longer “find one global sequential history,” but rather “find a partial order preserving process order, and for each process find a causal-past-constrained serialization compatible with the object specifications.” The data block explicitly identifies this as the formal target criterion relevant to CPS: find a partial order preserving process order, choose for each process a causal-past-constrained serialization, optionally assign return values for remote operations, and verify that each object projection is legal under its sequential specification [1802.00706].

A recurrent misconception is that causal consistency requires one common object history. The generalized account rejects that view. Strong consistency conditions require all processes to see the same sequential order, whereas causal consistency allows each process to have its own view of the execution; the “greatest common view” is the causality partial order, while the linearizations extending it may differ [1802.00706]. For CPS, this means the search space is inherently a space of compatible local views rather than a single canonical path.

## 2. Generalized semantics over concurrent objects

The generalized model starts from a concurrent history
$$
H=\langle L_1,\ldots,L_n\rangle,
$$
where each $L_i$ is the local history of sequential asynchronous process $p_i$, the processes cooperate by accessing shared concurrent objects, and the objects are defined by sequential specifications. Operations are generally assumed to be total, and, for exposition in the register case, each register has an initial value written by a fictitious write operation [1802.00706].

The formal definition requires a partial order $\stackrel{po}{\rightarrow}$ on the operations of $H$ such that, for every process $p_i$:

1. process order is respected,
   $$
   (1 \stackrel{i}\rightarrow 2) \Rightarrow (1 \stackrel{po}\rightarrow 2),
   $$
2. there exists an assignment $Assignment_i$ and a causal past-constrained serialization $S_i$ of $Assignment_i(\stackrel{po}\rightarrow)$ such that
   $$
   \forall\, O\in \mathcal O,\quad S_i|O \text{ belongs to the sequential specification of } O.
   $$

The role of $Assignment_i(\stackrel{po}{\rightarrow})$ is specific and technically important. For operations not issued by $p_i$, returned values may be replaced by possibly different values in the same return domain; operations issued by $p_i$ cannot have their returned values changed. This is necessary because, for stacks, queues, dictionaries, and other non-read/write objects, simply deleting remote operations is not adequate: updates affect object state in a richer way than a register write.

Causality remains a partial-order notion. In the read/write case, the execution partial order is the transitive closure of local process order and the write-into relation:
- local process order,
- write-into order,
- transitivity.

A serialization $S$ is any total order extending the partial order, and it is causal past-constrained if, for each operation issued by $p_i$, only operations in that operation’s causal past can appear before it. This gives CPS its core semantic structure: search over total orders that extend the same causal skeleton but respect local causal pasts.

The same paper supplies an operational realization via causal broadcast. A process invoking $O.(param)$ causally broadcasts $\textsf{operation}(i,O,(param))$, waits until the operation is locally processed, and returns the locally stored result. Upon causal delivery of $\textsf{operation}(j,O,(param))$, the process updates its local object state via
$$
\langle r,state_i[O]\rangle \leftarrow \delta_O(state_i[O],(param)),
$$
and if $j=i$, sets $result_i \leftarrow r$. Because each process processes operations in causal order and maintains a local state per object, each local execution yields a serialization compatible with the object specification. The paper also states that replacing causal broadcast by total order broadcast yields linearizability rather than causal consistency [1802.00706]. This sharply separates CPS for causal consistency from single-order search for stronger consistency conditions.

## 3. Execution-level path and cycle characterizations

At the execution level, CPS often appears as cycle detection in derived relations. “Checking Causal Consistency of Distributed Databases” represents an execution as a history
$$
h = (O, po, \wro),
$$
where $O$ is the set of read/write operations, $po$ is program order, and $\wro$ is the write-read relation pairing each read with the write that supplied its value. For CC, the paper uses the causal order
$$
co = (po \cup \wro)^+,
$$
and characterizes violations by finitely many bad patterns. For CCv, it adds the arbitration/conflict layer; for CM, it introduces a per-operation happened-before relation $hb[o]$ that propagates through reads-from and program-order prefixes [2011.09753].

| Model | Derived relation | Violation witness |
|---|---|---|
| CC | $co$ | `CyclicCO`, `WriteCOInitRead`, `ThinAirRead`, `WriteCORead` |
| CCv | $cf \cup co$ | `CyclicCF` |
| CM | $hb[o]$ | `WriteHBInitRead`, `CyclicHB` |

The forbidden patterns are explicitly path-shaped. `CyclicCO` is $\exists X.\ co(X,X)$. `WriteCORead` requires writes $w_1,w_2$ and a read $r$ on the same variable such that
$$
w_1 \xrightarrow{co} w_2 \xrightarrow{co} r
\quad\text{and}\quad
w_1 \xrightarrow{wr} r.
$$
For CCv, the conflict relation is defined by
$$
(\wrt{x}{v}, \wrt{x}{v'}) \in cf \iff (\wrt{x}{v}, \rd{x}{v'}) \in co \ \text{and}\ (\wrt{x}{v'}, \rd{x}{v'}) \in \wro
$$
for some read $\rd{x}{v'}$, and a violation occurs when $cf \cup co$ is cyclic. For CM, $hb[o]$ is the smallest transitive relation seeded by causal-order edges in the causal past of $o$ and extended through reads-from and program order in the prefix of $o$.

The Datalog reduction maps executions to facts such as `rd`, `wrt`, `po`, `wr`, `sv`, and `initread`, then derives closures and checks integrity constraints. The resulting method is a symbolic path search: recursive rules compute transitive closures, other rules compose paths through `wr` and `po`, and violation detection is reduced to the discovery of a cycle or prohibited path shape. The paper states polynomial complexity
$$
O(n^3),
$$
improving over an earlier $O(n^5)$ characterization, and implements the reduction in **CausalC-Checker** using `clingo`. On CockroachDB, CC and CCv checking terminate in under about **11.6 seconds** for all tested histories, and for histories with **600 operations**, CM\(_2\) improves runtime by about **8×** compared to CM\(_1\). On Galera, the tool detected that **1.25%** of tested histories violate causal consistency, and **73.3%** of the CM violations found were also CC violations [2011.09753].

## 4. Stateless model checking as optimal path search over traces

A second algorithmic form of CPS appears in stateless model checking of transactional programs. “Optimal Stateless Model Checking of Transactional Programs under Causal Consistency” explores traces summarized by program order and reads-from rather than raw interleavings. A trace is represented as
$$
\tau = \langle T,\ red,\ blue \rangle
$$
or, depending on the model, by extensions such as $\langle T,\ red,\ blue,\ violet \rangle$ or $\langle T,\ red,\ blue,\ blue\!70\!green_p \rangle$, where:
- $T$ is the set of transactions,
- $red$ is program order,
- $blue$ is reads-from,
- $violet$ and `blue!70!green_p` are model-specific closure relations.

The core trace relations are:
$$
t \; red \; t' \iff process(t)=process(t') \text{ and } t.id < t'.id,
$$
with the initializer before everything, and
$$
t \; blue \; t'
$$
when transaction $t'$ reads a value last written by transaction $t$ on the same variable. Two runs with the same associated traces are treated as equivalent because the assertions to be checked at the end of a run depend only on `red` and `blue`.

The CPS mechanism is incremental. When a transaction begins, the search adds a node and a `red` edge from the previous transaction in the same process. When a read occurs, the search computes a readable set
$$
(\tau^t_X, t, x),
$$
branches over all readable source transactions for the read on variable $x$, adds the corresponding `blue` edge, and then closes the trace under the model-specific consistency obligations. The readable set is precisely a feasibility filter: a transaction is readable iff choosing it does not immediately force a forbidden cycle after adding the implied closure edges.

This search is organized by a DPOR scheme with procedures `DPOR(X,P)`, `ExploreTraces(X,\tau,\pi)`, `CreateSchedule`, and `RunSchedule`. `CreateSchedule` is the backtracking mechanism: when a transaction ends, it scans backward to find earlier read events for which the ended transaction might have been a source but was postponed, then creates schedules that move the postponed source before the earlier transaction while preserving the necessary enabling prefix. The paper’s main theorem is that the algorithm is **sound, complete and optimal**, and explicitly states that “each consistent red-blue trace is explored exactly once” [2211.09020].

The implementation, **Tranchecker**, extends **Nidhugg**, works at **LLVM IR** level, accepts **C programs**, dynamically controls execution, generates schedules, replays them, and checks user assertions along generated traces. The experiments include **7507** litmus tests generated using Herd, handled in about **570 seconds** total for the five models, as well as classical database benchmarks and applications such as Vote, Twitter, FusionTicket, Auction, Auction-2, and Group [2211.09020]. A common misconception is that CPS must enumerate all interleavings; this framework does not. It explores trace classes modulo equivalence induced by `red`, `blue`, and the model-specific closures.

## 5. Graph types, signalling constraints, and proof-net completeness

In higher-order process semantics, CPS is recast as graph reasoning. “A complete logic for causal consistency” works in the $Caus[-]$ construction, where a base compact closed category $\mathcal C$ is lifted to a category of higher-order causal processes whose types encode signalling constraints. Objects are pairs
$$
\mathbf A = (A, c_{\mathbf A}),
$$
and a morphism $f:A\to B$ is causal when
$$
\forall \rho\in c_{\mathbf A}.\quad \rho\fatsemi f \in c_{\mathbf B}.
$$
The construction is designed so that closed diagrams always evaluate to probability $1$, thereby ruling out causal paradoxes from time loops [2403.09297].

The central abstraction is the **graph type**, which generalizes binary type formers such as $\otimes$, $<$, and $\parr$ to arbitrary DAGs. The paper defines local graph types, signalling graph types, recursive signalling graph types, and ordered graph types, and proves the key equivalence theorem
$$
\mathbf{LoGr}_G^\Gamma = \mathbf{LoGr2}_G^\Gamma = \mathbf{RSiGr}_G^\Gamma = \mathbf{SiGr}_G^\Gamma = \mathbf{OrGr}_G^\Gamma
\qquad\text{for every DAG }G.
$$
Thus causal compatibility over a DAG can be characterized equivalently by affine combinations of graph-factorizing local processes, by signalling constraints, or by ordered/topological decompositions. This is the most explicit “CPS-style” theorem in the logical setting: instead of asking directly whether a forbidden signalling path exists, one can ask whether every possible causal ordering compatible with the graph is valid.

The same framework yields standard forms. Graph type depends only on transitive closure,
$$
\mathbf{Gr}_G^\Gamma=\mathbf{Gr}_{G^+}^\Gamma,
$$
and after pruning edges into or out of first-order vertices one obtains a standard form $\overline G$ with
$$
\mathbf{Gr}_G^\Gamma=\mathbf{Gr}_{\overline G}^\Gamma.
$$
Compatibility of dual graph types is characterized by acyclicity:
$$
c_{\mathbf{Gr}_G^\Gamma}\subseteq c_{(\mathbf{Gr}_{G'}^{\Gamma^*})^*}
\quad\Longleftrightarrow\quad
(V,\overline E\cup\overline E')\text{ is acyclic}.
$$
This is the formal “no time loop / no causal paradox” criterion.

The proof-theoretic culmination is a causal proof-net calculus with distinguished first-order atoms. A formula is causally consistent under an interpretation $\Phi$ when the contraction morphism
$$
\epsilon_F^\Phi : \Phi(F)^* \to \mathbf I
$$
is causal. Correctness is determined by up-down switchings: for every switching, the switching graph must be acyclic. The completeness theorem is
$$
\Vdash_C^\Phi F \iff P_F \text{ is a causal proof-net}.
$$
Accordingly, CPS in this setting is the search for a switching-cycle witness: a diagram is valid exactly when there is no causal loop or signalling cycle hidden in any switching of the proof structure [2403.09297].

## 6. Scope, misconceptions, and adjacent path-based causal inference

Three misconceptions are repeatedly ruled out by the cited work. First, causal consistency is not equivalent to a single global history; different processes may have different views extending the same partial order [1802.00706]. Second, path search need not be explicit graph enumeration; Datalog saturation and proof-net switching criteria perform symbolic derivation of paths and cycles [2011.09753], [2403.09297]. Third, not every path-based causal method is a consistency criterion.

A related but distinct use of path analysis appears in “Causal Discovery from Poisson Branching Structural Causal Model Using High-Order Cumulant with Path Analysis.” That paper studies count-valued causal discovery under a **Poisson Branching Structural Causal Model (PB-SCM)**,
$$
X_i = \sum_{j\in Pa(i)} \alpha_{j,i} \circ X_j + \epsilon_i,
\qquad
\epsilon_i \sim \mathrm{Pois}(\mu_i),
\qquad
\alpha_{j,i}\in(0,1],
$$
with binomial thinning
$$
\alpha \circ X := \sum_{n=1}^{X} \xi_n^{(\alpha)},
\qquad
\xi_n^{(\alpha)} \stackrel{\mathrm{i.i.d.}}{\sim} \mathrm{Bern}(\alpha).
$$
Its central contribution is to connect high-order cumulants with directed path multiplicity. For a root vertex $i$, if there exist at least two directed paths $i\leadsto j$, i.e.
$$
|\mathbf{P}^{i\leadsto j}|\ge 2,
$$
then the causal order between $i$ and $j$ is identifiable. More generally, for adjacent $i,j$, if there exists $k\in\mathbb{Z}^+$ such that
$$
\tilde{\Lambda}_k(X_i\leadsto X_j)\neq 0
\quad\text{and}\quad
\tilde{\Lambda}_k(X_j\leadsto X_i)=0,
$$
then $X_i$ is the parent/ancestor of $X_j$ [2403.16523].

This is not a causal-consistency model. It is a path-identification method for observational count data, using cumulant asymmetries to escape bivariate Markov-equivalence ambiguity. Its relevance to CPS is therefore adjacent rather than direct: both lines of work treat path structure as the decisive latent object, but one searches for admissible histories or cycle witnesses of consistency, while the other infers directed structure from cumulants. This suggests that “path search” is a broader methodological pattern across causality research, whereas CPS in the strict consistency sense is specifically about admissible causal orderings, local views, and the absence of forbidden cycles [2403.16523].

Taken together, the cited works suggest that CPS is best regarded not as one fixed algorithm, but as a recurrent research pattern. In generalized shared-object semantics it is search over partial orders and local serializations; in database verification it is search over derived execution paths until a bad pattern or cycle is exposed; in stateless model checking it is optimal exploration of `po`–`rf` trace classes; and in categorical logic it is acyclicity checking over graph types and proof-net switchings. Across these settings, the invariant idea is the same: represent causality by a structure weaker than a total order, constrain the admissible extensions of that structure, and declare causal consistency exactly when no illegal serialization, signalling path, or cycle witness remains.

Source: https://www.emergentmind.com/topics/causal-consistency-path-search-cps