cations by introducing the set of necessary applications as another external
parameter N ⊆ Σ.
Definition 7. A specification S is sufficient to support a set of specifications
N iff N ⊆ post(S).
A spanning layer must be strong
enough to support all necessary applications, but the stronger it is the fewer
possible supports it has. The notion of
minimal sufficiency serves as a means to
balance these two design requirements:
Definition 8. A specification is
minimally sufficient for N iff it is sufficient
for N but there is no strictly weaker
specification sufficient for N.
The balance between more applications and more supports is achieved by
first choosing the set of necessary applications N and then seeking a spanning layer sufficient for N that is as
weak as possible. This scenario makes
the choice of necessary applications
N the most directly consequential element in the process of defining a spanning layer that meets the goals of the
Note the implication that the trade-off between the weakness of the spanning layer and its sufficiency for a
particular set of applications N is unavoidable. This suggests the design of
a spanning layer may have a tendency
to fail if it attempts to both achieve a
high degree of weakness and also be
sufficient to support a large set of necessary applications.
End-to-end arguments have influenced
the design of many layered systems,
most famously the Internet. Historically, end-to-end arguments have often
been invoked in discussions of whether it is appropriate to add functionality
to a layer of the network, and, in particular, when discussing the Internet’s
Claims have often been made that
an end-to-end argument implies that
adding functionality to the spanning
layer will result in a diminution of the
scalability of the Internet, although this
term does not have a generally agreed-
upon definition. Here, the hourglass
model is used as a reference, to hy-
pothesize that scalability is enabled by
a spanning layer that has implementa-
tions using as many different supports
as possible, given the necessary applica-
sets of specifications, since there is no
formal specification for the value of
, nor a way of determining whether a
particular program p is in . Even when
there is community agreement that cer-
tain programs are either in or in its
complement, there may still be conten-
tion regarding some boundary cases.
Taking a descriptive view of the
hourglass allows us to use it as an analytical or predictive tool to understand
the impact of a community’s adopting
a particular interface as a standard,
be it de jure or de facto. Making the
distinction between the use of the
hourglass as a descriptive tool or as a
means of justifying a standard also explains how different hourglasses can
be examined and compared within the
discussion of the same layered system.
Every prospective spanning layer has
an associated pre- and post-image, regardless of whether it is considered for
any kind of standardization.
The Hourglass Theorem
This theorem is central to our understanding of the hourglass model.
theorem 1. If a specification S1
is weaker than another specification
S2, then 1) post(S1) ⊆ post(S2), and
2) pre(S1) ⊇ pre(S2). Proof:
1. By definition, T ∈ post(S1) iff
∃p ∈ [S1 ≺p T ] so by Lemma 1
S2 ≺p T, thus
T ∈ post(S2)
2. The proof is symmetric to Part 1.
The Hourglass Theorem conveys (
approximately) that a weaker layer specification has fewer possible applications
but more possible supporting layers
than a stronger layer specification.
In terms of the hourglass shape, the thin
waist (weak spanning layer, as noted
earlier) naturally tends to give rise to the
large lower bell of the hourglass (many
supports). However, a weaker spanning
layer also tends to give rise to a smaller
upper bell (fewer applications). Thus,
some countervailing element must be
introduced into the model to ensure it
is in fact possible to implement all necessary applications (see Figure 4).
As a design goal, we model the necessity of implementing certain appli-
The thin waist
of the hourglass
is a narrow straw
can draw upon
that are available
in the less restricted
of the stack.