rust/neon
1
0
Fork 0
mirror of https://github.com/neondatabase/neon.git synced 2026-10-22 03:33:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

offline-ness

Browse Source
This commit is contained in:
Christian Schwarz
2025-01-19 22:16:58 +01:00
parent 933b4719cb
commit 071c5710c5
111 changed files with 4617 additions and 3154 deletions
Download Patch File Download Diff File Expand all files Collapse all files
storage_broker/spec/replicated/replicated.tla
+26 -9
View File
@@ -1,8 +1,8 @@
---- MODULE replicated ----
EXTENDS Integers
EXTENDS Integers, FiniteSets
VARIABLES broker_state, safekeeper_state, pageserver_state
VARIABLES broker_state, safekeeper_state, pageserver_state, online
CONSTANT
@@ -29,14 +29,23 @@ StateConstraint ==
InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0]
InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]]
InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]]
InitOnline == safekeepers \cup brokers \cup pageservers
Init ==
/\ broker_state = [b \in brokers |-> InitBroker]
/\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper]
/\ pageserver_state = [p \in pageservers |-> InitPageserver]
/\ online = InitOnline
NodeOnlineOffline ==
/\ online' = CHOOSE ss \in SUBSET InitOnline:
/\ Cardinality(ss \cap safekeepers) >= 2
/\ Cardinality(ss \cap brokers) >= 2
/\ ss \cap pageservers = pageservers \* assume no PS failures for now
/\ UNCHANGED <<safekeeper_state,broker_state,pageserver_state>>
SkCommit(s1, s2) ==
/\ {s1, s2} \subseteq online
/\ s1 # s2
/\ safekeeper_state[s1].commit_lsn = safekeeper_state[s2].commit_lsn
/\ LET
@@ -45,14 +54,16 @@ SkCommit(s1, s2) ==
safekeeper_state' = [safekeeper_state EXCEPT
![s1].commit_lsn = new_commit_lsn,
![s2].commit_lsn = new_commit_lsn]
/\ UNCHANGED <<broker_state, pageserver_state>>
/\ UNCHANGED <<broker_state, pageserver_state,online>>
SkPeerRecovery(s1,s2) ==
/\ {s1, s2} \subseteq online
/\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn
/\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn]
/\ UNCHANGED <<broker_state, pageserver_state>>
/\ UNCHANGED <<broker_state, pageserver_state,online>>
SkPushToBroker(s,b) ==
/\ {s, b} \subseteq online
/\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn
THEN
LET
@@ -61,9 +72,10 @@ SkPushToBroker(s,b) ==
IN
[broker_state EXCEPT ![b].sk = updbsk]
ELSE broker_state
/\ UNCHANGED <<safekeeper_state, pageserver_state>>
/\ UNCHANGED <<safekeeper_state, pageserver_state,online>>
PsRecvBroker(b,p,s) ==
/\ {b,p,s} \subseteq online
/\ LET
bsk == broker_state[b].sk[s]
psk == pageserver_state[p].sk[s]
@@ -72,7 +84,7 @@ PsRecvBroker(b,p,s) ==
pageserver_state' = IF bsk.commit_lsn > psk.commit_lsn
THEN [pageserver_state EXCEPT ![p].sk[s] = updpsk]
ELSE pageserver_state
/\ UNCHANGED <<safekeeper_state, broker_state>>
/\ UNCHANGED <<safekeeper_state, broker_state,online>>
SksWithNewerWal(p) ==
@@ -82,13 +94,14 @@ SksWithNewerWal(p) ==
{s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn}
PsChooseSk(p) ==
/\ {p} \subseteq online
/\ SksWithNewerWal(p) # {}
/\ pageserver_state' = [pageserver_state EXCEPT![p].preferred_sk = CHOOSE s \in SksWithNewerWal(p): TRUE]
/\ UNCHANGED <<safekeeper_state, broker_state>>
/\ UNCHANGED <<safekeeper_state, broker_state,online>>
Next ==
\/ NodeOnlineOffline
\/ \E s1 \in safekeepers: \E s2 \in safekeepers:
\/ SkCommit(s1, s2)
\/ SkPeerRecovery(s1, s2)
@@ -97,11 +110,15 @@ Next ==
\/ \E p \in pageservers: PsChooseSk(p)
Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state >>
Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state,online>>
\* invariants
PsLagsSk == \A p \in pageservers: \A s \in DOMAIN pageserver_state[p].sk:
/\ pageserver_state[p].sk[s].commit_lsn <= safekeeper_state[s].commit_lsn
EventuallyLaggingSkIsNotPreferredSk == <>(
LET
sks == safekeeper_state
storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-16-40-15/MC-0.st
BIN
View File
Binary file not shown.
storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-16-40-15/MC-1.st
BIN
View File
Binary file not shown.
storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-16-40-15/MC-2.st
BIN
View File
Binary file not shown.
storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-16-40-15/MC-3.st
BIN
View File
Binary file not shown.
storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.cfg
+12 -10
View File
@@ -11,7 +11,6 @@ s3 = s3
\* MV CONSTANT declarations
CONSTANTS
p1 = p1
p2 = p2
\* MV CONSTANT declarations
CONSTANTS
az1 = az1
@@ -19,33 +18,36 @@ az2 = az2
az3 = az3
\* MV CONSTANT definitions
CONSTANT
brokers <- const_17373012151752000
brokers <- const_1737309054555163000
\* CONSTANT declarations
CONSTANT NULL = NULL
\* MV CONSTANT definitions
CONSTANT
safekeepers <- const_17373012151763000
safekeepers <- const_1737309054555164000
\* MV CONSTANT definitions
CONSTANT
pageservers <- const_17373012151764000
pageservers <- const_1737309054555165000
\* MV CONSTANT definitions
CONSTANT
azs <- const_17373012151765000
azs <- const_1737309054555166000
\* SYMMETRY definition
SYMMETRY symm_17373012151766000
SYMMETRY symm_1737309054555167000
\* CONSTANT definitions
CONSTANT
max_commit_lsn <- const_17373012151767000
max_commit_lsn <- const_1737309054555168000
\* CONSTANT definitions
CONSTANT
az_mapping <- const_17373012151768000
az_mapping <- const_1737309054555169000
\* CONSTRAINT definition
CONSTRAINT
constr_17373012151769000
constr_1737309054555170000
\* SPECIFICATION definition
SPECIFICATION
Spec
\* INVARIANT definition
INVARIANT
PsLagsSk
\* PROPERTY definition
PROPERTY
EventuallyLaggingSkIsNotPreferredSk
\* Generated on Sun Jan 19 16:40:15 CET 2025
\* Generated on Sun Jan 19 18:50:54 CET 2025
storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.out
-53
View File
@@ -1,53 +0,0 @@
@!@!@STARTMSG 2262:0 @!@!@
TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802)
@!@!@ENDMSG 2262 @!@!@
@!@!@STARTMSG 2187:0 @!@!@
Running breadth-first search Model-Checking with fp 20 and seed 6372772458573668883 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 9898] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
@!@!@ENDMSG 2187 @!@!@
@!@!@STARTMSG 2220:0 @!@!@
Starting SANY...
@!@!@ENDMSG 2220 @!@!@
Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla
Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Semantic processing of module Naturals
Semantic processing of module Integers
Semantic processing of module replicated
Semantic processing of module Sequences
Semantic processing of module FiniteSets
Semantic processing of module TLC
Semantic processing of module MC
@!@!@STARTMSG 2219:0 @!@!@
SANY finished.
@!@!@ENDMSG 2219 @!@!@
@!@!@STARTMSG 2185:0 @!@!@
Starting... (2025-01-19 16:40:16)
@!@!@ENDMSG 2185 @!@!@
@!@!@STARTMSG 2279:3 @!@!@
Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined.
@!@!@ENDMSG 2279 @!@!@
@!@!@STARTMSG 2284:3 @!@!@
Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details.
@!@!@ENDMSG 2284 @!@!@
@!@!@STARTMSG 2212:0 @!@!@
Implied-temporal checking--satisfiability problem has 1 branches.
@!@!@ENDMSG 2212 @!@!@
@!@!@STARTMSG 2189:0 @!@!@
Computing initial states...
@!@!@ENDMSG 2189 @!@!@
@!@!@STARTMSG 2190:0 @!@!@
Finished computing initial states: 1 distinct state generated at 2025-01-19 16:40:18.
@!@!@ENDMSG 2190 @!@!@
@!@!@STARTMSG 2192:0 @!@!@
Checking temporal properties for the current state space with 1217 total distinct states at (2025-01-19 16:40:21)
@!@!@ENDMSG 2192 @!@!@
@!@!@STARTMSG 2267:0 @!@!@
Finished checking temporal properties in 00s at 2025-01-19 16:40:21
@!@!@ENDMSG 2267 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(11) at 2025-01-19 16:40:21: 39.816 states generated (39.816 s/min), 3.288 distinct states found (3.288 ds/min), 2.067 states left on queue.
@!@!@ENDMSG 2200 @!@!@
storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla
+13 -13
View File
@@ -13,7 +13,7 @@ s1, s2, s3
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
p1, p2
p1
----
\* MV CONSTANT declarations@modelParameterConstants
@@ -22,44 +22,44 @@ az1, az2, az3
----
\* MV CONSTANT definitions brokers
const_17373012151752000 ==
const_1737309054555163000 ==
{b1, b2, b3}
----
\* MV CONSTANT definitions safekeepers
const_17373012151763000 ==
const_1737309054555164000 ==
{s1, s2, s3}
----
\* MV CONSTANT definitions pageservers
const_17373012151764000 ==
{p1, p2}
const_1737309054555165000 ==
{p1}
----
\* MV CONSTANT definitions azs
const_17373012151765000 ==
const_1737309054555166000 ==
{az1, az2, az3}
----
\* SYMMETRY definition
symm_17373012151766000 ==
Permutations(const_17373012151752000) \union Permutations(const_17373012151763000) \union Permutations(const_17373012151764000) \union Permutations(const_17373012151765000)
symm_1737309054555167000 ==
Permutations(const_1737309054555163000) \union Permutations(const_1737309054555164000) \union Permutations(const_1737309054555165000) \union Permutations(const_1737309054555166000)
----
\* CONSTANT definitions @modelParameterConstants:4max_commit_lsn
const_17373012151767000 ==
const_1737309054555168000 ==
2
----
\* CONSTANT definitions @modelParameterConstants:5az_mapping
const_17373012151768000 ==
[ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2,p2} , az3 |-> {b3,s3}]
const_1737309054555169000 ==
[ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2} , az3 |-> {b3,s3}]
----
\* CONSTRAINT definition @modelParameterContraint:0
constr_17373012151769000 ==
constr_1737309054555170000 ==
StateConstraint
----
=============================================================================
\* Modification History
\* Created Sun Jan 19 16:40:15 CET 2025 by cs
\* Created Sun Jan 19 18:50:54 CET 2025 by cs
storage_broker/spec/replicated/replicated.toolbox/Model_1/MC_TE.out
+309 -8
View File
@@ -2,7 +2,7 @@
TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802)
@!@!@ENDMSG 2262 @!@!@
@!@!@STARTMSG 2187:0 @!@!@
Running breadth-first search Model-Checking with fp 20 and seed 6372772458573668883 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 9898] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
Running breadth-first search Model-Checking with fp 96 and seed 147884281130356166 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 12007] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
@!@!@ENDMSG 2187 @!@!@
@!@!@STARTMSG 2220:0 @!@!@
Starting SANY...
@@ -11,21 +11,21 @@ Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbo
Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Semantic processing of module Naturals
Semantic processing of module Integers
Semantic processing of module replicated
Semantic processing of module Sequences
Semantic processing of module FiniteSets
Semantic processing of module replicated
Semantic processing of module TLC
Semantic processing of module MC
@!@!@STARTMSG 2219:0 @!@!@
SANY finished.
@!@!@ENDMSG 2219 @!@!@
@!@!@STARTMSG 2185:0 @!@!@
Starting... (2025-01-19 16:40:16)
Starting... (2025-01-19 18:38:05)
@!@!@ENDMSG 2185 @!@!@
@!@!@STARTMSG 2279:3 @!@!@
Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined.
@@ -40,14 +40,315 @@ Implied-temporal checking--satisfiability problem has 1 branches.
Computing initial states...
@!@!@ENDMSG 2189 @!@!@
@!@!@STARTMSG 2190:0 @!@!@
Finished computing initial states: 1 distinct state generated at 2025-01-19 16:40:18.
Finished computing initial states: 1 distinct state generated at 2025-01-19 18:38:06.
@!@!@ENDMSG 2190 @!@!@
@!@!@STARTMSG 2192:0 @!@!@
Checking temporal properties for the current state space with 1217 total distinct states at (2025-01-19 16:40:21)
Checking temporal properties for the current state space with 3861 total distinct states at (2025-01-19 18:38:09)
@!@!@ENDMSG 2192 @!@!@
@!@!@STARTMSG 2267:0 @!@!@
Finished checking temporal properties in 00s at 2025-01-19 16:40:21
Finished checking temporal properties in 00s at 2025-01-19 18:38:09
@!@!@ENDMSG 2267 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(11) at 2025-01-19 16:40:21: 39.816 states generated (39.816 s/min), 3.288 distinct states found (3.288 ds/min), 2.067 states left on queue.
Progress(11) at 2025-01-19 18:38:09: 77.856 states generated (77.856 s/min), 8.653 distinct states found (8.653 ds/min), 4.790 states left on queue.
@!@!@ENDMSG 2200 @!@!@
@!@!@STARTMSG 2192:0 @!@!@
Checking temporal properties for the current state space with 197257 total distinct states at (2025-01-19 18:39:09)
@!@!@ENDMSG 2192 @!@!@
@!@!@STARTMSG 2267:0 @!@!@
Finished checking temporal properties in 00s at 2025-01-19 18:39:09
@!@!@ENDMSG 2267 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(20) at 2025-01-19 18:39:09: 3.084.377 states generated (3.006.521 s/min), 204.964 distinct states found (196.311 ds/min), 7.704 states left on queue.
@!@!@ENDMSG 2200 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(25) at 2025-01-19 18:39:12: 3.224.329 states generated, 208.868 distinct states found, 0 states left on queue.
@!@!@ENDMSG 2200 @!@!@
@!@!@STARTMSG 2192:0 @!@!@
Checking temporal properties for the complete state space with 208868 total distinct states at (2025-01-19 18:39:12)
@!@!@ENDMSG 2192 @!@!@
@!@!@STARTMSG 2267:0 @!@!@
Finished checking temporal properties in 00s at 2025-01-19 18:39:12
@!@!@ENDMSG 2267 @!@!@
@!@!@STARTMSG 2193:0 @!@!@
Model checking completed. No error has been found.
Estimates of the probability that TLC did not check all reachable states
because two distinct states had the same fingerprint:
calculated (optimistic): val = 3.4E-8
based on the actual fingerprints: val = 6.3E-10
@!@!@ENDMSG 2193 @!@!@
@!@!@STARTMSG 2201:0 @!@!@
The coverage statistics at 2025-01-19 18:39:14
@!@!@ENDMSG 2201 @!@!@
@!@!@STARTMSG 2773:0 @!@!@
<Init line 34, col 1 to line 34, col 4 of module replicated>: 1:1
@!@!@ENDMSG 2773 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 35, col 5 to line 38, col 26 of module replicated: 1
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<NodeOnlineOffline line 40, col 1 to line 40, col 17 of module replicated>: 14290:208868
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 41, col 8 to line 44, col 44 of module replicated: 208868
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 41, col 18 to line 44, col 44 of module replicated: 208868
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 42, col 9 to line 44, col 44 of module replicated: 22348876
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 42, col 12 to line 42, col 48 of module replicated: 22348876
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 43, col 12 to line 43, col 44 of module replicated: 8981324
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 44, col 12 to line 44, col 44 of module replicated: 2924152
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 41, col 32 to line 41, col 48 of module replicated: 208868
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 45, col 8 to line 45, col 67 of module replicated: 208868
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkCommit line 47, col 1 to line 47, col 16 of module replicated>: 84:530666
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 48, col 8 to line 48, col 32 of module replicated: 2410478
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2775:0 @!@!@
|line 48, col 8 to line 48, col 15 of module replicated: 1879812:4246157
@!@!@ENDMSG 2775 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 48, col 27 to line 48, col 32 of module replicated: 1879812
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 49, col 8 to line 49, col 14 of module replicated: 1643803
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 49, col 8 to line 49, col 9 of module replicated: 1113137
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 49, col 13 to line 49, col 14 of module replicated: 1113137
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 50, col 8 to line 50, col 72 of module replicated: 1170534
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 50, col 8 to line 50, col 38 of module replicated: 639868
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 50, col 42 to line 50, col 72 of module replicated: 639868
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 54, col 13 to line 56, col 50 of module replicated: 530666
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 57, col 8 to line 57, col 58 of module replicated: 530666
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkPeerRecovery line 59, col 1 to line 59, col 21 of module replicated>: 682:54601
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 60, col 8 to line 60, col 32 of module replicated: 1934413
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2775:0 @!@!@
|line 60, col 8 to line 60, col 15 of module replicated: 1879812:4246157
@!@!@ENDMSG 2775 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 60, col 27 to line 60, col 32 of module replicated: 1879812
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 61, col 8 to line 61, col 72 of module replicated: 54601
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 61, col 8 to line 61, col 38 of module replicated: 1113137
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 61, col 42 to line 61, col 72 of module replicated: 1113137
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 62, col 8 to line 62, col 102 of module replicated: 54601
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 63, col 8 to line 63, col 58 of module replicated: 54601
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkPushToBroker line 65, col 1 to line 65, col 19 of module replicated>: 45241:1113137
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 66, col 8 to line 66, col 30 of module replicated: 2992949
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2775:0 @!@!@
|line 66, col 8 to line 66, col 13 of module replicated: 1879812:4412756
@!@!@ENDMSG 2775 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 66, col 25 to line 66, col 30 of module replicated: 1879812
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 67, col 8 to line 74, col 29 of module replicated: 1113137
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 67, col 24 to line 74, col 29 of module replicated: 1113137
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 67, col 27 to line 67, col 91 of module replicated: 1113137
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 70, col 28 to line 70, col 45 of module replicated: 611653
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 71, col 31 to line 71, col 91 of module replicated: 611653
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 73, col 17 to line 73, col 54 of module replicated: 611653
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 74, col 18 to line 74, col 29 of module replicated: 501484
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 75, col 8 to line 75, col 62 of module replicated: 1113137
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<PsRecvBroker line 77, col 1 to line 77, col 19 of module replicated>: 90643:1113137
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 78, col 8 to line 78, col 31 of module replicated: 2992949
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2775:0 @!@!@
|line 78, col 8 to line 78, col 14 of module replicated: 1879812:5525893
@!@!@ENDMSG 2775 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 78, col 26 to line 78, col 31 of module replicated: 1879812
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 84, col 13 to line 86, col 37 of module replicated: 1113137
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 84, col 33 to line 86, col 37 of module replicated: 1113137
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 84, col 36 to line 84, col 66 of module replicated: 1113137
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 85, col 22 to line 85, col 66 of module replicated: 406880
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 86, col 22 to line 86, col 37 of module replicated: 706257
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 87, col 8 to line 87, col 58 of module replicated: 1113137
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<PsChooseSk line 96, col 1 to line 96, col 13 of module replicated>: 57927:203919
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 97, col 8 to line 97, col 27 of module replicated: 412787
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2775:0 @!@!@
|line 97, col 8 to line 97, col 10 of module replicated: 208868:417736
@!@!@ENDMSG 2775 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 97, col 22 to line 97, col 27 of module replicated: 208868
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 98, col 8 to line 98, col 30 of module replicated: 412787
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 98, col 8 to line 98, col 25 of module replicated: 208868
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 92, col 15 to line 92, col 33 of module replicated: 208868
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 94, col 5 to line 94, col 66 of module replicated: 208868
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 94, col 26 to line 94, col 65 of module replicated: 626604
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 94, col 12 to line 94, col 23 of module replicated: 208868
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 98, col 24 to line 98, col 24 of module replicated: 208868
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 98, col 29 to line 98, col 30 of module replicated: 208868
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 99, col 8 to line 99, col 109 of module replicated: 203919
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 99, col 28 to line 99, col 109 of module replicated: 203919
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 99, col 29 to line 99, col 44 of module replicated: 203919
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 99, col 52 to line 99, col 108 of module replicated: 203919
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 99, col 72 to line 99, col 108 of module replicated: 203919
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 99, col 105 to line 99, col 108 of module replicated: 203919
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 99, col 85 to line 99, col 102 of module replicated: 203919
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||||line 92, col 15 to line 92, col 33 of module replicated: 203919
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2775:0 @!@!@
||||line 94, col 5 to line 94, col 66 of module replicated: 203919:203919
@!@!@ENDMSG 2775 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||||line 94, col 26 to line 94, col 65 of module replicated: 611757
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||||line 94, col 12 to line 94, col 23 of module replicated: 203919
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||||line 99, col 101 to line 99, col 101 of module replicated: 203919
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 100, col 8 to line 100, col 58 of module replicated: 203919
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2774:0 @!@!@
<PsLagsSk line 118, col 1 to line 118, col 8 of module replicated>
@!@!@ENDMSG 2774 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 118, col 13 to line 119, col 81 of module replicated: 736274
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 118, col 35 to line 119, col 81 of module replicated: 736274
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 119, col 9 to line 119, col 81 of module replicated: 2208822
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 118, col 44 to line 118, col 72 of module replicated: 736274
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 118, col 22 to line 118, col 32 of module replicated: 736274
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2202:0 @!@!@
End of statistics.
@!@!@ENDMSG 2202 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(25) at 2025-01-19 18:39:14: 3.224.329 states generated (2.761.383 s/min), 208.868 distinct states found (178.878 ds/min), 0 states left on queue.
@!@!@ENDMSG 2200 @!@!@
@!@!@STARTMSG 2199:0 @!@!@
3224329 states generated, 208868 distinct states found, 0 states left on queue.
@!@!@ENDMSG 2199 @!@!@
@!@!@STARTMSG 2194:0 @!@!@
The depth of the complete state graph search is 25.
@!@!@ENDMSG 2194 @!@!@
@!@!@STARTMSG 2268:0 @!@!@
The average outdegree of the complete state graph is 1 (minimum is 0, the maximum 9 and the 95th percentile is 3).
@!@!@ENDMSG 2268 @!@!@
@!@!@STARTMSG 2186:0 @!@!@
Finished in 70074ms at (2025-01-19 18:39:14)
@!@!@ENDMSG 2186 @!@!@
storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla
+26 -9
View File
@@ -1,8 +1,8 @@
---- MODULE replicated ----
EXTENDS Integers
EXTENDS Integers, FiniteSets
VARIABLES broker_state, safekeeper_state, pageserver_state
VARIABLES broker_state, safekeeper_state, pageserver_state, online
CONSTANT
@@ -29,14 +29,23 @@ StateConstraint ==
InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0]
InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]]
InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]]
InitOnline == safekeepers \cup brokers \cup pageservers
Init ==
/\ broker_state = [b \in brokers |-> InitBroker]
/\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper]
/\ pageserver_state = [p \in pageservers |-> InitPageserver]
/\ online = InitOnline
NodeOnlineOffline ==
/\ online' = CHOOSE ss \in SUBSET InitOnline:
/\ Cardinality(ss \cap safekeepers) >= 2
/\ Cardinality(ss \cap brokers) >= 2
/\ ss \cap pageservers = pageservers \* assume no PS failures for now
/\ UNCHANGED <<safekeeper_state,broker_state,pageserver_state>>
SkCommit(s1, s2) ==
/\ {s1, s2} \subseteq online
/\ s1 # s2
/\ safekeeper_state[s1].commit_lsn = safekeeper_state[s2].commit_lsn
/\ LET
@@ -45,14 +54,16 @@ SkCommit(s1, s2) ==
safekeeper_state' = [safekeeper_state EXCEPT
![s1].commit_lsn = new_commit_lsn,
![s2].commit_lsn = new_commit_lsn]
/\ UNCHANGED <<broker_state, pageserver_state>>
/\ UNCHANGED <<broker_state, pageserver_state,online>>
SkPeerRecovery(s1,s2) ==
/\ {s1, s2} \subseteq online
/\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn
/\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn]
/\ UNCHANGED <<broker_state, pageserver_state>>
/\ UNCHANGED <<broker_state, pageserver_state,online>>
SkPushToBroker(s,b) ==
/\ {s, b} \subseteq online
/\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn
THEN
LET
@@ -61,9 +72,10 @@ SkPushToBroker(s,b) ==
IN
[broker_state EXCEPT ![b].sk = updbsk]
ELSE broker_state
/\ UNCHANGED <<safekeeper_state, pageserver_state>>
/\ UNCHANGED <<safekeeper_state, pageserver_state,online>>
PsRecvBroker(b,p,s) ==
/\ {b,p,s} \subseteq online
/\ LET
bsk == broker_state[b].sk[s]
psk == pageserver_state[p].sk[s]
@@ -72,7 +84,7 @@ PsRecvBroker(b,p,s) ==
pageserver_state' = IF bsk.commit_lsn > psk.commit_lsn
THEN [pageserver_state EXCEPT ![p].sk[s] = updpsk]
ELSE pageserver_state
/\ UNCHANGED <<safekeeper_state, broker_state>>
/\ UNCHANGED <<safekeeper_state, broker_state,online>>
SksWithNewerWal(p) ==
@@ -82,13 +94,14 @@ SksWithNewerWal(p) ==
{s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn}
PsChooseSk(p) ==
/\ {p} \subseteq online
/\ SksWithNewerWal(p) # {}
/\ pageserver_state' = [pageserver_state EXCEPT![p].preferred_sk = CHOOSE s \in SksWithNewerWal(p): TRUE]
/\ UNCHANGED <<safekeeper_state, broker_state>>
/\ UNCHANGED <<safekeeper_state, broker_state,online>>
Next ==
\/ NodeOnlineOffline
\/ \E s1 \in safekeepers: \E s2 \in safekeepers:
\/ SkCommit(s1, s2)
\/ SkPeerRecovery(s1, s2)
@@ -97,11 +110,15 @@ Next ==
\/ \E p \in pageservers: PsChooseSk(p)
Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state >>
Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state,online>>
\* invariants
PsLagsSk == \A p \in pageservers: \A s \in DOMAIN pageserver_state[p].sk:
/\ pageserver_state[p].sk[s].commit_lsn <= safekeeper_state[s].commit_lsn
EventuallyLaggingSkIsNotPreferredSk == <>(
LET
sks == safekeeper_state
storage_broker/spec/replicated/replicated.toolbox/Model_1/states/25-01-19-18-52-55/0
BIN
View File
Binary file not shown.
storage_broker/spec/replicated/replicated.toolbox/Model_1/states/25-01-19-18-52-55/MC-0.st
BIN
View File
Binary file not shown.
storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-16-40-15/MC.st → storage_broker/spec/replicated/replicated.toolbox/Model_1/states/25-01-19-18-52-55/MC.st
View File
storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-16-40-15/MC_0.fp → storage_broker/spec/replicated/replicated.toolbox/Model_1/states/25-01-19-18-52-55/MC_0.fp
View File
storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-16-40-15/MC_1.fp → storage_broker/spec/replicated/replicated.toolbox/Model_1/states/25-01-19-18-52-55/MC_1.fp
View File
storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-16-40-15/nodes_0 → storage_broker/spec/replicated/replicated.toolbox/Model_1/states/25-01-19-18-52-55/nodes_0
View File
storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-16-40-15/ptrs_0 → storage_broker/spec/replicated/replicated.toolbox/Model_1/states/25-01-19-18-52-55/ptrs_0
View File
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737296416956/MC.cfg
-37
View File
@@ -1,37 +0,0 @@
\* MV CONSTANT declarations
CONSTANTS
b1 = b1
b2 = b2
b3 = b3
\* MV CONSTANT declarations
CONSTANTS
s1 = s1
s2 = s2
s3 = s3
\* MV CONSTANT declarations
CONSTANTS
p1 = p1
p2 = p2
\* MV CONSTANT definitions
CONSTANT
brokers <- const_1737296402193120000
\* CONSTANT declarations
CONSTANT NULL = NULL
\* MV CONSTANT definitions
CONSTANT
safekeepers <- const_1737296402194121000
\* MV CONSTANT definitions
CONSTANT
pageservers <- const_1737296402194122000
\* SYMMETRY definition
SYMMETRY symm_1737296402194123000
\* CONSTANT definitions
CONSTANT
max_commit_lsn <- const_1737296402194124000
\* CONSTRAINT definition
CONSTRAINT
constr_1737296402194125000
\* SPECIFICATION definition
SPECIFICATION
Spec
\* Generated on Sun Jan 19 15:20:02 CET 2025
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737296416956/MC.out
-38
View File
@@ -1,38 +0,0 @@
@!@!@STARTMSG 2262:0 @!@!@
TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802)
@!@!@ENDMSG 2262 @!@!@
@!@!@STARTMSG 2187:0 @!@!@
Running breadth-first search Model-Checking with fp 60 and seed 6751784514943401101 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 5476] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
@!@!@ENDMSG 2187 @!@!@
@!@!@STARTMSG 2220:0 @!@!@
Starting SANY...
@!@!@ENDMSG 2220 @!@!@
Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/MC.tla
Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/fullmesh.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Semantic processing of module Naturals
Semantic processing of module Integers
Semantic processing of module fullmesh
Semantic processing of module Sequences
Semantic processing of module FiniteSets
Semantic processing of module TLC
Semantic processing of module MC
@!@!@STARTMSG 2219:0 @!@!@
SANY finished.
@!@!@ENDMSG 2219 @!@!@
@!@!@STARTMSG 2185:0 @!@!@
Starting... (2025-01-19 15:20:03)
@!@!@ENDMSG 2185 @!@!@
@!@!@STARTMSG 2189:0 @!@!@
Computing initial states...
@!@!@ENDMSG 2189 @!@!@
@!@!@STARTMSG 2190:0 @!@!@
Finished computing initial states: 1 distinct state generated at 2025-01-19 15:20:04.
@!@!@ENDMSG 2190 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(12) at 2025-01-19 15:20:07: 163.015 states generated (163.015 s/min), 12.588 distinct states found (12.588 ds/min), 7.372 states left on queue.
@!@!@ENDMSG 2200 @!@!@
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737296416956/MC.tla
-50
View File
@@ -1,50 +0,0 @@
---- MODULE MC ----
EXTENDS fullmesh, TLC
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
b1, b2, b3
----
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
s1, s2, s3
----
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
p1, p2
----
\* MV CONSTANT definitions brokers
const_1737296402193120000 ==
{b1, b2, b3}
----
\* MV CONSTANT definitions safekeepers
const_1737296402194121000 ==
{s1, s2, s3}
----
\* MV CONSTANT definitions pageservers
const_1737296402194122000 ==
{p1, p2}
----
\* SYMMETRY definition
symm_1737296402194123000 ==
Permutations(const_1737296402193120000) \union Permutations(const_1737296402194121000) \union Permutations(const_1737296402194122000)
----
\* CONSTANT definitions @modelParameterConstants:4max_commit_lsn
const_1737296402194124000 ==
2
----
\* CONSTRAINT definition @modelParameterContraint:0
constr_1737296402194125000 ==
StateConstraint
----
=============================================================================
\* Modification History
\* Created Sun Jan 19 15:20:02 CET 2025 by cs
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737296416956/MC_TE.out
-38
View File
@@ -1,38 +0,0 @@
@!@!@STARTMSG 2262:0 @!@!@
TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802)
@!@!@ENDMSG 2262 @!@!@
@!@!@STARTMSG 2187:0 @!@!@
Running breadth-first search Model-Checking with fp 60 and seed 6751784514943401101 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 5476] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
@!@!@ENDMSG 2187 @!@!@
@!@!@STARTMSG 2220:0 @!@!@
Starting SANY...
@!@!@ENDMSG 2220 @!@!@
Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/MC.tla
Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/fullmesh.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Semantic processing of module Naturals
Semantic processing of module Integers
Semantic processing of module fullmesh
Semantic processing of module Sequences
Semantic processing of module FiniteSets
Semantic processing of module TLC
Semantic processing of module MC
@!@!@STARTMSG 2219:0 @!@!@
SANY finished.
@!@!@ENDMSG 2219 @!@!@
@!@!@STARTMSG 2185:0 @!@!@
Starting... (2025-01-19 15:20:03)
@!@!@ENDMSG 2185 @!@!@
@!@!@STARTMSG 2189:0 @!@!@
Computing initial states...
@!@!@ENDMSG 2189 @!@!@
@!@!@STARTMSG 2190:0 @!@!@
Finished computing initial states: 1 distinct state generated at 2025-01-19 15:20:04.
@!@!@ENDMSG 2190 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(12) at 2025-01-19 15:20:07: 163.015 states generated (163.015 s/min), 12.588 distinct states found (12.588 ds/min), 7.372 states left on queue.
@!@!@ENDMSG 2200 @!@!@
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737296416956/fullmesh.tla
-85
View File
@@ -1,85 +0,0 @@
---- MODULE fullmesh ----
EXTENDS Integers
VARIABLES broker_state, safekeeper_state, pageserver_state
vars == << broker_state, safekeeper_state, pageserver_state >>
CONSTANT
brokers,
safekeepers,
pageservers
CONSTANT
NULL
CONSTANT
max_commit_lsn
StateConstraint ==
/\ \A s \in safekeepers:
/\ safekeeper_state[s].commit_lsn <= max_commit_lsn
/\ \A b \in brokers:
/\ \A s \in DOMAIN broker_state[b].sk:
/\ broker_state[b].sk[s].commit_lsn <= max_commit_lsn
InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0]
InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]]
InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]]
Init ==
/\ broker_state = [b \in brokers |-> InitBroker]
/\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper]
/\ pageserver_state = [p \in pageservers |-> InitPageserver]
SkCommit(s) ==
/\ safekeeper_state' = [safekeeper_state EXCEPT ![s].commit_lsn = safekeeper_state[s].commit_lsn + 1]
/\ UNCHANGED <<broker_state, pageserver_state>>
SkPushToBroker(s,b) ==
/\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn
THEN
LET
bsk == broker_state[b].sk
updbsk == [bsk EXCEPT ![s].commit_lsn = safekeeper_state[s].commit_lsn]
IN
[broker_state EXCEPT ![b].sk = updbsk]
ELSE broker_state
/\ UNCHANGED <<safekeeper_state, pageserver_state>>
PsRecvBroker(b,p,s) ==
/\ LET
bsk == broker_state[b].sk[s]
psk == pageserver_state[p].sk[s]
updpsk == [psk EXCEPT !["commit_lsn"] = bsk.commit_lsn]
IN
pageserver_state' = IF bsk.commit_lsn > psk.commit_lsn
THEN [pageserver_state EXCEPT ![p].sk[s] = updpsk]
ELSE pageserver_state
/\ UNCHANGED <<safekeeper_state, broker_state>>
SksWithNewerWal(p) ==
LET
ps == pageserver_state[p]
IN
{s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn}
PsChooseSk(p) ==
/\ SksWithNewerWal(p) # {}
/\ pageserver_state' = [pageserver_state EXCEPT![p].preferred_sk = CHOOSE s \in SksWithNewerWal(p): TRUE]
/\ UNCHANGED <<safekeeper_state, broker_state>>
Next ==
\/ \E s \in safekeepers: SkCommit(s)
\/ \E s \in safekeepers: \E b \in brokers: SkPushToBroker(s, b)
\/ \E s \in safekeepers: \E b \in brokers: \E p \in pageservers: PsRecvBroker(b,p,s)
\/ \E p \in pageservers: PsChooseSk(p)
Spec == Init /\ [][Next]_vars
====
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737297534393/MC.cfg
-48
View File
@@ -1,48 +0,0 @@
\* MV CONSTANT declarations
CONSTANTS
b1 = b1
b2 = b2
b3 = b3
\* MV CONSTANT declarations
CONSTANTS
s1 = s1
s2 = s2
s3 = s3
\* MV CONSTANT declarations
CONSTANTS
p1 = p1
p2 = p2
\* MV CONSTANT declarations
CONSTANTS
az1 = az1
az2 = az2
az3 = az3
\* MV CONSTANT definitions
CONSTANT
brokers <- const_1737297530693169000
\* CONSTANT declarations
CONSTANT NULL = NULL
\* MV CONSTANT definitions
CONSTANT
safekeepers <- const_1737297530694170000
\* MV CONSTANT definitions
CONSTANT
pageservers <- const_1737297530694171000
\* MV CONSTANT definitions
CONSTANT
azs <- const_1737297530694172000
\* SYMMETRY definition
SYMMETRY symm_1737297530694173000
\* CONSTANT definitions
CONSTANT
max_commit_lsn <- const_1737297530694174000
\* CONSTANT definitions
CONSTANT
az_mapping <- const_1737297530694175000
\* CONSTRAINT definition
CONSTRAINT
constr_1737297530694176000
\* SPECIFICATION definition
SPECIFICATION
Spec
\* Generated on Sun Jan 19 15:38:50 CET 2025
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737297534393/MC.out
-35
View File
@@ -1,35 +0,0 @@
@!@!@STARTMSG 2262:0 @!@!@
TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802)
@!@!@ENDMSG 2262 @!@!@
@!@!@STARTMSG 2187:0 @!@!@
Running breadth-first search Model-Checking with fp 130 and seed 4267255892797165884 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 6327] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
@!@!@ENDMSG 2187 @!@!@
@!@!@STARTMSG 2220:0 @!@!@
Starting SANY...
@!@!@ENDMSG 2220 @!@!@
Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/MC.tla
Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/fullmesh.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Semantic processing of module Naturals
Semantic processing of module Integers
Semantic processing of module fullmesh
Semantic processing of module Sequences
Semantic processing of module FiniteSets
Semantic processing of module TLC
Semantic processing of module MC
@!@!@STARTMSG 2219:0 @!@!@
SANY finished.
@!@!@ENDMSG 2219 @!@!@
@!@!@STARTMSG 2185:0 @!@!@
Starting... (2025-01-19 15:38:51)
@!@!@ENDMSG 2185 @!@!@
@!@!@STARTMSG 2189:0 @!@!@
Computing initial states...
@!@!@ENDMSG 2189 @!@!@
@!@!@STARTMSG 2190:0 @!@!@
Finished computing initial states: 1 distinct state generated at 2025-01-19 15:38:53.
@!@!@ENDMSG 2190 @!@!@
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737297534393/MC_TE.out
-35
View File
@@ -1,35 +0,0 @@
@!@!@STARTMSG 2262:0 @!@!@
TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802)
@!@!@ENDMSG 2262 @!@!@
@!@!@STARTMSG 2187:0 @!@!@
Running breadth-first search Model-Checking with fp 130 and seed 4267255892797165884 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 6327] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
@!@!@ENDMSG 2187 @!@!@
@!@!@STARTMSG 2220:0 @!@!@
Starting SANY...
@!@!@ENDMSG 2220 @!@!@
Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/MC.tla
Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/fullmesh.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Semantic processing of module Naturals
Semantic processing of module Integers
Semantic processing of module fullmesh
Semantic processing of module Sequences
Semantic processing of module FiniteSets
Semantic processing of module TLC
Semantic processing of module MC
@!@!@STARTMSG 2219:0 @!@!@
SANY finished.
@!@!@ENDMSG 2219 @!@!@
@!@!@STARTMSG 2185:0 @!@!@
Starting... (2025-01-19 15:38:51)
@!@!@ENDMSG 2185 @!@!@
@!@!@STARTMSG 2189:0 @!@!@
Computing initial states...
@!@!@ENDMSG 2189 @!@!@
@!@!@STARTMSG 2190:0 @!@!@
Finished computing initial states: 1 distinct state generated at 2025-01-19 15:38:53.
@!@!@ENDMSG 2190 @!@!@
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737297534393/fullmesh.tla
-91
View File
@@ -1,91 +0,0 @@
---- MODULE fullmesh ----
EXTENDS Integers
VARIABLES broker_state, safekeeper_state, pageserver_state
CONSTANT
brokers,
safekeepers,
pageservers,
azs,
az_mapping
CONSTANT
NULL
CONSTANT
max_commit_lsn
StateConstraint ==
/\ \A s \in safekeepers:
/\ safekeeper_state[s].commit_lsn <= max_commit_lsn
/\ \A b \in brokers:
/\ \A s \in DOMAIN broker_state[b].sk:
/\ broker_state[b].sk[s].commit_lsn <= max_commit_lsn
InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0]
InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]]
InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]]
Init ==
/\ broker_state = [b \in brokers |-> InitBroker]
/\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper]
/\ pageserver_state = [p \in pageservers |-> InitPageserver]
SkCommit(s) ==
/\ safekeeper_state' = [safekeeper_state EXCEPT ![s].commit_lsn = safekeeper_state[s].commit_lsn + 1]
/\ UNCHANGED <<broker_state, pageserver_state>>
SkPushToBroker(s,b) ==
/\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn
THEN
LET
bsk == broker_state[b].sk
updbsk == [bsk EXCEPT ![s].commit_lsn = safekeeper_state[s].commit_lsn]
IN
[broker_state EXCEPT ![b].sk = updbsk]
ELSE broker_state
/\ UNCHANGED <<safekeeper_state, pageserver_state>>
PsRecvBroker(b,p,s) ==
/\ LET
bsk == broker_state[b].sk[s]
psk == pageserver_state[p].sk[s]
updpsk == [psk EXCEPT !["commit_lsn"] = bsk.commit_lsn]
IN
pageserver_state' = IF bsk.commit_lsn > psk.commit_lsn
THEN [pageserver_state EXCEPT ![p].sk[s] = updpsk]
ELSE pageserver_state
/\ UNCHANGED <<safekeeper_state, broker_state>>
SksWithNewerWal(p) ==
LET
ps == pageserver_state[p]
IN
{s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn}
PsChooseSk(p) ==
/\ SksWithNewerWal(p) # {}
/\ pageserver_state' = [pageserver_state EXCEPT![p].preferred_sk = CHOOSE s \in SksWithNewerWal(p): TRUE]
/\ UNCHANGED <<safekeeper_state, broker_state>>
Next ==
\/ \E s \in safekeepers: SkCommit(s)
\/ \E s \in safekeepers: \E b \in brokers: SkPushToBroker(s, b)
\/ \E s \in safekeepers: \E b \in brokers: \E p \in pageservers: PsRecvBroker(b,p,s)
\/ \E p \in pageservers: PsChooseSk(p)
Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state >>
\* invariants
====
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737297999722/MC.cfg
-48
View File
@@ -1,48 +0,0 @@
\* MV CONSTANT declarations
CONSTANTS
b1 = b1
b2 = b2
b3 = b3
\* MV CONSTANT declarations
CONSTANTS
s1 = s1
s2 = s2
s3 = s3
\* MV CONSTANT declarations
CONSTANTS
p1 = p1
p2 = p2
\* MV CONSTANT declarations
CONSTANTS
az1 = az1
az2 = az2
az3 = az3
\* MV CONSTANT definitions
CONSTANT
brokers <- const_1737297992949177000
\* CONSTANT declarations
CONSTANT NULL = NULL
\* MV CONSTANT definitions
CONSTANT
safekeepers <- const_1737297992949178000
\* MV CONSTANT definitions
CONSTANT
pageservers <- const_1737297992949179000
\* MV CONSTANT definitions
CONSTANT
azs <- const_1737297992949180000
\* SYMMETRY definition
SYMMETRY symm_1737297992949181000
\* CONSTANT definitions
CONSTANT
max_commit_lsn <- const_1737297992949182000
\* CONSTANT definitions
CONSTANT
az_mapping <- const_1737297992949183000
\* CONSTRAINT definition
CONSTRAINT
constr_1737297992949184000
\* SPECIFICATION definition
SPECIFICATION
Spec
\* Generated on Sun Jan 19 15:46:32 CET 2025
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737297999722/MC.out
-38
View File
@@ -1,38 +0,0 @@
@!@!@STARTMSG 2262:0 @!@!@
TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802)
@!@!@ENDMSG 2262 @!@!@
@!@!@STARTMSG 2187:0 @!@!@
Running breadth-first search Model-Checking with fp 0 and seed -5924036830053169413 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 6690] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
@!@!@ENDMSG 2187 @!@!@
@!@!@STARTMSG 2220:0 @!@!@
Starting SANY...
@!@!@ENDMSG 2220 @!@!@
Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/MC.tla
Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/fullmesh.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Semantic processing of module Naturals
Semantic processing of module Integers
Semantic processing of module fullmesh
Semantic processing of module Sequences
Semantic processing of module FiniteSets
Semantic processing of module TLC
Semantic processing of module MC
@!@!@STARTMSG 2219:0 @!@!@
SANY finished.
@!@!@ENDMSG 2219 @!@!@
@!@!@STARTMSG 2185:0 @!@!@
Starting... (2025-01-19 15:46:33)
@!@!@ENDMSG 2185 @!@!@
@!@!@STARTMSG 2189:0 @!@!@
Computing initial states...
@!@!@ENDMSG 2189 @!@!@
@!@!@STARTMSG 2190:0 @!@!@
Finished computing initial states: 1 distinct state generated at 2025-01-19 15:46:35.
@!@!@ENDMSG 2190 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(10) at 2025-01-19 15:46:38: 41.300 states generated (41.300 s/min), 3.445 distinct states found (3.445 ds/min), 2.202 states left on queue.
@!@!@ENDMSG 2200 @!@!@
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737297999722/MC.tla
-65
View File
@@ -1,65 +0,0 @@
---- MODULE MC ----
EXTENDS fullmesh, TLC
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
b1, b2, b3
----
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
s1, s2, s3
----
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
p1, p2
----
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
az1, az2, az3
----
\* MV CONSTANT definitions brokers
const_1737297992949177000 ==
{b1, b2, b3}
----
\* MV CONSTANT definitions safekeepers
const_1737297992949178000 ==
{s1, s2, s3}
----
\* MV CONSTANT definitions pageservers
const_1737297992949179000 ==
{p1, p2}
----
\* MV CONSTANT definitions azs
const_1737297992949180000 ==
{az1, az2, az3}
----
\* SYMMETRY definition
symm_1737297992949181000 ==
Permutations(const_1737297992949177000) \union Permutations(const_1737297992949178000) \union Permutations(const_1737297992949179000) \union Permutations(const_1737297992949180000)
----
\* CONSTANT definitions @modelParameterConstants:4max_commit_lsn
const_1737297992949182000 ==
2
----
\* CONSTANT definitions @modelParameterConstants:5az_mapping
const_1737297992949183000 ==
[ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2,p2} , az3 |-> {b3,s3}]
----
\* CONSTRAINT definition @modelParameterContraint:0
constr_1737297992949184000 ==
StateConstraint
----
=============================================================================
\* Modification History
\* Created Sun Jan 19 15:46:32 CET 2025 by cs
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737297999722/MC_TE.out
-38
View File
@@ -1,38 +0,0 @@
@!@!@STARTMSG 2262:0 @!@!@
TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802)
@!@!@ENDMSG 2262 @!@!@
@!@!@STARTMSG 2187:0 @!@!@
Running breadth-first search Model-Checking with fp 0 and seed -5924036830053169413 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 6690] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
@!@!@ENDMSG 2187 @!@!@
@!@!@STARTMSG 2220:0 @!@!@
Starting SANY...
@!@!@ENDMSG 2220 @!@!@
Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/MC.tla
Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/fullmesh.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Semantic processing of module Naturals
Semantic processing of module Integers
Semantic processing of module fullmesh
Semantic processing of module Sequences
Semantic processing of module FiniteSets
Semantic processing of module TLC
Semantic processing of module MC
@!@!@STARTMSG 2219:0 @!@!@
SANY finished.
@!@!@ENDMSG 2219 @!@!@
@!@!@STARTMSG 2185:0 @!@!@
Starting... (2025-01-19 15:46:33)
@!@!@ENDMSG 2185 @!@!@
@!@!@STARTMSG 2189:0 @!@!@
Computing initial states...
@!@!@ENDMSG 2189 @!@!@
@!@!@STARTMSG 2190:0 @!@!@
Finished computing initial states: 1 distinct state generated at 2025-01-19 15:46:35.
@!@!@ENDMSG 2190 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(10) at 2025-01-19 15:46:38: 41.300 states generated (41.300 s/min), 3.445 distinct states found (3.445 ds/min), 2.202 states left on queue.
@!@!@ENDMSG 2200 @!@!@
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737297999722/fullmesh.tla
-97
View File
@@ -1,97 +0,0 @@
---- MODULE fullmesh ----
EXTENDS Integers
VARIABLES broker_state, safekeeper_state, pageserver_state
CONSTANT
brokers,
safekeepers,
pageservers,
azs,
az_mapping
CONSTANT
NULL
CONSTANT
max_commit_lsn
StateConstraint ==
/\ \A s \in safekeepers:
/\ safekeeper_state[s].commit_lsn <= max_commit_lsn
/\ \A b \in brokers:
/\ \A s \in DOMAIN broker_state[b].sk:
/\ broker_state[b].sk[s].commit_lsn <= max_commit_lsn
InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0]
InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]]
InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]]
Init ==
/\ broker_state = [b \in brokers |-> InitBroker]
/\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper]
/\ pageserver_state = [p \in pageservers |-> InitPageserver]
SkCommit(s1, s2) ==
/\ safekeeper_state[s1].commit_lsn = safekeeper_state[s2].commit_lsn
/\ LET
new_commit_lsn == safekeeper_state[s1].commit_lsn + 1
IN
safekeeper_state' = [safekeeper_state EXCEPT
![s1].commit_lsn = new_commit_lsn,
![s2].commit_lsn = new_commit_lsn]
/\ UNCHANGED <<broker_state, pageserver_state>>
SkPushToBroker(s,b) ==
/\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn
THEN
LET
bsk == broker_state[b].sk
updbsk == [bsk EXCEPT ![s].commit_lsn = safekeeper_state[s].commit_lsn]
IN
[broker_state EXCEPT ![b].sk = updbsk]
ELSE broker_state
/\ UNCHANGED <<safekeeper_state, pageserver_state>>
PsRecvBroker(b,p,s) ==
/\ LET
bsk == broker_state[b].sk[s]
psk == pageserver_state[p].sk[s]
updpsk == [psk EXCEPT !["commit_lsn"] = bsk.commit_lsn]
IN
pageserver_state' = IF bsk.commit_lsn > psk.commit_lsn
THEN [pageserver_state EXCEPT ![p].sk[s] = updpsk]
ELSE pageserver_state
/\ UNCHANGED <<safekeeper_state, broker_state>>
SksWithNewerWal(p) ==
LET
ps == pageserver_state[p]
IN
{s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn}
PsChooseSk(p) ==
/\ SksWithNewerWal(p) # {}
/\ pageserver_state' = [pageserver_state EXCEPT![p].preferred_sk = CHOOSE s \in SksWithNewerWal(p): TRUE]
/\ UNCHANGED <<safekeeper_state, broker_state>>
Next ==
\/ \E s1 \in safekeepers: \E s2 \in safekeepers: SkCommit(s1, s2)
\/ \E s \in safekeepers: \E b \in brokers: SkPushToBroker(s, b)
\/ \E s \in safekeepers: \E b \in brokers: \E p \in pageservers: PsRecvBroker(b,p,s)
\/ \E p \in pageservers: PsChooseSk(p)
Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state >>
\* invariants
====
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299352762/fullmesh.tla
-115
View File
@@ -1,115 +0,0 @@
---- MODULE fullmesh ----
EXTENDS Integers
VARIABLES broker_state, safekeeper_state, pageserver_state
CONSTANT
brokers,
safekeepers,
pageservers,
azs,
az_mapping
CONSTANT
NULL
CONSTANT
max_commit_lsn
StateConstraint ==
/\ \A s \in safekeepers:
/\ safekeeper_state[s].commit_lsn <= max_commit_lsn
/\ \A b \in brokers:
/\ \A s \in DOMAIN broker_state[b].sk:
/\ broker_state[b].sk[s].commit_lsn <= max_commit_lsn
InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0]
InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]]
InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]]
Init ==
/\ broker_state = [b \in brokers |-> InitBroker]
/\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper]
/\ pageserver_state = [p \in pageservers |-> InitPageserver]
SkCommit(s1, s2) ==
/\ safekeeper_state[s1].commit_lsn = safekeeper_state[s2].commit_lsn
/\ LET
new_commit_lsn == safekeeper_state[s1].commit_lsn + 1
IN
safekeeper_state' = [safekeeper_state EXCEPT
![s1].commit_lsn = new_commit_lsn,
![s2].commit_lsn = new_commit_lsn]
/\ UNCHANGED <<broker_state, pageserver_state>>
SkPeerRecovery(s1,s2) ==
/\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn
/\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn]
SkPushToBroker(s,b) ==
/\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn
THEN
LET
bsk == broker_state[b].sk
updbsk == [bsk EXCEPT ![s].commit_lsn = safekeeper_state[s].commit_lsn]
IN
[broker_state EXCEPT ![b].sk = updbsk]
ELSE broker_state
/\ UNCHANGED <<safekeeper_state, pageserver_state>>
PsRecvBroker(b,p,s) ==
/\ LET
bsk == broker_state[b].sk[s]
psk == pageserver_state[p].sk[s]
updpsk == [psk EXCEPT !["commit_lsn"] = bsk.commit_lsn]
IN
pageserver_state' = IF bsk.commit_lsn > psk.commit_lsn
THEN [pageserver_state EXCEPT ![p].sk[s] = updpsk]
ELSE pageserver_state
/\ UNCHANGED <<safekeeper_state, broker_state>>
SksWithNewerWal(p) ==
LET
ps == pageserver_state[p]
IN
{s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn}
PsChooseSk(p) ==
/\ SksWithNewerWal(p) # {}
/\ pageserver_state' = [pageserver_state EXCEPT![p].preferred_sk = CHOOSE s \in SksWithNewerWal(p): TRUE]
/\ UNCHANGED <<safekeeper_state, broker_state>>
Next ==
\/ \E s1 \in safekeepers: \E s2 \in safekeepers:
\/ SkCommit(s1, s2)
\/ SkPeerRecovery(s1, s2)
\/ \E s \in safekeepers: \E b \in brokers: SkPushToBroker(s, b)
\/ \E s \in safekeepers: \E b \in brokers: \E p \in pageservers: PsRecvBroker(b,p,s)
\/ \E p \in pageservers: PsChooseSk(p)
Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state >>
\* invariants
EventuallyLaggingSkIsNotPreferredSk == <>(
LET
sks == safekeeper_state
lagging_sks == { s \in safekeepers: \A s2 \in safekeepers: sks[s].commit_lsn <= sks[s2].commit_lsn }
preferred_sks == {pageserver_state[p].preferred_sk: p \in pageservers}
IN
preferred_sks \cap lagging_sks = {}
)
====
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299381423/MC.tla
-65
View File
@@ -1,65 +0,0 @@
---- MODULE MC ----
EXTENDS fullmesh, TLC
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
b1, b2, b3
----
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
s1, s2, s3
----
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
p1, p2
----
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
az1, az2, az3
----
\* MV CONSTANT definitions brokers
const_1737299377376212000 ==
{b1, b2, b3}
----
\* MV CONSTANT definitions safekeepers
const_1737299377376213000 ==
{s1, s2, s3}
----
\* MV CONSTANT definitions pageservers
const_1737299377376214000 ==
{p1, p2}
----
\* MV CONSTANT definitions azs
const_1737299377376215000 ==
{az1, az2, az3}
----
\* SYMMETRY definition
symm_1737299377376216000 ==
Permutations(const_1737299377376212000) \union Permutations(const_1737299377376213000) \union Permutations(const_1737299377376214000) \union Permutations(const_1737299377376215000)
----
\* CONSTANT definitions @modelParameterConstants:4max_commit_lsn
const_1737299377376217000 ==
2
----
\* CONSTANT definitions @modelParameterConstants:5az_mapping
const_1737299377376218000 ==
[ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2,p2} , az3 |-> {b3,s3}]
----
\* CONSTRAINT definition @modelParameterContraint:0
constr_1737299377376219000 ==
StateConstraint
----
=============================================================================
\* Modification History
\* Created Sun Jan 19 16:09:37 CET 2025 by cs
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299381423/fullmesh.tla
-115
View File
@@ -1,115 +0,0 @@
---- MODULE fullmesh ----
EXTENDS Integers
VARIABLES broker_state, safekeeper_state, pageserver_state
CONSTANT
brokers,
safekeepers,
pageservers,
azs,
az_mapping
CONSTANT
NULL
CONSTANT
max_commit_lsn
StateConstraint ==
/\ \A s \in safekeepers:
/\ safekeeper_state[s].commit_lsn <= max_commit_lsn
/\ \A b \in brokers:
/\ \A s \in DOMAIN broker_state[b].sk:
/\ broker_state[b].sk[s].commit_lsn <= max_commit_lsn
InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0]
InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]]
InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]]
Init ==
/\ broker_state = [b \in brokers |-> InitBroker]
/\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper]
/\ pageserver_state = [p \in pageservers |-> InitPageserver]
SkCommit(s1, s2) ==
/\ safekeeper_state[s1].commit_lsn = safekeeper_state[s2].commit_lsn
/\ LET
new_commit_lsn == safekeeper_state[s1].commit_lsn + 1
IN
safekeeper_state' = [safekeeper_state EXCEPT
![s1].commit_lsn = new_commit_lsn,
![s2].commit_lsn = new_commit_lsn]
/\ UNCHANGED <<broker_state, pageserver_state>>
SkPeerRecovery(s1,s2) ==
/\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn
/\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn]
SkPushToBroker(s,b) ==
/\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn
THEN
LET
bsk == broker_state[b].sk
updbsk == [bsk EXCEPT ![s].commit_lsn = safekeeper_state[s].commit_lsn]
IN
[broker_state EXCEPT ![b].sk = updbsk]
ELSE broker_state
/\ UNCHANGED <<safekeeper_state, pageserver_state>>
PsRecvBroker(b,p,s) ==
/\ LET
bsk == broker_state[b].sk[s]
psk == pageserver_state[p].sk[s]
updpsk == [psk EXCEPT !["commit_lsn"] = bsk.commit_lsn]
IN
pageserver_state' = IF bsk.commit_lsn > psk.commit_lsn
THEN [pageserver_state EXCEPT ![p].sk[s] = updpsk]
ELSE pageserver_state
/\ UNCHANGED <<safekeeper_state, broker_state>>
SksWithNewerWal(p) ==
LET
ps == pageserver_state[p]
IN
{s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn}
PsChooseSk(p) ==
/\ SksWithNewerWal(p) # {}
/\ pageserver_state' = [pageserver_state EXCEPT![p].preferred_sk = CHOOSE s \in SksWithNewerWal(p): TRUE]
/\ UNCHANGED <<safekeeper_state, broker_state>>
Next ==
\/ \E s1 \in safekeepers: \E s2 \in safekeepers:
\/ SkCommit(s1, s2)
\/ SkPeerRecovery(s1, s2)
\/ \E s \in safekeepers: \E b \in brokers: SkPushToBroker(s, b)
\/ \E s \in safekeepers: \E b \in brokers: \E p \in pageservers: PsRecvBroker(b,p,s)
\/ \E p \in pageservers: PsChooseSk(p)
Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state >>
\* invariants
EventuallyLaggingSkIsNotPreferredSk == <>(
LET
sks == safekeeper_state
lagging_sks == { s \in safekeepers: \A s2 \in safekeepers: sks[s].commit_lsn <= sks[s2].commit_lsn }
preferred_sks == {pageserver_state[p].preferred_sk: p \in pageservers}
IN
preferred_sks \cap lagging_sks = {}
)
====
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299469039/MC.out
-202
View File
@@ -1,202 +0,0 @@
@!@!@STARTMSG 2262:0 @!@!@
TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802)
@!@!@ENDMSG 2262 @!@!@
@!@!@STARTMSG 2187:0 @!@!@
Running breadth-first search Model-Checking with fp 105 and seed 4277674636266930199 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 7749] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
@!@!@ENDMSG 2187 @!@!@
@!@!@STARTMSG 2220:0 @!@!@
Starting SANY...
@!@!@ENDMSG 2220 @!@!@
Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/MC.tla
Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/fullmesh.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Semantic processing of module Naturals
Semantic processing of module Integers
Semantic processing of module fullmesh
Semantic processing of module Sequences
Semantic processing of module FiniteSets
Semantic processing of module TLC
Semantic processing of module MC
@!@!@STARTMSG 2219:0 @!@!@
SANY finished.
@!@!@ENDMSG 2219 @!@!@
@!@!@STARTMSG 2185:0 @!@!@
Starting... (2025-01-19 16:11:06)
@!@!@ENDMSG 2185 @!@!@
@!@!@STARTMSG 2279:3 @!@!@
Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined.
@!@!@ENDMSG 2279 @!@!@
@!@!@STARTMSG 2284:3 @!@!@
Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details.
@!@!@ENDMSG 2284 @!@!@
@!@!@STARTMSG 2212:0 @!@!@
Implied-temporal checking--satisfiability problem has 1 branches.
@!@!@ENDMSG 2212 @!@!@
@!@!@STARTMSG 2189:0 @!@!@
Computing initial states...
@!@!@ENDMSG 2189 @!@!@
@!@!@STARTMSG 2190:0 @!@!@
Finished computing initial states: 1 distinct state generated at 2025-01-19 16:11:07.
@!@!@ENDMSG 2190 @!@!@
@!@!@STARTMSG 2109:1 @!@!@
Successor state is not completely specified by action SkPeerRecovery of the next-state relation. The following variables are not assigned: broker_state, pageserver_state.
@!@!@ENDMSG 2109 @!@!@
@!@!@STARTMSG 2121:1 @!@!@
The behavior up to this point is:
@!@!@ENDMSG 2121 @!@!@
@!@!@STARTMSG 2217:4 @!@!@
1: <Initial predicate>
/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL])
/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])])
/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0])
@!@!@ENDMSG 2217 @!@!@
@!@!@STARTMSG 2217:4 @!@!@
2: <SkCommit line 40, col 5 to line 48, col 51 of module fullmesh>
/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL])
/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])])
/\ safekeeper_state = (s1 :> [commit_lsn |-> 1, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 1, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0])
@!@!@ENDMSG 2217 @!@!@
@!@!@STARTMSG 2217:4 @!@!@
3: <SkCommit line 40, col 5 to line 48, col 51 of module fullmesh>
/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL])
/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])])
/\ safekeeper_state = (s1 :> [commit_lsn |-> 2, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 2, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0])
@!@!@ENDMSG 2217 @!@!@
@!@!@STARTMSG 2217:4 @!@!@
4: <SkPeerRecovery line 51, col 5 to line 52, col 102 of module fullmesh>
/\ pageserver_state = null
/\ broker_state = null
/\ safekeeper_state = (s1 :> [commit_lsn |-> 2, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 2, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 2, pruned_lsn |-> 0])
@!@!@ENDMSG 2217 @!@!@
@!@!@STARTMSG 2201:0 @!@!@
The coverage statistics at 2025-01-19 16:11:07
@!@!@ENDMSG 2201 @!@!@
@!@!@STARTMSG 2773:0 @!@!@
<Init line 33, col 1 to line 33, col 4 of module fullmesh>: 2:2
@!@!@ENDMSG 2773 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 34, col 5 to line 36, col 64 of module fullmesh: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkCommit line 39, col 1 to line 39, col 16 of module fullmesh>: 2:14
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 40, col 8 to line 40, col 14 of module fullmesh: 48
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 40, col 8 to line 40, col 9 of module fullmesh: 34
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 40, col 13 to line 40, col 14 of module fullmesh: 34
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 41, col 8 to line 41, col 72 of module fullmesh: 37
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 41, col 8 to line 41, col 38 of module fullmesh: 23
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 41, col 42 to line 41, col 72 of module fullmesh: 23
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 45, col 13 to line 47, col 50 of module fullmesh: 14
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 48, col 8 to line 48, col 51 of module fullmesh: 14
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkPeerRecovery line 50, col 1 to line 50, col 21 of module fullmesh>: 0:3
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 51, col 8 to line 51, col 72 of module fullmesh: 1
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 51, col 8 to line 51, col 38 of module fullmesh: 32
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 51, col 42 to line 51, col 72 of module fullmesh: 32
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 52, col 8 to line 52, col 102 of module fullmesh: 1
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 52, col 28 to line 52, col 102 of module fullmesh: 3
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkPushToBroker line 54, col 1 to line 54, col 19 of module fullmesh>: 0:9
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 55, col 8 to line 62, col 29 of module fullmesh: 9
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 63, col 8 to line 63, col 55 of module fullmesh: 9
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<PsRecvBroker line 65, col 1 to line 65, col 19 of module fullmesh>: 0:18
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 71, col 13 to line 73, col 37 of module fullmesh: 18
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 74, col 8 to line 74, col 51 of module fullmesh: 18
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<PsChooseSk line 83, col 1 to line 83, col 13 of module fullmesh>: 0:0
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 84, col 8 to line 84, col 30 of module fullmesh: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 84, col 8 to line 84, col 25 of module fullmesh: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 79, col 15 to line 79, col 33 of module fullmesh: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 81, col 5 to line 81, col 66 of module fullmesh: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 81, col 26 to line 81, col 65 of module fullmesh: 6
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 81, col 12 to line 81, col 23 of module fullmesh: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 84, col 24 to line 84, col 24 of module fullmesh: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 84, col 29 to line 84, col 30 of module fullmesh: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 85, col 8 to line 85, col 109 of module fullmesh: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 86, col 8 to line 86, col 51 of module fullmesh: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2202:0 @!@!@
End of statistics.
@!@!@ENDMSG 2202 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(3) at 2025-01-19 16:11:07: 40 states generated (992 s/min), 3 distinct states found (74 ds/min), 0 states left on queue.
@!@!@ENDMSG 2200 @!@!@
@!@!@STARTMSG 2199:0 @!@!@
40 states generated, 3 distinct states found, 0 states left on queue.
@!@!@ENDMSG 2199 @!@!@
@!@!@STARTMSG 2194:0 @!@!@
The depth of the complete state graph search is 3.
@!@!@ENDMSG 2194 @!@!@
@!@!@STARTMSG 2268:0 @!@!@
The average outdegree of the complete state graph is 1 (minimum is 1, the maximum 1 and the 95th percentile is 1).
@!@!@ENDMSG 2268 @!@!@
@!@!@STARTMSG 2186:0 @!@!@
Finished in 2440ms at (2025-01-19 16:11:07)
@!@!@ENDMSG 2186 @!@!@
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299469039/MC.tla
-65
View File
@@ -1,65 +0,0 @@
---- MODULE MC ----
EXTENDS fullmesh, TLC
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
b1, b2, b3
----
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
s1, s2, s3
----
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
p1, p2
----
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
az1, az2, az3
----
\* MV CONSTANT definitions brokers
const_1737299464992221000 ==
{b1, b2, b3}
----
\* MV CONSTANT definitions safekeepers
const_1737299464992222000 ==
{s1, s2, s3}
----
\* MV CONSTANT definitions pageservers
const_1737299464992223000 ==
{p1, p2}
----
\* MV CONSTANT definitions azs
const_1737299464992224000 ==
{az1, az2, az3}
----
\* SYMMETRY definition
symm_1737299464992225000 ==
Permutations(const_1737299464992221000) \union Permutations(const_1737299464992222000) \union Permutations(const_1737299464992223000) \union Permutations(const_1737299464992224000)
----
\* CONSTANT definitions @modelParameterConstants:4max_commit_lsn
const_1737299464992226000 ==
2
----
\* CONSTANT definitions @modelParameterConstants:5az_mapping
const_1737299464992227000 ==
[ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2,p2} , az3 |-> {b3,s3}]
----
\* CONSTRAINT definition @modelParameterContraint:0
constr_1737299464992228000 ==
StateConstraint
----
=============================================================================
\* Modification History
\* Created Sun Jan 19 16:11:04 CET 2025 by cs
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299469039/MC_TE.out
-202
View File
@@ -1,202 +0,0 @@
@!@!@STARTMSG 2262:0 @!@!@
TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802)
@!@!@ENDMSG 2262 @!@!@
@!@!@STARTMSG 2187:0 @!@!@
Running breadth-first search Model-Checking with fp 105 and seed 4277674636266930199 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 7749] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
@!@!@ENDMSG 2187 @!@!@
@!@!@STARTMSG 2220:0 @!@!@
Starting SANY...
@!@!@ENDMSG 2220 @!@!@
Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/MC.tla
Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/fullmesh.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Semantic processing of module Naturals
Semantic processing of module Integers
Semantic processing of module fullmesh
Semantic processing of module Sequences
Semantic processing of module FiniteSets
Semantic processing of module TLC
Semantic processing of module MC
@!@!@STARTMSG 2219:0 @!@!@
SANY finished.
@!@!@ENDMSG 2219 @!@!@
@!@!@STARTMSG 2185:0 @!@!@
Starting... (2025-01-19 16:11:06)
@!@!@ENDMSG 2185 @!@!@
@!@!@STARTMSG 2279:3 @!@!@
Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined.
@!@!@ENDMSG 2279 @!@!@
@!@!@STARTMSG 2284:3 @!@!@
Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details.
@!@!@ENDMSG 2284 @!@!@
@!@!@STARTMSG 2212:0 @!@!@
Implied-temporal checking--satisfiability problem has 1 branches.
@!@!@ENDMSG 2212 @!@!@
@!@!@STARTMSG 2189:0 @!@!@
Computing initial states...
@!@!@ENDMSG 2189 @!@!@
@!@!@STARTMSG 2190:0 @!@!@
Finished computing initial states: 1 distinct state generated at 2025-01-19 16:11:07.
@!@!@ENDMSG 2190 @!@!@
@!@!@STARTMSG 2109:1 @!@!@
Successor state is not completely specified by action SkPeerRecovery of the next-state relation. The following variables are not assigned: broker_state, pageserver_state.
@!@!@ENDMSG 2109 @!@!@
@!@!@STARTMSG 2121:1 @!@!@
The behavior up to this point is:
@!@!@ENDMSG 2121 @!@!@
@!@!@STARTMSG 2217:4 @!@!@
1: <Initial predicate>
/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL])
/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])])
/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0])
@!@!@ENDMSG 2217 @!@!@
@!@!@STARTMSG 2217:4 @!@!@
2: <SkCommit line 40, col 5 to line 48, col 51 of module fullmesh>
/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL])
/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])])
/\ safekeeper_state = (s1 :> [commit_lsn |-> 1, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 1, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0])
@!@!@ENDMSG 2217 @!@!@
@!@!@STARTMSG 2217:4 @!@!@
3: <SkCommit line 40, col 5 to line 48, col 51 of module fullmesh>
/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL])
/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])])
/\ safekeeper_state = (s1 :> [commit_lsn |-> 2, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 2, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0])
@!@!@ENDMSG 2217 @!@!@
@!@!@STARTMSG 2217:4 @!@!@
4: <SkPeerRecovery line 51, col 5 to line 52, col 102 of module fullmesh>
/\ pageserver_state = null
/\ broker_state = null
/\ safekeeper_state = (s1 :> [commit_lsn |-> 2, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 2, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 2, pruned_lsn |-> 0])
@!@!@ENDMSG 2217 @!@!@
@!@!@STARTMSG 2201:0 @!@!@
The coverage statistics at 2025-01-19 16:11:07
@!@!@ENDMSG 2201 @!@!@
@!@!@STARTMSG 2773:0 @!@!@
<Init line 33, col 1 to line 33, col 4 of module fullmesh>: 2:2
@!@!@ENDMSG 2773 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 34, col 5 to line 36, col 64 of module fullmesh: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkCommit line 39, col 1 to line 39, col 16 of module fullmesh>: 2:14
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 40, col 8 to line 40, col 14 of module fullmesh: 48
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 40, col 8 to line 40, col 9 of module fullmesh: 34
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 40, col 13 to line 40, col 14 of module fullmesh: 34
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 41, col 8 to line 41, col 72 of module fullmesh: 37
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 41, col 8 to line 41, col 38 of module fullmesh: 23
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 41, col 42 to line 41, col 72 of module fullmesh: 23
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 45, col 13 to line 47, col 50 of module fullmesh: 14
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 48, col 8 to line 48, col 51 of module fullmesh: 14
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkPeerRecovery line 50, col 1 to line 50, col 21 of module fullmesh>: 0:3
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 51, col 8 to line 51, col 72 of module fullmesh: 1
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 51, col 8 to line 51, col 38 of module fullmesh: 32
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 51, col 42 to line 51, col 72 of module fullmesh: 32
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 52, col 8 to line 52, col 102 of module fullmesh: 1
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 52, col 28 to line 52, col 102 of module fullmesh: 3
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkPushToBroker line 54, col 1 to line 54, col 19 of module fullmesh>: 0:9
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 55, col 8 to line 62, col 29 of module fullmesh: 9
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 63, col 8 to line 63, col 55 of module fullmesh: 9
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<PsRecvBroker line 65, col 1 to line 65, col 19 of module fullmesh>: 0:18
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 71, col 13 to line 73, col 37 of module fullmesh: 18
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 74, col 8 to line 74, col 51 of module fullmesh: 18
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<PsChooseSk line 83, col 1 to line 83, col 13 of module fullmesh>: 0:0
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 84, col 8 to line 84, col 30 of module fullmesh: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 84, col 8 to line 84, col 25 of module fullmesh: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 79, col 15 to line 79, col 33 of module fullmesh: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 81, col 5 to line 81, col 66 of module fullmesh: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 81, col 26 to line 81, col 65 of module fullmesh: 6
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 81, col 12 to line 81, col 23 of module fullmesh: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 84, col 24 to line 84, col 24 of module fullmesh: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 84, col 29 to line 84, col 30 of module fullmesh: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 85, col 8 to line 85, col 109 of module fullmesh: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 86, col 8 to line 86, col 51 of module fullmesh: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2202:0 @!@!@
End of statistics.
@!@!@ENDMSG 2202 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(3) at 2025-01-19 16:11:07: 40 states generated (992 s/min), 3 distinct states found (74 ds/min), 0 states left on queue.
@!@!@ENDMSG 2200 @!@!@
@!@!@STARTMSG 2199:0 @!@!@
40 states generated, 3 distinct states found, 0 states left on queue.
@!@!@ENDMSG 2199 @!@!@
@!@!@STARTMSG 2194:0 @!@!@
The depth of the complete state graph search is 3.
@!@!@ENDMSG 2194 @!@!@
@!@!@STARTMSG 2268:0 @!@!@
The average outdegree of the complete state graph is 1 (minimum is 1, the maximum 1 and the 95th percentile is 1).
@!@!@ENDMSG 2268 @!@!@
@!@!@STARTMSG 2186:0 @!@!@
Finished in 2440ms at (2025-01-19 16:11:07)
@!@!@ENDMSG 2186 @!@!@
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299542008/MC.out
-57
View File
@@ -1,57 +0,0 @@
@!@!@STARTMSG 2262:0 @!@!@
TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802)
@!@!@ENDMSG 2262 @!@!@
@!@!@STARTMSG 2187:0 @!@!@
Running breadth-first search Model-Checking with fp 90 and seed -131482239732531000 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 7787] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
@!@!@ENDMSG 2187 @!@!@
@!@!@STARTMSG 2220:0 @!@!@
Starting SANY...
@!@!@ENDMSG 2220 @!@!@
Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/MC.tla
Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/fullmesh.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Semantic processing of module Naturals
Semantic processing of module Integers
Semantic processing of module fullmesh
Semantic processing of module Sequences
Semantic processing of module FiniteSets
Semantic processing of module TLC
Semantic processing of module MC
@!@!@STARTMSG 2219:0 @!@!@
SANY finished.
@!@!@ENDMSG 2219 @!@!@
@!@!@STARTMSG 2185:0 @!@!@
Starting... (2025-01-19 16:12:09)
@!@!@ENDMSG 2185 @!@!@
@!@!@STARTMSG 2279:3 @!@!@
Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined.
@!@!@ENDMSG 2279 @!@!@
@!@!@STARTMSG 2284:3 @!@!@
Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details.
@!@!@ENDMSG 2284 @!@!@
@!@!@STARTMSG 2212:0 @!@!@
Implied-temporal checking--satisfiability problem has 1 branches.
@!@!@ENDMSG 2212 @!@!@
@!@!@STARTMSG 2189:0 @!@!@
Computing initial states...
@!@!@ENDMSG 2189 @!@!@
@!@!@STARTMSG 2190:0 @!@!@
Finished computing initial states: 1 distinct state generated at 2025-01-19 16:12:10.
@!@!@ENDMSG 2190 @!@!@
@!@!@STARTMSG 2143:3 @!@!@
The variable safekeeper_state was changed while it is specified as UNCHANGED at
line 53, col 34 to line 53, col 49 of module fullmesh
@!@!@ENDMSG 2143 @!@!@
@!@!@STARTMSG 2192:0 @!@!@
Checking temporal properties for the current state space with 1454 total distinct states at (2025-01-19 16:12:13)
@!@!@ENDMSG 2192 @!@!@
@!@!@STARTMSG 2267:0 @!@!@
Finished checking temporal properties in 00s at 2025-01-19 16:12:13
@!@!@ENDMSG 2267 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(11) at 2025-01-19 16:12:13: 44.264 states generated (44.264 s/min), 2.994 distinct states found (2.994 ds/min), 1.536 states left on queue.
@!@!@ENDMSG 2200 @!@!@
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299542008/MC.tla
-65
View File
@@ -1,65 +0,0 @@
---- MODULE MC ----
EXTENDS fullmesh, TLC
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
b1, b2, b3
----
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
s1, s2, s3
----
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
p1, p2
----
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
az1, az2, az3
----
\* MV CONSTANT definitions brokers
const_1737299528165230000 ==
{b1, b2, b3}
----
\* MV CONSTANT definitions safekeepers
const_1737299528166231000 ==
{s1, s2, s3}
----
\* MV CONSTANT definitions pageservers
const_1737299528166232000 ==
{p1, p2}
----
\* MV CONSTANT definitions azs
const_1737299528166233000 ==
{az1, az2, az3}
----
\* SYMMETRY definition
symm_1737299528166234000 ==
Permutations(const_1737299528165230000) \union Permutations(const_1737299528166231000) \union Permutations(const_1737299528166232000) \union Permutations(const_1737299528166233000)
----
\* CONSTANT definitions @modelParameterConstants:4max_commit_lsn
const_1737299528166235000 ==
2
----
\* CONSTANT definitions @modelParameterConstants:5az_mapping
const_1737299528166236000 ==
[ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2,p2} , az3 |-> {b3,s3}]
----
\* CONSTRAINT definition @modelParameterContraint:0
constr_1737299528166237000 ==
StateConstraint
----
=============================================================================
\* Modification History
\* Created Sun Jan 19 16:12:08 CET 2025 by cs
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299542008/MC_TE.out
-57
View File
@@ -1,57 +0,0 @@
@!@!@STARTMSG 2262:0 @!@!@
TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802)
@!@!@ENDMSG 2262 @!@!@
@!@!@STARTMSG 2187:0 @!@!@
Running breadth-first search Model-Checking with fp 90 and seed -131482239732531000 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 7787] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
@!@!@ENDMSG 2187 @!@!@
@!@!@STARTMSG 2220:0 @!@!@
Starting SANY...
@!@!@ENDMSG 2220 @!@!@
Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/MC.tla
Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/fullmesh.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Semantic processing of module Naturals
Semantic processing of module Integers
Semantic processing of module fullmesh
Semantic processing of module Sequences
Semantic processing of module FiniteSets
Semantic processing of module TLC
Semantic processing of module MC
@!@!@STARTMSG 2219:0 @!@!@
SANY finished.
@!@!@ENDMSG 2219 @!@!@
@!@!@STARTMSG 2185:0 @!@!@
Starting... (2025-01-19 16:12:09)
@!@!@ENDMSG 2185 @!@!@
@!@!@STARTMSG 2279:3 @!@!@
Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined.
@!@!@ENDMSG 2279 @!@!@
@!@!@STARTMSG 2284:3 @!@!@
Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details.
@!@!@ENDMSG 2284 @!@!@
@!@!@STARTMSG 2212:0 @!@!@
Implied-temporal checking--satisfiability problem has 1 branches.
@!@!@ENDMSG 2212 @!@!@
@!@!@STARTMSG 2189:0 @!@!@
Computing initial states...
@!@!@ENDMSG 2189 @!@!@
@!@!@STARTMSG 2190:0 @!@!@
Finished computing initial states: 1 distinct state generated at 2025-01-19 16:12:10.
@!@!@ENDMSG 2190 @!@!@
@!@!@STARTMSG 2143:3 @!@!@
The variable safekeeper_state was changed while it is specified as UNCHANGED at
line 53, col 34 to line 53, col 49 of module fullmesh
@!@!@ENDMSG 2143 @!@!@
@!@!@STARTMSG 2192:0 @!@!@
Checking temporal properties for the current state space with 1454 total distinct states at (2025-01-19 16:12:13)
@!@!@ENDMSG 2192 @!@!@
@!@!@STARTMSG 2267:0 @!@!@
Finished checking temporal properties in 00s at 2025-01-19 16:12:13
@!@!@ENDMSG 2267 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(11) at 2025-01-19 16:12:13: 44.264 states generated (44.264 s/min), 2.994 distinct states found (2.994 ds/min), 1.536 states left on queue.
@!@!@ENDMSG 2200 @!@!@
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299744229/MC.cfg
-51
View File
@@ -1,51 +0,0 @@
\* MV CONSTANT declarations
CONSTANTS
b1 = b1
b2 = b2
b3 = b3
\* MV CONSTANT declarations
CONSTANTS
s1 = s1
s2 = s2
s3 = s3
\* MV CONSTANT declarations
CONSTANTS
p1 = p1
p2 = p2
\* MV CONSTANT declarations
CONSTANTS
az1 = az1
az2 = az2
az3 = az3
\* MV CONSTANT definitions
CONSTANT
brokers <- const_1737299548592239000
\* CONSTANT declarations
CONSTANT NULL = NULL
\* MV CONSTANT definitions
CONSTANT
safekeepers <- const_1737299548592240000
\* MV CONSTANT definitions
CONSTANT
pageservers <- const_1737299548592241000
\* MV CONSTANT definitions
CONSTANT
azs <- const_1737299548592242000
\* SYMMETRY definition
SYMMETRY symm_1737299548592243000
\* CONSTANT definitions
CONSTANT
max_commit_lsn <- const_1737299548592244000
\* CONSTANT definitions
CONSTANT
az_mapping <- const_1737299548592245000
\* CONSTRAINT definition
CONSTRAINT
constr_1737299548592246000
\* SPECIFICATION definition
SPECIFICATION
Spec
\* PROPERTY definition
PROPERTY
EventuallyLaggingSkIsNotPreferredSk
\* Generated on Sun Jan 19 16:12:28 CET 2025
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299744229/MC.out
-323
View File
@@ -1,323 +0,0 @@
@!@!@STARTMSG 2262:0 @!@!@
TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802)
@!@!@ENDMSG 2262 @!@!@
@!@!@STARTMSG 2187:0 @!@!@
Running breadth-first search Model-Checking with fp 7 and seed 1961239747497010948 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 7839] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
@!@!@ENDMSG 2187 @!@!@
@!@!@STARTMSG 2220:0 @!@!@
Starting SANY...
@!@!@ENDMSG 2220 @!@!@
Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/MC.tla
Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/fullmesh.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Semantic processing of module Naturals
Semantic processing of module Integers
Semantic processing of module fullmesh
Semantic processing of module Sequences
Semantic processing of module FiniteSets
Semantic processing of module TLC
Semantic processing of module MC
@!@!@STARTMSG 2219:0 @!@!@
SANY finished.
@!@!@ENDMSG 2219 @!@!@
@!@!@STARTMSG 2185:0 @!@!@
Starting... (2025-01-19 16:12:29)
@!@!@ENDMSG 2185 @!@!@
@!@!@STARTMSG 2279:3 @!@!@
Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined.
@!@!@ENDMSG 2279 @!@!@
@!@!@STARTMSG 2284:3 @!@!@
Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details.
@!@!@ENDMSG 2284 @!@!@
@!@!@STARTMSG 2212:0 @!@!@
Implied-temporal checking--satisfiability problem has 1 branches.
@!@!@ENDMSG 2212 @!@!@
@!@!@STARTMSG 2189:0 @!@!@
Computing initial states...
@!@!@ENDMSG 2189 @!@!@
@!@!@STARTMSG 2190:0 @!@!@
Finished computing initial states: 1 distinct state generated at 2025-01-19 16:12:31.
@!@!@ENDMSG 2190 @!@!@
@!@!@STARTMSG 2192:0 @!@!@
Checking temporal properties for the current state space with 1175 total distinct states at (2025-01-19 16:12:34)
@!@!@ENDMSG 2192 @!@!@
@!@!@STARTMSG 2267:0 @!@!@
Finished checking temporal properties in 00s at 2025-01-19 16:12:34
@!@!@ENDMSG 2267 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(11) at 2025-01-19 16:12:34: 38.396 states generated (38.396 s/min), 3.250 distinct states found (3.250 ds/min), 2.071 states left on queue.
@!@!@ENDMSG 2200 @!@!@
@!@!@STARTMSG 2192:0 @!@!@
Checking temporal properties for the current state space with 45381 total distinct states at (2025-01-19 16:13:34)
@!@!@ENDMSG 2192 @!@!@
@!@!@STARTMSG 2267:0 @!@!@
Finished checking temporal properties in 00s at 2025-01-19 16:13:34
@!@!@ENDMSG 2267 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(15) at 2025-01-19 16:13:34: 1.510.623 states generated (1.472.227 s/min), 97.716 distinct states found (94.466 ds/min), 52.332 states left on queue.
@!@!@ENDMSG 2200 @!@!@
@!@!@STARTMSG 2192:0 @!@!@
Checking temporal properties for the current state space with 92513 total distinct states at (2025-01-19 16:14:34)
@!@!@ENDMSG 2192 @!@!@
@!@!@STARTMSG 2267:0 @!@!@
Finished checking temporal properties in 00s at 2025-01-19 16:14:34
@!@!@ENDMSG 2267 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(16) at 2025-01-19 16:14:34: 3.093.230 states generated (1.582.607 s/min), 182.372 distinct states found (84.656 ds/min), 89.855 states left on queue.
@!@!@ENDMSG 2200 @!@!@
@!@!@STARTMSG 2192:0 @!@!@
Checking temporal properties for the current state space with 140861 total distinct states at (2025-01-19 16:15:34)
@!@!@ENDMSG 2192 @!@!@
@!@!@STARTMSG 2267:0 @!@!@
Finished checking temporal properties in 00s at 2025-01-19 16:15:34
@!@!@ENDMSG 2267 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(17) at 2025-01-19 16:15:34: 4.742.508 states generated (1.649.278 s/min), 257.179 distinct states found (74.807 ds/min), 116.314 states left on queue.
@!@!@ENDMSG 2200 @!@!@
@!@!@STARTMSG 2201:0 @!@!@
The coverage statistics at 2025-01-19 16:15:34
@!@!@ENDMSG 2201 @!@!@
@!@!@STARTMSG 2773:0 @!@!@
<Init line 33, col 1 to line 33, col 4 of module fullmesh>: 1:1
@!@!@ENDMSG 2773 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 34, col 5 to line 36, col 64 of module fullmesh: 1
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkCommit line 39, col 1 to line 39, col 16 of module fullmesh>: 54:531874
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 40, col 8 to line 40, col 14 of module fullmesh: 1799789
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 40, col 8 to line 40, col 9 of module fullmesh: 1267920
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 40, col 13 to line 40, col 14 of module fullmesh: 1267920
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 41, col 8 to line 41, col 72 of module fullmesh: 1377160
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 41, col 8 to line 41, col 38 of module fullmesh: 845280
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 41, col 8 to line 41, col 27 of module fullmesh: 845280
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 41, col 8 to line 41, col 23 of module fullmesh: 845280
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 41, col 25 to line 41, col 26 of module fullmesh: 845280
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 41, col 42 to line 41, col 72 of module fullmesh: 845280
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 45, col 13 to line 47, col 50 of module fullmesh: 531880
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 48, col 8 to line 48, col 51 of module fullmesh: 531878
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkPeerRecovery line 50, col 1 to line 50, col 21 of module fullmesh>: 148:156702
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 51, col 8 to line 51, col 72 of module fullmesh: 156716
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 51, col 8 to line 51, col 38 of module fullmesh: 1267992
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 51, col 8 to line 51, col 27 of module fullmesh: 1267999
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 51, col 8 to line 51, col 23 of module fullmesh: 1268010
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 51, col 25 to line 51, col 26 of module fullmesh: 1268010
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 51, col 42 to line 51, col 72 of module fullmesh: 1268010
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 52, col 8 to line 52, col 102 of module fullmesh: 156720
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 53, col 8 to line 53, col 51 of module fullmesh: 156716
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkPushToBroker line 55, col 1 to line 55, col 19 of module fullmesh>: 13409:1268009
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 56, col 8 to line 63, col 29 of module fullmesh: 1268023
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 56, col 24 to line 63, col 29 of module fullmesh: 1268028
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 56, col 27 to line 56, col 91 of module fullmesh: 1268028
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 56, col 27 to line 56, col 58 of module fullmesh: 1268028
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||||line 56, col 27 to line 56, col 47 of module fullmesh: 1268028
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||||line 56, col 27 to line 56, col 44 of module fullmesh: 1268028
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||||||line 56, col 27 to line 56, col 41 of module fullmesh: 1268028
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||||||line 56, col 27 to line 56, col 38 of module fullmesh: 1268028
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||||||line 56, col 40 to line 56, col 40 of module fullmesh: 1268028
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||||line 56, col 46 to line 56, col 46 of module fullmesh: 1268028
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 56, col 62 to line 56, col 91 of module fullmesh: 1268028
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 59, col 28 to line 59, col 45 of module fullmesh: 793908
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 59, col 28 to line 59, col 42 of module fullmesh: 793908
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 60, col 31 to line 60, col 91 of module fullmesh: 793908
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 60, col 32 to line 60, col 34 of module fullmesh: 793908
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 60, col 43 to line 60, col 90 of module fullmesh: 793906
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 62, col 17 to line 62, col 54 of module fullmesh: 793908
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 63, col 18 to line 63, col 29 of module fullmesh: 474120
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 64, col 8 to line 64, col 55 of module fullmesh: 1268023
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<PsRecvBroker line 66, col 1 to line 66, col 19 of module fullmesh>: 130578:2536105
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 72, col 13 to line 74, col 37 of module fullmesh: 2536113
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 72, col 33 to line 74, col 37 of module fullmesh: 2536117
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 72, col 36 to line 72, col 66 of module fullmesh: 2536118
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 72, col 36 to line 72, col 49 of module fullmesh: 2536119
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 72, col 53 to line 72, col 66 of module fullmesh: 2536121
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||||line 72, col 53 to line 72, col 55 of module fullmesh: 2536122
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||||line 69, col 20 to line 69, col 44 of module fullmesh: 2536123
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||||||line 69, col 20 to line 69, col 41 of module fullmesh: 2536124
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||||||line 69, col 20 to line 69, col 38 of module fullmesh: 2536125
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||||||line 69, col 43 to line 69, col 43 of module fullmesh: 2536126
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 73, col 22 to line 73, col 66 of module fullmesh: 818090
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 74, col 22 to line 74, col 37 of module fullmesh: 1718038
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 75, col 8 to line 75, col 51 of module fullmesh: 2536113
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<PsChooseSk line 84, col 1 to line 84, col 13 of module fullmesh>: 113018:250807
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 85, col 8 to line 85, col 30 of module fullmesh: 532607
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 85, col 8 to line 85, col 25 of module fullmesh: 281798
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 80, col 15 to line 80, col 33 of module fullmesh: 281798
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 82, col 5 to line 82, col 66 of module fullmesh: 281798
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 82, col 26 to line 82, col 65 of module fullmesh: 845394
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 82, col 12 to line 82, col 23 of module fullmesh: 281798
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 85, col 24 to line 85, col 24 of module fullmesh: 281798
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 85, col 29 to line 85, col 30 of module fullmesh: 281800
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 86, col 8 to line 86, col 109 of module fullmesh: 250813
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 86, col 28 to line 86, col 109 of module fullmesh: 250815
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 86, col 29 to line 86, col 44 of module fullmesh: 250815
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 86, col 52 to line 86, col 108 of module fullmesh: 250807
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 86, col 72 to line 86, col 108 of module fullmesh: 250815
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 86, col 105 to line 86, col 108 of module fullmesh: 250814
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 86, col 85 to line 86, col 102 of module fullmesh: 250815
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||||line 80, col 15 to line 80, col 33 of module fullmesh: 250814
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2775:0 @!@!@
||||line 82, col 5 to line 82, col 66 of module fullmesh: 250814:250814
@!@!@ENDMSG 2775 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||||line 82, col 26 to line 82, col 65 of module fullmesh: 752442
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||||line 82, col 12 to line 82, col 23 of module fullmesh: 250814
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||||line 86, col 101 to line 86, col 101 of module fullmesh: 250814
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 87, col 8 to line 87, col 51 of module fullmesh: 250807
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2202:0 @!@!@
End of statistics.
@!@!@ENDMSG 2202 @!@!@
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299744229/MC.tla
-65
View File
@@ -1,65 +0,0 @@
---- MODULE MC ----
EXTENDS fullmesh, TLC
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
b1, b2, b3
----
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
s1, s2, s3
----
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
p1, p2
----
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
az1, az2, az3
----
\* MV CONSTANT definitions brokers
const_1737299548592239000 ==
{b1, b2, b3}
----
\* MV CONSTANT definitions safekeepers
const_1737299548592240000 ==
{s1, s2, s3}
----
\* MV CONSTANT definitions pageservers
const_1737299548592241000 ==
{p1, p2}
----
\* MV CONSTANT definitions azs
const_1737299548592242000 ==
{az1, az2, az3}
----
\* SYMMETRY definition
symm_1737299548592243000 ==
Permutations(const_1737299548592239000) \union Permutations(const_1737299548592240000) \union Permutations(const_1737299548592241000) \union Permutations(const_1737299548592242000)
----
\* CONSTANT definitions @modelParameterConstants:4max_commit_lsn
const_1737299548592244000 ==
2
----
\* CONSTANT definitions @modelParameterConstants:5az_mapping
const_1737299548592245000 ==
[ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2,p2} , az3 |-> {b3,s3}]
----
\* CONSTRAINT definition @modelParameterContraint:0
constr_1737299548592246000 ==
StateConstraint
----
=============================================================================
\* Modification History
\* Created Sun Jan 19 16:12:28 CET 2025 by cs
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299744229/MC_TE.out
-323
View File
@@ -1,323 +0,0 @@
@!@!@STARTMSG 2262:0 @!@!@
TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802)
@!@!@ENDMSG 2262 @!@!@
@!@!@STARTMSG 2187:0 @!@!@
Running breadth-first search Model-Checking with fp 7 and seed 1961239747497010948 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 7839] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
@!@!@ENDMSG 2187 @!@!@
@!@!@STARTMSG 2220:0 @!@!@
Starting SANY...
@!@!@ENDMSG 2220 @!@!@
Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/MC.tla
Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/fullmesh.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Semantic processing of module Naturals
Semantic processing of module Integers
Semantic processing of module fullmesh
Semantic processing of module Sequences
Semantic processing of module FiniteSets
Semantic processing of module TLC
Semantic processing of module MC
@!@!@STARTMSG 2219:0 @!@!@
SANY finished.
@!@!@ENDMSG 2219 @!@!@
@!@!@STARTMSG 2185:0 @!@!@
Starting... (2025-01-19 16:12:29)
@!@!@ENDMSG 2185 @!@!@
@!@!@STARTMSG 2279:3 @!@!@
Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined.
@!@!@ENDMSG 2279 @!@!@
@!@!@STARTMSG 2284:3 @!@!@
Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details.
@!@!@ENDMSG 2284 @!@!@
@!@!@STARTMSG 2212:0 @!@!@
Implied-temporal checking--satisfiability problem has 1 branches.
@!@!@ENDMSG 2212 @!@!@
@!@!@STARTMSG 2189:0 @!@!@
Computing initial states...
@!@!@ENDMSG 2189 @!@!@
@!@!@STARTMSG 2190:0 @!@!@
Finished computing initial states: 1 distinct state generated at 2025-01-19 16:12:31.
@!@!@ENDMSG 2190 @!@!@
@!@!@STARTMSG 2192:0 @!@!@
Checking temporal properties for the current state space with 1175 total distinct states at (2025-01-19 16:12:34)
@!@!@ENDMSG 2192 @!@!@
@!@!@STARTMSG 2267:0 @!@!@
Finished checking temporal properties in 00s at 2025-01-19 16:12:34
@!@!@ENDMSG 2267 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(11) at 2025-01-19 16:12:34: 38.396 states generated (38.396 s/min), 3.250 distinct states found (3.250 ds/min), 2.071 states left on queue.
@!@!@ENDMSG 2200 @!@!@
@!@!@STARTMSG 2192:0 @!@!@
Checking temporal properties for the current state space with 45381 total distinct states at (2025-01-19 16:13:34)
@!@!@ENDMSG 2192 @!@!@
@!@!@STARTMSG 2267:0 @!@!@
Finished checking temporal properties in 00s at 2025-01-19 16:13:34
@!@!@ENDMSG 2267 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(15) at 2025-01-19 16:13:34: 1.510.623 states generated (1.472.227 s/min), 97.716 distinct states found (94.466 ds/min), 52.332 states left on queue.
@!@!@ENDMSG 2200 @!@!@
@!@!@STARTMSG 2192:0 @!@!@
Checking temporal properties for the current state space with 92513 total distinct states at (2025-01-19 16:14:34)
@!@!@ENDMSG 2192 @!@!@
@!@!@STARTMSG 2267:0 @!@!@
Finished checking temporal properties in 00s at 2025-01-19 16:14:34
@!@!@ENDMSG 2267 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(16) at 2025-01-19 16:14:34: 3.093.230 states generated (1.582.607 s/min), 182.372 distinct states found (84.656 ds/min), 89.855 states left on queue.
@!@!@ENDMSG 2200 @!@!@
@!@!@STARTMSG 2192:0 @!@!@
Checking temporal properties for the current state space with 140861 total distinct states at (2025-01-19 16:15:34)
@!@!@ENDMSG 2192 @!@!@
@!@!@STARTMSG 2267:0 @!@!@
Finished checking temporal properties in 00s at 2025-01-19 16:15:34
@!@!@ENDMSG 2267 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(17) at 2025-01-19 16:15:34: 4.742.508 states generated (1.649.278 s/min), 257.179 distinct states found (74.807 ds/min), 116.314 states left on queue.
@!@!@ENDMSG 2200 @!@!@
@!@!@STARTMSG 2201:0 @!@!@
The coverage statistics at 2025-01-19 16:15:34
@!@!@ENDMSG 2201 @!@!@
@!@!@STARTMSG 2773:0 @!@!@
<Init line 33, col 1 to line 33, col 4 of module fullmesh>: 1:1
@!@!@ENDMSG 2773 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 34, col 5 to line 36, col 64 of module fullmesh: 1
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkCommit line 39, col 1 to line 39, col 16 of module fullmesh>: 54:531874
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 40, col 8 to line 40, col 14 of module fullmesh: 1799789
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 40, col 8 to line 40, col 9 of module fullmesh: 1267920
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 40, col 13 to line 40, col 14 of module fullmesh: 1267920
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 41, col 8 to line 41, col 72 of module fullmesh: 1377160
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 41, col 8 to line 41, col 38 of module fullmesh: 845280
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 41, col 8 to line 41, col 27 of module fullmesh: 845280
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 41, col 8 to line 41, col 23 of module fullmesh: 845280
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 41, col 25 to line 41, col 26 of module fullmesh: 845280
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 41, col 42 to line 41, col 72 of module fullmesh: 845280
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 45, col 13 to line 47, col 50 of module fullmesh: 531880
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 48, col 8 to line 48, col 51 of module fullmesh: 531878
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkPeerRecovery line 50, col 1 to line 50, col 21 of module fullmesh>: 148:156702
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 51, col 8 to line 51, col 72 of module fullmesh: 156716
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 51, col 8 to line 51, col 38 of module fullmesh: 1267992
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 51, col 8 to line 51, col 27 of module fullmesh: 1267999
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 51, col 8 to line 51, col 23 of module fullmesh: 1268010
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 51, col 25 to line 51, col 26 of module fullmesh: 1268010
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 51, col 42 to line 51, col 72 of module fullmesh: 1268010
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 52, col 8 to line 52, col 102 of module fullmesh: 156720
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 53, col 8 to line 53, col 51 of module fullmesh: 156716
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkPushToBroker line 55, col 1 to line 55, col 19 of module fullmesh>: 13409:1268009
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 56, col 8 to line 63, col 29 of module fullmesh: 1268023
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 56, col 24 to line 63, col 29 of module fullmesh: 1268028
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 56, col 27 to line 56, col 91 of module fullmesh: 1268028
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 56, col 27 to line 56, col 58 of module fullmesh: 1268028
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||||line 56, col 27 to line 56, col 47 of module fullmesh: 1268028
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||||line 56, col 27 to line 56, col 44 of module fullmesh: 1268028
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||||||line 56, col 27 to line 56, col 41 of module fullmesh: 1268028
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||||||line 56, col 27 to line 56, col 38 of module fullmesh: 1268028
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||||||line 56, col 40 to line 56, col 40 of module fullmesh: 1268028
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||||line 56, col 46 to line 56, col 46 of module fullmesh: 1268028
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 56, col 62 to line 56, col 91 of module fullmesh: 1268028
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 59, col 28 to line 59, col 45 of module fullmesh: 793908
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 59, col 28 to line 59, col 42 of module fullmesh: 793908
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 60, col 31 to line 60, col 91 of module fullmesh: 793908
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 60, col 32 to line 60, col 34 of module fullmesh: 793908
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 60, col 43 to line 60, col 90 of module fullmesh: 793906
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 62, col 17 to line 62, col 54 of module fullmesh: 793908
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 63, col 18 to line 63, col 29 of module fullmesh: 474120
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 64, col 8 to line 64, col 55 of module fullmesh: 1268023
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<PsRecvBroker line 66, col 1 to line 66, col 19 of module fullmesh>: 130578:2536105
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 72, col 13 to line 74, col 37 of module fullmesh: 2536113
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 72, col 33 to line 74, col 37 of module fullmesh: 2536117
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 72, col 36 to line 72, col 66 of module fullmesh: 2536118
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 72, col 36 to line 72, col 49 of module fullmesh: 2536119
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 72, col 53 to line 72, col 66 of module fullmesh: 2536121
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||||line 72, col 53 to line 72, col 55 of module fullmesh: 2536122
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||||line 69, col 20 to line 69, col 44 of module fullmesh: 2536123
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||||||line 69, col 20 to line 69, col 41 of module fullmesh: 2536124
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||||||line 69, col 20 to line 69, col 38 of module fullmesh: 2536125
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||||||line 69, col 43 to line 69, col 43 of module fullmesh: 2536126
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 73, col 22 to line 73, col 66 of module fullmesh: 818090
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 74, col 22 to line 74, col 37 of module fullmesh: 1718038
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 75, col 8 to line 75, col 51 of module fullmesh: 2536113
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<PsChooseSk line 84, col 1 to line 84, col 13 of module fullmesh>: 113018:250807
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 85, col 8 to line 85, col 30 of module fullmesh: 532607
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 85, col 8 to line 85, col 25 of module fullmesh: 281798
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 80, col 15 to line 80, col 33 of module fullmesh: 281798
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 82, col 5 to line 82, col 66 of module fullmesh: 281798
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 82, col 26 to line 82, col 65 of module fullmesh: 845394
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 82, col 12 to line 82, col 23 of module fullmesh: 281798
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 85, col 24 to line 85, col 24 of module fullmesh: 281798
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 85, col 29 to line 85, col 30 of module fullmesh: 281800
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 86, col 8 to line 86, col 109 of module fullmesh: 250813
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 86, col 28 to line 86, col 109 of module fullmesh: 250815
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 86, col 29 to line 86, col 44 of module fullmesh: 250815
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 86, col 52 to line 86, col 108 of module fullmesh: 250807
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 86, col 72 to line 86, col 108 of module fullmesh: 250815
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 86, col 105 to line 86, col 108 of module fullmesh: 250814
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 86, col 85 to line 86, col 102 of module fullmesh: 250815
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||||line 80, col 15 to line 80, col 33 of module fullmesh: 250814
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2775:0 @!@!@
||||line 82, col 5 to line 82, col 66 of module fullmesh: 250814:250814
@!@!@ENDMSG 2775 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||||line 82, col 26 to line 82, col 65 of module fullmesh: 752442
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||||line 82, col 12 to line 82, col 23 of module fullmesh: 250814
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||||line 86, col 101 to line 86, col 101 of module fullmesh: 250814
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 87, col 8 to line 87, col 51 of module fullmesh: 250807
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2202:0 @!@!@
End of statistics.
@!@!@ENDMSG 2202 @!@!@
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737301172627/MC.cfg → storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307595008/MC.cfg
+9 -9
View File
@@ -19,33 +19,33 @@ az2 = az2
az3 = az3
\* MV CONSTANT definitions
CONSTANT
brokers <- const_17373011685892000
brokers <- const_17373075907692000
\* CONSTANT declarations
CONSTANT NULL = NULL
\* MV CONSTANT definitions
CONSTANT
safekeepers <- const_17373011685893000
safekeepers <- const_17373075907703000
\* MV CONSTANT definitions
CONSTANT
pageservers <- const_17373011685894000
pageservers <- const_17373075907704000
\* MV CONSTANT definitions
CONSTANT
azs <- const_17373011685895000
azs <- const_17373075907705000
\* SYMMETRY definition
SYMMETRY symm_17373011685896000
SYMMETRY symm_17373075907706000
\* CONSTANT definitions
CONSTANT
max_commit_lsn <- const_17373011685897000
max_commit_lsn <- const_17373075907707000
\* CONSTANT definitions
CONSTANT
az_mapping <- const_17373011685898000
az_mapping <- const_17373075907708000
\* CONSTRAINT definition
CONSTRAINT
constr_17373011685899000
constr_17373075907709000
\* SPECIFICATION definition
SPECIFICATION
Spec
\* PROPERTY definition
PROPERTY
EventuallyLaggingSkIsNotPreferredSk
\* Generated on Sun Jan 19 16:39:28 CET 2025
\* Generated on Sun Jan 19 18:26:30 CET 2025
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307595008/MC.out
+164
View File
@@ -0,0 +1,164 @@
@!@!@STARTMSG 2262:0 @!@!@
TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802)
@!@!@ENDMSG 2262 @!@!@
@!@!@STARTMSG 2187:0 @!@!@
Running breadth-first search Model-Checking with fp 44 and seed -6447714091281296951 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11418] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
@!@!@ENDMSG 2187 @!@!@
@!@!@STARTMSG 2220:0 @!@!@
Starting SANY...
@!@!@ENDMSG 2220 @!@!@
Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla
Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla
Semantic processing of module Naturals
Semantic processing of module Integers
Semantic processing of module Sequences
Semantic processing of module FiniteSets
Semantic processing of module replicated
Semantic processing of module TLC
Semantic processing of module MC
@!@!@STARTMSG 2219:0 @!@!@
SANY finished.
@!@!@ENDMSG 2219 @!@!@
@!@!@STARTMSG 2185:0 @!@!@
Starting... (2025-01-19 18:26:32)
@!@!@ENDMSG 2185 @!@!@
@!@!@STARTMSG 2140:3 @!@!@
The subscript of the next-state relation specified by the specification
does not seem to contain the state variable online
@!@!@ENDMSG 2140 @!@!@
@!@!@STARTMSG 2279:3 @!@!@
Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined.
@!@!@ENDMSG 2279 @!@!@
@!@!@STARTMSG 2284:3 @!@!@
Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details.
@!@!@ENDMSG 2284 @!@!@
@!@!@STARTMSG 2212:0 @!@!@
Implied-temporal checking--satisfiability problem has 1 branches.
@!@!@ENDMSG 2212 @!@!@
@!@!@STARTMSG 2189:0 @!@!@
Computing initial states...
@!@!@ENDMSG 2189 @!@!@
@!@!@STARTMSG 2190:0 @!@!@
Finished computing initial states: 1 distinct state generated at 2025-01-19 18:26:33.
@!@!@ENDMSG 2190 @!@!@
@!@!@STARTMSG 2109:1 @!@!@
Successor state is not completely specified by action NodeOnlineOffline of the next-state relation. The following variables are not assigned: broker_state, pageserver_state, safekeeper_state.
@!@!@ENDMSG 2109 @!@!@
@!@!@STARTMSG 2121:1 @!@!@
The behavior up to this point is:
@!@!@ENDMSG 2121 @!@!@
@!@!@STARTMSG 2217:4 @!@!@
1: <Initial predicate>
/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL])
/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])])
/\ online = {b1, b2, b3, s1, s2, s3, p1, p2}
/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0])
@!@!@ENDMSG 2217 @!@!@
@!@!@STARTMSG 2217:4 @!@!@
2: <NodeOnlineOffline line 40, col 22 to line 43, col 44 of module replicated>
/\ pageserver_state = null
/\ broker_state = null
/\ online = {b1, b2, s1, s2, p1, p2}
/\ safekeeper_state = null
@!@!@ENDMSG 2217 @!@!@
@!@!@STARTMSG 2201:0 @!@!@
The coverage statistics at 2025-01-19 18:26:33
@!@!@ENDMSG 2201 @!@!@
@!@!@STARTMSG 2773:0 @!@!@
<Init line 34, col 1 to line 34, col 4 of module replicated>: 1:1
@!@!@ENDMSG 2773 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 35, col 5 to line 38, col 26 of module replicated: 1
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<NodeOnlineOffline line 40, col 1 to line 40, col 17 of module replicated>: 0:2
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 40, col 22 to line 43, col 44 of module replicated: 1
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 40, col 32 to line 43, col 44 of module replicated: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 41, col 9 to line 43, col 44 of module replicated: 464
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 41, col 12 to line 41, col 48 of module replicated: 464
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 42, col 12 to line 42, col 44 of module replicated: 208
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 43, col 12 to line 43, col 44 of module replicated: 86
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 40, col 46 to line 40, col 62 of module replicated: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkCommit line 45, col 1 to line 45, col 16 of module replicated>: 0:0
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 52, col 13 to line 54, col 50 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 55, col 8 to line 55, col 51 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkPeerRecovery line 57, col 1 to line 57, col 21 of module replicated>: 0:0
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 60, col 8 to line 60, col 102 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 61, col 8 to line 61, col 51 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkPushToBroker line 63, col 1 to line 63, col 19 of module replicated>: 0:0
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 65, col 8 to line 72, col 29 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 73, col 8 to line 73, col 55 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<PsRecvBroker line 75, col 1 to line 75, col 19 of module replicated>: 0:0
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 82, col 13 to line 84, col 37 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 85, col 8 to line 85, col 51 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<PsChooseSk line 96, col 1 to line 96, col 13 of module replicated>: 0:0
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 98, col 8 to line 98, col 109 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 99, col 8 to line 99, col 51 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2202:0 @!@!@
End of statistics.
@!@!@ENDMSG 2202 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(1) at 2025-01-19 18:26:33: 2 states generated (45 s/min), 1 distinct states found (22 ds/min), 0 states left on queue.
@!@!@ENDMSG 2200 @!@!@
@!@!@STARTMSG 2199:0 @!@!@
2 states generated, 1 distinct states found, 0 states left on queue.
@!@!@ENDMSG 2199 @!@!@
@!@!@STARTMSG 2194:0 @!@!@
The depth of the complete state graph search is 1.
@!@!@ENDMSG 2194 @!@!@
@!@!@STARTMSG 2186:0 @!@!@
Finished in 2685ms at (2025-01-19 18:26:33)
@!@!@ENDMSG 2186 @!@!@
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737301172627/MC.tla → storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307595008/MC.tla
+10 -10
View File
@@ -22,44 +22,44 @@ az1, az2, az3
----
\* MV CONSTANT definitions brokers
const_17373011685892000 ==
const_17373075907692000 ==
{b1, b2, b3}
----
\* MV CONSTANT definitions safekeepers
const_17373011685893000 ==
const_17373075907703000 ==
{s1, s2, s3}
----
\* MV CONSTANT definitions pageservers
const_17373011685894000 ==
const_17373075907704000 ==
{p1, p2}
----
\* MV CONSTANT definitions azs
const_17373011685895000 ==
const_17373075907705000 ==
{az1, az2, az3}
----
\* SYMMETRY definition
symm_17373011685896000 ==
Permutations(const_17373011685892000) \union Permutations(const_17373011685893000) \union Permutations(const_17373011685894000) \union Permutations(const_17373011685895000)
symm_17373075907706000 ==
Permutations(const_17373075907692000) \union Permutations(const_17373075907703000) \union Permutations(const_17373075907704000) \union Permutations(const_17373075907705000)
----
\* CONSTANT definitions @modelParameterConstants:4max_commit_lsn
const_17373011685897000 ==
const_17373075907707000 ==
2
----
\* CONSTANT definitions @modelParameterConstants:5az_mapping
const_17373011685898000 ==
const_17373075907708000 ==
[ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2,p2} , az3 |-> {b3,s3}]
----
\* CONSTRAINT definition @modelParameterContraint:0
constr_17373011685899000 ==
constr_17373075907709000 ==
StateConstraint
----
=============================================================================
\* Modification History
\* Created Sun Jan 19 16:39:28 CET 2025 by cs
\* Created Sun Jan 19 18:26:30 CET 2025 by cs
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307595008/MC_TE.out
+164
View File
@@ -0,0 +1,164 @@
@!@!@STARTMSG 2262:0 @!@!@
TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802)
@!@!@ENDMSG 2262 @!@!@
@!@!@STARTMSG 2187:0 @!@!@
Running breadth-first search Model-Checking with fp 44 and seed -6447714091281296951 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11418] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
@!@!@ENDMSG 2187 @!@!@
@!@!@STARTMSG 2220:0 @!@!@
Starting SANY...
@!@!@ENDMSG 2220 @!@!@
Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla
Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla
Semantic processing of module Naturals
Semantic processing of module Integers
Semantic processing of module Sequences
Semantic processing of module FiniteSets
Semantic processing of module replicated
Semantic processing of module TLC
Semantic processing of module MC
@!@!@STARTMSG 2219:0 @!@!@
SANY finished.
@!@!@ENDMSG 2219 @!@!@
@!@!@STARTMSG 2185:0 @!@!@
Starting... (2025-01-19 18:26:32)
@!@!@ENDMSG 2185 @!@!@
@!@!@STARTMSG 2140:3 @!@!@
The subscript of the next-state relation specified by the specification
does not seem to contain the state variable online
@!@!@ENDMSG 2140 @!@!@
@!@!@STARTMSG 2279:3 @!@!@
Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined.
@!@!@ENDMSG 2279 @!@!@
@!@!@STARTMSG 2284:3 @!@!@
Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details.
@!@!@ENDMSG 2284 @!@!@
@!@!@STARTMSG 2212:0 @!@!@
Implied-temporal checking--satisfiability problem has 1 branches.
@!@!@ENDMSG 2212 @!@!@
@!@!@STARTMSG 2189:0 @!@!@
Computing initial states...
@!@!@ENDMSG 2189 @!@!@
@!@!@STARTMSG 2190:0 @!@!@
Finished computing initial states: 1 distinct state generated at 2025-01-19 18:26:33.
@!@!@ENDMSG 2190 @!@!@
@!@!@STARTMSG 2109:1 @!@!@
Successor state is not completely specified by action NodeOnlineOffline of the next-state relation. The following variables are not assigned: broker_state, pageserver_state, safekeeper_state.
@!@!@ENDMSG 2109 @!@!@
@!@!@STARTMSG 2121:1 @!@!@
The behavior up to this point is:
@!@!@ENDMSG 2121 @!@!@
@!@!@STARTMSG 2217:4 @!@!@
1: <Initial predicate>
/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL])
/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])])
/\ online = {b1, b2, b3, s1, s2, s3, p1, p2}
/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0])
@!@!@ENDMSG 2217 @!@!@
@!@!@STARTMSG 2217:4 @!@!@
2: <NodeOnlineOffline line 40, col 22 to line 43, col 44 of module replicated>
/\ pageserver_state = null
/\ broker_state = null
/\ online = {b1, b2, s1, s2, p1, p2}
/\ safekeeper_state = null
@!@!@ENDMSG 2217 @!@!@
@!@!@STARTMSG 2201:0 @!@!@
The coverage statistics at 2025-01-19 18:26:33
@!@!@ENDMSG 2201 @!@!@
@!@!@STARTMSG 2773:0 @!@!@
<Init line 34, col 1 to line 34, col 4 of module replicated>: 1:1
@!@!@ENDMSG 2773 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 35, col 5 to line 38, col 26 of module replicated: 1
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<NodeOnlineOffline line 40, col 1 to line 40, col 17 of module replicated>: 0:2
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 40, col 22 to line 43, col 44 of module replicated: 1
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 40, col 32 to line 43, col 44 of module replicated: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 41, col 9 to line 43, col 44 of module replicated: 464
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 41, col 12 to line 41, col 48 of module replicated: 464
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 42, col 12 to line 42, col 44 of module replicated: 208
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 43, col 12 to line 43, col 44 of module replicated: 86
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 40, col 46 to line 40, col 62 of module replicated: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkCommit line 45, col 1 to line 45, col 16 of module replicated>: 0:0
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 52, col 13 to line 54, col 50 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 55, col 8 to line 55, col 51 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkPeerRecovery line 57, col 1 to line 57, col 21 of module replicated>: 0:0
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 60, col 8 to line 60, col 102 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 61, col 8 to line 61, col 51 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkPushToBroker line 63, col 1 to line 63, col 19 of module replicated>: 0:0
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 65, col 8 to line 72, col 29 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 73, col 8 to line 73, col 55 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<PsRecvBroker line 75, col 1 to line 75, col 19 of module replicated>: 0:0
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 82, col 13 to line 84, col 37 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 85, col 8 to line 85, col 51 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<PsChooseSk line 96, col 1 to line 96, col 13 of module replicated>: 0:0
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 98, col 8 to line 98, col 109 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 99, col 8 to line 99, col 51 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2202:0 @!@!@
End of statistics.
@!@!@ENDMSG 2202 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(1) at 2025-01-19 18:26:33: 2 states generated (45 s/min), 1 distinct states found (22 ds/min), 0 states left on queue.
@!@!@ENDMSG 2200 @!@!@
@!@!@STARTMSG 2199:0 @!@!@
2 states generated, 1 distinct states found, 0 states left on queue.
@!@!@ENDMSG 2199 @!@!@
@!@!@STARTMSG 2194:0 @!@!@
The depth of the complete state graph search is 1.
@!@!@ENDMSG 2194 @!@!@
@!@!@STARTMSG 2186:0 @!@!@
Finished in 2685ms at (2025-01-19 18:26:33)
@!@!@ENDMSG 2186 @!@!@
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737301223409/replicated.tla → storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307595008/replicated.tla
+19 -7
View File
@@ -1,8 +1,8 @@
---- MODULE replicated ----
EXTENDS Integers
EXTENDS Integers, FiniteSets
VARIABLES broker_state, safekeeper_state, pageserver_state
VARIABLES broker_state, safekeeper_state, pageserver_state, online
CONSTANT
@@ -29,14 +29,21 @@ StateConstraint ==
InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0]
InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]]
InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]]
InitOnline == safekeepers \cup brokers \cup pageservers
Init ==
/\ broker_state = [b \in brokers |-> InitBroker]
/\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper]
/\ pageserver_state = [p \in pageservers |-> InitPageserver]
/\ online = InitOnline
NodeOnlineOffline == online' = CHOOSE ss \in SUBSET InitOnline:
/\ Cardinality(ss \cap safekeepers) >= 2
/\ Cardinality(ss \cap brokers) >= 2
/\ ss \cap pageservers = pageservers \* assume no PS failures for now
SkCommit(s1, s2) ==
/\ {s1, s2} \subseteq online
/\ s1 # s2
/\ safekeeper_state[s1].commit_lsn = safekeeper_state[s2].commit_lsn
/\ LET
@@ -48,11 +55,13 @@ SkCommit(s1, s2) ==
/\ UNCHANGED <<broker_state, pageserver_state>>
SkPeerRecovery(s1,s2) ==
/\ {s1, s2} \subseteq online
/\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn
/\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn]
/\ UNCHANGED <<broker_state, pageserver_state>>
SkPushToBroker(s,b) ==
/\ {s, b} \subseteq online
/\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn
THEN
LET
@@ -64,6 +73,7 @@ SkPushToBroker(s,b) ==
/\ UNCHANGED <<safekeeper_state, pageserver_state>>
PsRecvBroker(b,p,s) ==
/\ {b,p,s} \subseteq online
/\ LET
bsk == broker_state[b].sk[s]
psk == pageserver_state[p].sk[s]
@@ -76,10 +86,12 @@ PsRecvBroker(b,p,s) ==
SksWithNewerWal(p) ==
LET
ps == pageserver_state[p]
IN
{s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn}
/\ {p} \subseteq online
/\
LET
ps == pageserver_state[p]
IN
{s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn}
PsChooseSk(p) ==
/\ SksWithNewerWal(p) # {}
@@ -88,7 +100,7 @@ PsChooseSk(p) ==
Next ==
\/ NodeOnlineOffline
\/ \E s1 \in safekeepers: \E s2 \in safekeepers:
\/ SkCommit(s1, s2)
\/ SkPeerRecovery(s1, s2)
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737301223409/MC.cfg → storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307621596/MC.cfg
+9 -9
View File
@@ -19,33 +19,33 @@ az2 = az2
az3 = az3
\* MV CONSTANT definitions
CONSTANT
brokers <- const_17373012151752000
brokers <- const_173730761739711000
\* CONSTANT declarations
CONSTANT NULL = NULL
\* MV CONSTANT definitions
CONSTANT
safekeepers <- const_17373012151763000
safekeepers <- const_173730761739712000
\* MV CONSTANT definitions
CONSTANT
pageservers <- const_17373012151764000
pageservers <- const_173730761739713000
\* MV CONSTANT definitions
CONSTANT
azs <- const_17373012151765000
azs <- const_173730761739714000
\* SYMMETRY definition
SYMMETRY symm_17373012151766000
SYMMETRY symm_173730761739715000
\* CONSTANT definitions
CONSTANT
max_commit_lsn <- const_17373012151767000
max_commit_lsn <- const_173730761739716000
\* CONSTANT definitions
CONSTANT
az_mapping <- const_17373012151768000
az_mapping <- const_173730761739717000
\* CONSTRAINT definition
CONSTRAINT
constr_17373012151769000
constr_173730761739718000
\* SPECIFICATION definition
SPECIFICATION
Spec
\* PROPERTY definition
PROPERTY
EventuallyLaggingSkIsNotPreferredSk
\* Generated on Sun Jan 19 16:40:15 CET 2025
\* Generated on Sun Jan 19 18:26:57 CET 2025
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307621596/MC.out
+174
View File
@@ -0,0 +1,174 @@
@!@!@STARTMSG 2262:0 @!@!@
TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802)
@!@!@ENDMSG 2262 @!@!@
@!@!@STARTMSG 2187:0 @!@!@
Running breadth-first search Model-Checking with fp 92 and seed -7531418498003009516 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11444] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
@!@!@ENDMSG 2187 @!@!@
@!@!@STARTMSG 2220:0 @!@!@
Starting SANY...
@!@!@ENDMSG 2220 @!@!@
Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla
Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla
Semantic processing of module Naturals
Semantic processing of module Integers
Semantic processing of module Sequences
Semantic processing of module FiniteSets
Semantic processing of module replicated
Semantic processing of module TLC
Semantic processing of module MC
@!@!@STARTMSG 2219:0 @!@!@
SANY finished.
@!@!@ENDMSG 2219 @!@!@
@!@!@STARTMSG 2185:0 @!@!@
Starting... (2025-01-19 18:26:58)
@!@!@ENDMSG 2185 @!@!@
@!@!@STARTMSG 2140:3 @!@!@
The subscript of the next-state relation specified by the specification
does not seem to contain the state variable online
@!@!@ENDMSG 2140 @!@!@
@!@!@STARTMSG 2279:3 @!@!@
Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined.
@!@!@ENDMSG 2279 @!@!@
@!@!@STARTMSG 2284:3 @!@!@
Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details.
@!@!@ENDMSG 2284 @!@!@
@!@!@STARTMSG 2212:0 @!@!@
Implied-temporal checking--satisfiability problem has 1 branches.
@!@!@ENDMSG 2212 @!@!@
@!@!@STARTMSG 2189:0 @!@!@
Computing initial states...
@!@!@ENDMSG 2189 @!@!@
@!@!@STARTMSG 2190:0 @!@!@
Finished computing initial states: 1 distinct state generated at 2025-01-19 18:27:00.
@!@!@ENDMSG 2190 @!@!@
@!@!@STARTMSG 1000:1 @!@!@
TLC threw an unexpected exception.
This was probably caused by an error in the spec or model.
See the User Output or TLC Console for clues to what happened.
The exception was a java.lang.RuntimeException
: @!@!@STARTMSG 2280:0 @!@!@
In evaluation, the identifier safekeeper_state is either undefined or not an operator.
line 44, col 24 to line 44, col 39 of module replicated
@!@!@ENDMSG 2280 @!@!@
@!@!@ENDMSG 1000 @!@!@
@!@!@STARTMSG 2121:1 @!@!@
The behavior up to this point is:
@!@!@ENDMSG 2121 @!@!@
@!@!@STARTMSG 2217:4 @!@!@
1: <Initial predicate>
/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL])
/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])])
/\ online = {b1, b2, b3, s1, s2, s3, p1, p2}
/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0])
@!@!@ENDMSG 2217 @!@!@
@!@!@STARTMSG 2103:1 @!@!@
The error occurred when TLC was evaluating the nested
expressions at the following positions:
0. Line 40, column 22 to line 44, column 71 in replicated
1. Line 40, column 32 to line 44, column 71 in replicated
2. Line 41, column 9 to line 44, column 71 in replicated
3. Line 44, column 12 to line 44, column 71 in replicated
4. Line 44, column 22 to line 44, column 71 in replicated
5. Line 44, column 24 to line 44, column 39 in replicated
@!@!@ENDMSG 2103 @!@!@
@!@!@STARTMSG 2201:0 @!@!@
The coverage statistics at 2025-01-19 18:27:00
@!@!@ENDMSG 2201 @!@!@
@!@!@STARTMSG 2773:0 @!@!@
<Init line 34, col 1 to line 34, col 4 of module replicated>: 1:1
@!@!@ENDMSG 2773 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 35, col 5 to line 38, col 26 of module replicated: 1
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<NodeOnlineOffline line 40, col 1 to line 40, col 17 of module replicated>: 0:0
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 40, col 22 to line 44, col 71 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 40, col 32 to line 44, col 71 of module replicated: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 41, col 9 to line 44, col 71 of module replicated: 464
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 41, col 12 to line 41, col 48 of module replicated: 464
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 42, col 12 to line 42, col 44 of module replicated: 208
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 43, col 12 to line 43, col 44 of module replicated: 86
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 44, col 12 to line 44, col 71 of module replicated: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 40, col 46 to line 40, col 62 of module replicated: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkCommit line 46, col 1 to line 46, col 16 of module replicated>: 0:0
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 53, col 13 to line 55, col 50 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 56, col 8 to line 56, col 51 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkPeerRecovery line 58, col 1 to line 58, col 21 of module replicated>: 0:0
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 61, col 8 to line 61, col 102 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 62, col 8 to line 62, col 51 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkPushToBroker line 64, col 1 to line 64, col 19 of module replicated>: 0:0
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 66, col 8 to line 73, col 29 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 74, col 8 to line 74, col 55 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<PsRecvBroker line 76, col 1 to line 76, col 19 of module replicated>: 0:0
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 83, col 13 to line 85, col 37 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 86, col 8 to line 86, col 51 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<PsChooseSk line 97, col 1 to line 97, col 13 of module replicated>: 0:0
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 99, col 8 to line 99, col 109 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 100, col 8 to line 100, col 51 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2202:0 @!@!@
End of statistics.
@!@!@ENDMSG 2202 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(1) at 2025-01-19 18:27:00: 1 states generated (24 s/min), 1 distinct states found (24 ds/min), 0 states left on queue.
@!@!@ENDMSG 2200 @!@!@
@!@!@STARTMSG 2199:0 @!@!@
1 states generated, 1 distinct states found, 0 states left on queue.
@!@!@ENDMSG 2199 @!@!@
@!@!@STARTMSG 2186:0 @!@!@
Finished in 2483ms at (2025-01-19 18:27:00)
@!@!@ENDMSG 2186 @!@!@
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737301223409/MC.tla → storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307621596/MC.tla
+10 -10
View File
@@ -22,44 +22,44 @@ az1, az2, az3
----
\* MV CONSTANT definitions brokers
const_17373012151752000 ==
const_173730761739711000 ==
{b1, b2, b3}
----
\* MV CONSTANT definitions safekeepers
const_17373012151763000 ==
const_173730761739712000 ==
{s1, s2, s3}
----
\* MV CONSTANT definitions pageservers
const_17373012151764000 ==
const_173730761739713000 ==
{p1, p2}
----
\* MV CONSTANT definitions azs
const_17373012151765000 ==
const_173730761739714000 ==
{az1, az2, az3}
----
\* SYMMETRY definition
symm_17373012151766000 ==
Permutations(const_17373012151752000) \union Permutations(const_17373012151763000) \union Permutations(const_17373012151764000) \union Permutations(const_17373012151765000)
symm_173730761739715000 ==
Permutations(const_173730761739711000) \union Permutations(const_173730761739712000) \union Permutations(const_173730761739713000) \union Permutations(const_173730761739714000)
----
\* CONSTANT definitions @modelParameterConstants:4max_commit_lsn
const_17373012151767000 ==
const_173730761739716000 ==
2
----
\* CONSTANT definitions @modelParameterConstants:5az_mapping
const_17373012151768000 ==
const_173730761739717000 ==
[ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2,p2} , az3 |-> {b3,s3}]
----
\* CONSTRAINT definition @modelParameterContraint:0
constr_17373012151769000 ==
constr_173730761739718000 ==
StateConstraint
----
=============================================================================
\* Modification History
\* Created Sun Jan 19 16:40:15 CET 2025 by cs
\* Created Sun Jan 19 18:26:57 CET 2025 by cs
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307621596/MC_TE.out
+174
View File
@@ -0,0 +1,174 @@
@!@!@STARTMSG 2262:0 @!@!@
TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802)
@!@!@ENDMSG 2262 @!@!@
@!@!@STARTMSG 2187:0 @!@!@
Running breadth-first search Model-Checking with fp 92 and seed -7531418498003009516 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11444] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
@!@!@ENDMSG 2187 @!@!@
@!@!@STARTMSG 2220:0 @!@!@
Starting SANY...
@!@!@ENDMSG 2220 @!@!@
Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla
Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla
Semantic processing of module Naturals
Semantic processing of module Integers
Semantic processing of module Sequences
Semantic processing of module FiniteSets
Semantic processing of module replicated
Semantic processing of module TLC
Semantic processing of module MC
@!@!@STARTMSG 2219:0 @!@!@
SANY finished.
@!@!@ENDMSG 2219 @!@!@
@!@!@STARTMSG 2185:0 @!@!@
Starting... (2025-01-19 18:26:58)
@!@!@ENDMSG 2185 @!@!@
@!@!@STARTMSG 2140:3 @!@!@
The subscript of the next-state relation specified by the specification
does not seem to contain the state variable online
@!@!@ENDMSG 2140 @!@!@
@!@!@STARTMSG 2279:3 @!@!@
Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined.
@!@!@ENDMSG 2279 @!@!@
@!@!@STARTMSG 2284:3 @!@!@
Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details.
@!@!@ENDMSG 2284 @!@!@
@!@!@STARTMSG 2212:0 @!@!@
Implied-temporal checking--satisfiability problem has 1 branches.
@!@!@ENDMSG 2212 @!@!@
@!@!@STARTMSG 2189:0 @!@!@
Computing initial states...
@!@!@ENDMSG 2189 @!@!@
@!@!@STARTMSG 2190:0 @!@!@
Finished computing initial states: 1 distinct state generated at 2025-01-19 18:27:00.
@!@!@ENDMSG 2190 @!@!@
@!@!@STARTMSG 1000:1 @!@!@
TLC threw an unexpected exception.
This was probably caused by an error in the spec or model.
See the User Output or TLC Console for clues to what happened.
The exception was a java.lang.RuntimeException
: @!@!@STARTMSG 2280:0 @!@!@
In evaluation, the identifier safekeeper_state is either undefined or not an operator.
line 44, col 24 to line 44, col 39 of module replicated
@!@!@ENDMSG 2280 @!@!@
@!@!@ENDMSG 1000 @!@!@
@!@!@STARTMSG 2121:1 @!@!@
The behavior up to this point is:
@!@!@ENDMSG 2121 @!@!@
@!@!@STARTMSG 2217:4 @!@!@
1: <Initial predicate>
/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL])
/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])])
/\ online = {b1, b2, b3, s1, s2, s3, p1, p2}
/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0])
@!@!@ENDMSG 2217 @!@!@
@!@!@STARTMSG 2103:1 @!@!@
The error occurred when TLC was evaluating the nested
expressions at the following positions:
0. Line 40, column 22 to line 44, column 71 in replicated
1. Line 40, column 32 to line 44, column 71 in replicated
2. Line 41, column 9 to line 44, column 71 in replicated
3. Line 44, column 12 to line 44, column 71 in replicated
4. Line 44, column 22 to line 44, column 71 in replicated
5. Line 44, column 24 to line 44, column 39 in replicated
@!@!@ENDMSG 2103 @!@!@
@!@!@STARTMSG 2201:0 @!@!@
The coverage statistics at 2025-01-19 18:27:00
@!@!@ENDMSG 2201 @!@!@
@!@!@STARTMSG 2773:0 @!@!@
<Init line 34, col 1 to line 34, col 4 of module replicated>: 1:1
@!@!@ENDMSG 2773 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 35, col 5 to line 38, col 26 of module replicated: 1
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<NodeOnlineOffline line 40, col 1 to line 40, col 17 of module replicated>: 0:0
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 40, col 22 to line 44, col 71 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 40, col 32 to line 44, col 71 of module replicated: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 41, col 9 to line 44, col 71 of module replicated: 464
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 41, col 12 to line 41, col 48 of module replicated: 464
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 42, col 12 to line 42, col 44 of module replicated: 208
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 43, col 12 to line 43, col 44 of module replicated: 86
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 44, col 12 to line 44, col 71 of module replicated: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 40, col 46 to line 40, col 62 of module replicated: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkCommit line 46, col 1 to line 46, col 16 of module replicated>: 0:0
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 53, col 13 to line 55, col 50 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 56, col 8 to line 56, col 51 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkPeerRecovery line 58, col 1 to line 58, col 21 of module replicated>: 0:0
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 61, col 8 to line 61, col 102 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 62, col 8 to line 62, col 51 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkPushToBroker line 64, col 1 to line 64, col 19 of module replicated>: 0:0
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 66, col 8 to line 73, col 29 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 74, col 8 to line 74, col 55 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<PsRecvBroker line 76, col 1 to line 76, col 19 of module replicated>: 0:0
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 83, col 13 to line 85, col 37 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 86, col 8 to line 86, col 51 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<PsChooseSk line 97, col 1 to line 97, col 13 of module replicated>: 0:0
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 99, col 8 to line 99, col 109 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 100, col 8 to line 100, col 51 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2202:0 @!@!@
End of statistics.
@!@!@ENDMSG 2202 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(1) at 2025-01-19 18:27:00: 1 states generated (24 s/min), 1 distinct states found (24 ds/min), 0 states left on queue.
@!@!@ENDMSG 2200 @!@!@
@!@!@STARTMSG 2199:0 @!@!@
1 states generated, 1 distinct states found, 0 states left on queue.
@!@!@ENDMSG 2199 @!@!@
@!@!@STARTMSG 2186:0 @!@!@
Finished in 2483ms at (2025-01-19 18:27:00)
@!@!@ENDMSG 2186 @!@!@
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737301172627/replicated.tla → storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307621596/replicated.tla
+20 -7
View File
@@ -1,8 +1,8 @@
---- MODULE replicated ----
EXTENDS Integers
EXTENDS Integers, FiniteSets
VARIABLES broker_state, safekeeper_state, pageserver_state
VARIABLES broker_state, safekeeper_state, pageserver_state, online
CONSTANT
@@ -29,14 +29,22 @@ StateConstraint ==
InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0]
InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]]
InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]]
InitOnline == safekeepers \cup brokers \cup pageservers
Init ==
/\ broker_state = [b \in brokers |-> InitBroker]
/\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper]
/\ pageserver_state = [p \in pageservers |-> InitPageserver]
/\ online = InitOnline
NodeOnlineOffline == online' = CHOOSE ss \in SUBSET InitOnline:
/\ Cardinality(ss \cap safekeepers) >= 2
/\ Cardinality(ss \cap brokers) >= 2
/\ ss \cap pageservers = pageservers \* assume no PS failures for now
/\ UNCHANGED <<safekeeper_state,broker_state,pageserver_state>>
SkCommit(s1, s2) ==
/\ {s1, s2} \subseteq online
/\ s1 # s2
/\ safekeeper_state[s1].commit_lsn = safekeeper_state[s2].commit_lsn
/\ LET
@@ -48,11 +56,13 @@ SkCommit(s1, s2) ==
/\ UNCHANGED <<broker_state, pageserver_state>>
SkPeerRecovery(s1,s2) ==
/\ {s1, s2} \subseteq online
/\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn
/\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn]
/\ UNCHANGED <<broker_state, pageserver_state>>
SkPushToBroker(s,b) ==
/\ {s, b} \subseteq online
/\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn
THEN
LET
@@ -64,6 +74,7 @@ SkPushToBroker(s,b) ==
/\ UNCHANGED <<safekeeper_state, pageserver_state>>
PsRecvBroker(b,p,s) ==
/\ {b,p,s} \subseteq online
/\ LET
bsk == broker_state[b].sk[s]
psk == pageserver_state[p].sk[s]
@@ -76,10 +87,12 @@ PsRecvBroker(b,p,s) ==
SksWithNewerWal(p) ==
LET
ps == pageserver_state[p]
IN
{s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn}
/\ {p} \subseteq online
/\
LET
ps == pageserver_state[p]
IN
{s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn}
PsChooseSk(p) ==
/\ SksWithNewerWal(p) # {}
@@ -88,7 +101,7 @@ PsChooseSk(p) ==
Next ==
\/ NodeOnlineOffline
\/ \E s1 \in safekeepers: \E s2 \in safekeepers:
\/ SkCommit(s1, s2)
\/ SkPeerRecovery(s1, s2)
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299469039/MC.cfg → storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307660221/MC.cfg
+9 -9
View File
@@ -19,33 +19,33 @@ az2 = az2
az3 = az3
\* MV CONSTANT definitions
CONSTANT
brokers <- const_1737299464992221000
brokers <- const_173730765610820000
\* CONSTANT declarations
CONSTANT NULL = NULL
\* MV CONSTANT definitions
CONSTANT
safekeepers <- const_1737299464992222000
safekeepers <- const_173730765610821000
\* MV CONSTANT definitions
CONSTANT
pageservers <- const_1737299464992223000
pageservers <- const_173730765610822000
\* MV CONSTANT definitions
CONSTANT
azs <- const_1737299464992224000
azs <- const_173730765610823000
\* SYMMETRY definition
SYMMETRY symm_1737299464992225000
SYMMETRY symm_173730765610824000
\* CONSTANT definitions
CONSTANT
max_commit_lsn <- const_1737299464992226000
max_commit_lsn <- const_173730765610825000
\* CONSTANT definitions
CONSTANT
az_mapping <- const_1737299464992227000
az_mapping <- const_173730765610826000
\* CONSTRAINT definition
CONSTRAINT
constr_1737299464992228000
constr_173730765610827000
\* SPECIFICATION definition
SPECIFICATION
Spec
\* PROPERTY definition
PROPERTY
EventuallyLaggingSkIsNotPreferredSk
\* Generated on Sun Jan 19 16:11:04 CET 2025
\* Generated on Sun Jan 19 18:27:36 CET 2025
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299381423/MC.out → storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307660221/MC.out
+86 -69
View File
@@ -2,31 +2,35 @@
TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802)
@!@!@ENDMSG 2262 @!@!@
@!@!@STARTMSG 2187:0 @!@!@
Running breadth-first search Model-Checking with fp 3 and seed -7432767478319300652 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 7681] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
Running breadth-first search Model-Checking with fp 70 and seed -383534902230932382 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11483] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
@!@!@ENDMSG 2187 @!@!@
@!@!@STARTMSG 2220:0 @!@!@
Starting SANY...
@!@!@ENDMSG 2220 @!@!@
Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/MC.tla
Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/fullmesh.tla
Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla
Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Semantic processing of module Naturals
Semantic processing of module Integers
Semantic processing of module fullmesh
Semantic processing of module Sequences
Semantic processing of module FiniteSets
Semantic processing of module replicated
Semantic processing of module TLC
Semantic processing of module MC
@!@!@STARTMSG 2219:0 @!@!@
SANY finished.
@!@!@ENDMSG 2219 @!@!@
@!@!@STARTMSG 2185:0 @!@!@
Starting... (2025-01-19 16:09:38)
Starting... (2025-01-19 18:27:37)
@!@!@ENDMSG 2185 @!@!@
@!@!@STARTMSG 2140:3 @!@!@
The subscript of the next-state relation specified by the specification
does not seem to contain the state variable online
@!@!@ENDMSG 2140 @!@!@
@!@!@STARTMSG 2279:3 @!@!@
Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined.
@!@!@ENDMSG 2279 @!@!@
@@ -40,10 +44,10 @@ Implied-temporal checking--satisfiability problem has 1 branches.
Computing initial states...
@!@!@ENDMSG 2189 @!@!@
@!@!@STARTMSG 2190:0 @!@!@
Finished computing initial states: 1 distinct state generated at 2025-01-19 16:09:40.
Finished computing initial states: 1 distinct state generated at 2025-01-19 18:27:38.
@!@!@ENDMSG 2190 @!@!@
@!@!@STARTMSG 2109:1 @!@!@
Successor state is not completely specified by action SkPeerRecovery of the next-state relation. The following variables are not assigned: broker_state, pageserver_state.
Successor state is not completely specified by action SkCommit of the next-state relation. The following variable is not assigned: online.
@!@!@ENDMSG 2109 @!@!@
@!@!@STARTMSG 2121:1 @!@!@
@@ -53,134 +57,147 @@ The behavior up to this point is:
1: <Initial predicate>
/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL])
/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])])
/\ online = {b1, b2, b3, s1, s2, s3, p1, p2}
/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0])
@!@!@ENDMSG 2217 @!@!@
@!@!@STARTMSG 2217:4 @!@!@
2: <SkCommit line 40, col 5 to line 47, col 51 of module fullmesh>
2: <SkCommit line 48, col 5 to line 57, col 51 of module replicated>
/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL])
/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])])
/\ safekeeper_state = (s1 :> [commit_lsn |-> 1, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0])
@!@!@ENDMSG 2217 @!@!@
@!@!@STARTMSG 2217:4 @!@!@
3: <SkPeerRecovery line 50, col 5 to line 51, col 102 of module fullmesh>
/\ pageserver_state = null
/\ broker_state = null
/\ online = null
/\ safekeeper_state = (s1 :> [commit_lsn |-> 1, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 1, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0])
@!@!@ENDMSG 2217 @!@!@
@!@!@STARTMSG 2201:0 @!@!@
The coverage statistics at 2025-01-19 16:09:40
The coverage statistics at 2025-01-19 18:27:38
@!@!@ENDMSG 2201 @!@!@
@!@!@STARTMSG 2773:0 @!@!@
<Init line 33, col 1 to line 33, col 4 of module fullmesh>: 2:2
<Init line 34, col 1 to line 34, col 4 of module replicated>: 1:1
@!@!@ENDMSG 2773 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 34, col 5 to line 36, col 64 of module fullmesh: 2
line 35, col 5 to line 38, col 26 of module replicated: 1
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkCommit line 39, col 1 to line 39, col 16 of module fullmesh>: 5:17
<NodeOnlineOffline line 40, col 1 to line 40, col 17 of module replicated>: 1:3
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 40, col 8 to line 40, col 72 of module fullmesh: 46
line 41, col 8 to line 44, col 44 of module replicated: 3
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 40, col 8 to line 40, col 38 of module fullmesh: 29
|line 41, col 18 to line 44, col 44 of module replicated: 3
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 40, col 42 to line 40, col 72 of module fullmesh: 29
||line 42, col 9 to line 44, col 44 of module replicated: 696
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 44, col 13 to line 46, col 50 of module fullmesh: 17
|||line 42, col 12 to line 42, col 48 of module replicated: 696
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 47, col 8 to line 47, col 51 of module fullmesh: 17
|||line 43, col 12 to line 43, col 44 of module replicated: 312
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 44, col 12 to line 44, col 44 of module replicated: 129
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 41, col 32 to line 41, col 48 of module replicated: 3
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 45, col 8 to line 45, col 67 of module replicated: 3
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkPeerRecovery line 49, col 1 to line 49, col 21 of module fullmesh>: 0:4
<SkCommit line 47, col 1 to line 47, col 16 of module replicated>: 0:3
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 50, col 8 to line 50, col 72 of module fullmesh: 1
line 48, col 8 to line 48, col 32 of module replicated: 7
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2775:0 @!@!@
|line 48, col 8 to line 48, col 15 of module replicated: 6:15
@!@!@ENDMSG 2775 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 48, col 27 to line 48, col 32 of module replicated: 6
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 50, col 8 to line 50, col 38 of module fullmesh: 28
line 49, col 8 to line 49, col 14 of module replicated: 7
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 50, col 42 to line 50, col 72 of module fullmesh: 28
|line 49, col 8 to line 49, col 9 of module replicated: 6
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 51, col 8 to line 51, col 102 of module fullmesh: 1
|line 49, col 13 to line 49, col 14 of module replicated: 6
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 51, col 28 to line 51, col 102 of module fullmesh: 4
line 50, col 8 to line 50, col 72 of module replicated: 4
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 50, col 8 to line 50, col 38 of module replicated: 3
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 50, col 42 to line 50, col 72 of module replicated: 3
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 54, col 13 to line 56, col 50 of module replicated: 1
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 54, col 33 to line 56, col 50 of module replicated: 3
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 57, col 8 to line 57, col 51 of module replicated: 1
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkPushToBroker line 53, col 1 to line 53, col 19 of module fullmesh>: 0:9
<SkPeerRecovery line 59, col 1 to line 59, col 21 of module replicated>: 0:0
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 54, col 8 to line 61, col 29 of module fullmesh: 9
line 60, col 8 to line 60, col 32 of module replicated: 3
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 62, col 8 to line 62, col 55 of module fullmesh: 9
line 61, col 8 to line 61, col 72 of module replicated: 3
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 62, col 8 to line 62, col 102 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 63, col 8 to line 63, col 51 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<PsRecvBroker line 64, col 1 to line 64, col 19 of module fullmesh>: 0:18
<SkPushToBroker line 65, col 1 to line 65, col 19 of module replicated>: 0:0
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 70, col 13 to line 72, col 37 of module fullmesh: 18
line 67, col 8 to line 74, col 29 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 73, col 8 to line 73, col 51 of module fullmesh: 18
line 75, col 8 to line 75, col 55 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<PsChooseSk line 82, col 1 to line 82, col 13 of module fullmesh>: 0:0
<PsRecvBroker line 77, col 1 to line 77, col 19 of module replicated>: 0:0
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 83, col 8 to line 83, col 30 of module fullmesh: 2
line 84, col 13 to line 86, col 37 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 83, col 8 to line 83, col 25 of module fullmesh: 2
line 87, col 8 to line 87, col 51 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<PsChooseSk line 98, col 1 to line 98, col 13 of module replicated>: 0:0
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 100, col 8 to line 100, col 109 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 78, col 15 to line 78, col 33 of module fullmesh: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 80, col 5 to line 80, col 66 of module fullmesh: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 80, col 26 to line 80, col 65 of module fullmesh: 6
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 80, col 12 to line 80, col 23 of module fullmesh: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 83, col 24 to line 83, col 24 of module fullmesh: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 83, col 29 to line 83, col 30 of module fullmesh: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 84, col 8 to line 84, col 109 of module fullmesh: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 85, col 8 to line 85, col 51 of module fullmesh: 0
line 101, col 8 to line 101, col 51 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2202:0 @!@!@
End of statistics.
@!@!@ENDMSG 2202 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(3) at 2025-01-19 16:09:40: 46 states generated (1.044 s/min), 6 distinct states found (136 ds/min), 2 states left on queue.
Progress(2) at 2025-01-19 18:27:38: 5 states generated (121 s/min), 2 distinct states found (48 ds/min), 0 states left on queue.
@!@!@ENDMSG 2200 @!@!@
@!@!@STARTMSG 2199:0 @!@!@
46 states generated, 6 distinct states found, 2 states left on queue.
5 states generated, 2 distinct states found, 0 states left on queue.
@!@!@ENDMSG 2199 @!@!@
@!@!@STARTMSG 2194:0 @!@!@
The depth of the complete state graph search is 3.
The depth of the complete state graph search is 2.
@!@!@ENDMSG 2194 @!@!@
@!@!@STARTMSG 2268:0 @!@!@
The average outdegree of the complete state graph is 2 (minimum is 2, the maximum 2 and the 95th percentile is 2).
@!@!@ENDMSG 2268 @!@!@
@!@!@STARTMSG 2186:0 @!@!@
Finished in 2658ms at (2025-01-19 16:09:40)
Finished in 2493ms at (2025-01-19 18:27:38)
@!@!@ENDMSG 2186 @!@!@
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737297534393/MC.tla → storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307660221/MC.tla
+11 -11
View File
@@ -1,5 +1,5 @@
---- MODULE MC ----
EXTENDS fullmesh, TLC
EXTENDS replicated, TLC
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
@@ -22,44 +22,44 @@ az1, az2, az3
----
\* MV CONSTANT definitions brokers
const_1737297530693169000 ==
const_173730765610820000 ==
{b1, b2, b3}
----
\* MV CONSTANT definitions safekeepers
const_1737297530694170000 ==
const_173730765610821000 ==
{s1, s2, s3}
----
\* MV CONSTANT definitions pageservers
const_1737297530694171000 ==
const_173730765610822000 ==
{p1, p2}
----
\* MV CONSTANT definitions azs
const_1737297530694172000 ==
const_173730765610823000 ==
{az1, az2, az3}
----
\* SYMMETRY definition
symm_1737297530694173000 ==
Permutations(const_1737297530693169000) \union Permutations(const_1737297530694170000) \union Permutations(const_1737297530694171000) \union Permutations(const_1737297530694172000)
symm_173730765610824000 ==
Permutations(const_173730765610820000) \union Permutations(const_173730765610821000) \union Permutations(const_173730765610822000) \union Permutations(const_173730765610823000)
----
\* CONSTANT definitions @modelParameterConstants:4max_commit_lsn
const_1737297530694174000 ==
const_173730765610825000 ==
2
----
\* CONSTANT definitions @modelParameterConstants:5az_mapping
const_1737297530694175000 ==
const_173730765610826000 ==
[ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2,p2} , az3 |-> {b3,s3}]
----
\* CONSTRAINT definition @modelParameterContraint:0
constr_1737297530694176000 ==
constr_173730765610827000 ==
StateConstraint
----
=============================================================================
\* Modification History
\* Created Sun Jan 19 15:38:50 CET 2025 by cs
\* Created Sun Jan 19 18:27:36 CET 2025 by cs
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299381423/MC_TE.out → storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307660221/MC_TE.out
+86 -69
View File
@@ -2,31 +2,35 @@
TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802)
@!@!@ENDMSG 2262 @!@!@
@!@!@STARTMSG 2187:0 @!@!@
Running breadth-first search Model-Checking with fp 3 and seed -7432767478319300652 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 7681] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
Running breadth-first search Model-Checking with fp 70 and seed -383534902230932382 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11483] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
@!@!@ENDMSG 2187 @!@!@
@!@!@STARTMSG 2220:0 @!@!@
Starting SANY...
@!@!@ENDMSG 2220 @!@!@
Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/MC.tla
Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/fullmesh.tla
Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla
Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Semantic processing of module Naturals
Semantic processing of module Integers
Semantic processing of module fullmesh
Semantic processing of module Sequences
Semantic processing of module FiniteSets
Semantic processing of module replicated
Semantic processing of module TLC
Semantic processing of module MC
@!@!@STARTMSG 2219:0 @!@!@
SANY finished.
@!@!@ENDMSG 2219 @!@!@
@!@!@STARTMSG 2185:0 @!@!@
Starting... (2025-01-19 16:09:38)
Starting... (2025-01-19 18:27:37)
@!@!@ENDMSG 2185 @!@!@
@!@!@STARTMSG 2140:3 @!@!@
The subscript of the next-state relation specified by the specification
does not seem to contain the state variable online
@!@!@ENDMSG 2140 @!@!@
@!@!@STARTMSG 2279:3 @!@!@
Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined.
@!@!@ENDMSG 2279 @!@!@
@@ -40,10 +44,10 @@ Implied-temporal checking--satisfiability problem has 1 branches.
Computing initial states...
@!@!@ENDMSG 2189 @!@!@
@!@!@STARTMSG 2190:0 @!@!@
Finished computing initial states: 1 distinct state generated at 2025-01-19 16:09:40.
Finished computing initial states: 1 distinct state generated at 2025-01-19 18:27:38.
@!@!@ENDMSG 2190 @!@!@
@!@!@STARTMSG 2109:1 @!@!@
Successor state is not completely specified by action SkPeerRecovery of the next-state relation. The following variables are not assigned: broker_state, pageserver_state.
Successor state is not completely specified by action SkCommit of the next-state relation. The following variable is not assigned: online.
@!@!@ENDMSG 2109 @!@!@
@!@!@STARTMSG 2121:1 @!@!@
@@ -53,134 +57,147 @@ The behavior up to this point is:
1: <Initial predicate>
/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL])
/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])])
/\ online = {b1, b2, b3, s1, s2, s3, p1, p2}
/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0])
@!@!@ENDMSG 2217 @!@!@
@!@!@STARTMSG 2217:4 @!@!@
2: <SkCommit line 40, col 5 to line 47, col 51 of module fullmesh>
2: <SkCommit line 48, col 5 to line 57, col 51 of module replicated>
/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL])
/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])])
/\ safekeeper_state = (s1 :> [commit_lsn |-> 1, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0])
@!@!@ENDMSG 2217 @!@!@
@!@!@STARTMSG 2217:4 @!@!@
3: <SkPeerRecovery line 50, col 5 to line 51, col 102 of module fullmesh>
/\ pageserver_state = null
/\ broker_state = null
/\ online = null
/\ safekeeper_state = (s1 :> [commit_lsn |-> 1, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 1, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0])
@!@!@ENDMSG 2217 @!@!@
@!@!@STARTMSG 2201:0 @!@!@
The coverage statistics at 2025-01-19 16:09:40
The coverage statistics at 2025-01-19 18:27:38
@!@!@ENDMSG 2201 @!@!@
@!@!@STARTMSG 2773:0 @!@!@
<Init line 33, col 1 to line 33, col 4 of module fullmesh>: 2:2
<Init line 34, col 1 to line 34, col 4 of module replicated>: 1:1
@!@!@ENDMSG 2773 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 34, col 5 to line 36, col 64 of module fullmesh: 2
line 35, col 5 to line 38, col 26 of module replicated: 1
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkCommit line 39, col 1 to line 39, col 16 of module fullmesh>: 5:17
<NodeOnlineOffline line 40, col 1 to line 40, col 17 of module replicated>: 1:3
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 40, col 8 to line 40, col 72 of module fullmesh: 46
line 41, col 8 to line 44, col 44 of module replicated: 3
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 40, col 8 to line 40, col 38 of module fullmesh: 29
|line 41, col 18 to line 44, col 44 of module replicated: 3
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 40, col 42 to line 40, col 72 of module fullmesh: 29
||line 42, col 9 to line 44, col 44 of module replicated: 696
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 44, col 13 to line 46, col 50 of module fullmesh: 17
|||line 42, col 12 to line 42, col 48 of module replicated: 696
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 47, col 8 to line 47, col 51 of module fullmesh: 17
|||line 43, col 12 to line 43, col 44 of module replicated: 312
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 44, col 12 to line 44, col 44 of module replicated: 129
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 41, col 32 to line 41, col 48 of module replicated: 3
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 45, col 8 to line 45, col 67 of module replicated: 3
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkPeerRecovery line 49, col 1 to line 49, col 21 of module fullmesh>: 0:4
<SkCommit line 47, col 1 to line 47, col 16 of module replicated>: 0:3
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 50, col 8 to line 50, col 72 of module fullmesh: 1
line 48, col 8 to line 48, col 32 of module replicated: 7
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2775:0 @!@!@
|line 48, col 8 to line 48, col 15 of module replicated: 6:15
@!@!@ENDMSG 2775 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 48, col 27 to line 48, col 32 of module replicated: 6
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 50, col 8 to line 50, col 38 of module fullmesh: 28
line 49, col 8 to line 49, col 14 of module replicated: 7
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 50, col 42 to line 50, col 72 of module fullmesh: 28
|line 49, col 8 to line 49, col 9 of module replicated: 6
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 51, col 8 to line 51, col 102 of module fullmesh: 1
|line 49, col 13 to line 49, col 14 of module replicated: 6
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 51, col 28 to line 51, col 102 of module fullmesh: 4
line 50, col 8 to line 50, col 72 of module replicated: 4
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 50, col 8 to line 50, col 38 of module replicated: 3
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 50, col 42 to line 50, col 72 of module replicated: 3
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 54, col 13 to line 56, col 50 of module replicated: 1
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 54, col 33 to line 56, col 50 of module replicated: 3
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 57, col 8 to line 57, col 51 of module replicated: 1
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkPushToBroker line 53, col 1 to line 53, col 19 of module fullmesh>: 0:9
<SkPeerRecovery line 59, col 1 to line 59, col 21 of module replicated>: 0:0
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 54, col 8 to line 61, col 29 of module fullmesh: 9
line 60, col 8 to line 60, col 32 of module replicated: 3
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 62, col 8 to line 62, col 55 of module fullmesh: 9
line 61, col 8 to line 61, col 72 of module replicated: 3
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 62, col 8 to line 62, col 102 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 63, col 8 to line 63, col 51 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<PsRecvBroker line 64, col 1 to line 64, col 19 of module fullmesh>: 0:18
<SkPushToBroker line 65, col 1 to line 65, col 19 of module replicated>: 0:0
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 70, col 13 to line 72, col 37 of module fullmesh: 18
line 67, col 8 to line 74, col 29 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 73, col 8 to line 73, col 51 of module fullmesh: 18
line 75, col 8 to line 75, col 55 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<PsChooseSk line 82, col 1 to line 82, col 13 of module fullmesh>: 0:0
<PsRecvBroker line 77, col 1 to line 77, col 19 of module replicated>: 0:0
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 83, col 8 to line 83, col 30 of module fullmesh: 2
line 84, col 13 to line 86, col 37 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 83, col 8 to line 83, col 25 of module fullmesh: 2
line 87, col 8 to line 87, col 51 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<PsChooseSk line 98, col 1 to line 98, col 13 of module replicated>: 0:0
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 100, col 8 to line 100, col 109 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 78, col 15 to line 78, col 33 of module fullmesh: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 80, col 5 to line 80, col 66 of module fullmesh: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 80, col 26 to line 80, col 65 of module fullmesh: 6
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 80, col 12 to line 80, col 23 of module fullmesh: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 83, col 24 to line 83, col 24 of module fullmesh: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 83, col 29 to line 83, col 30 of module fullmesh: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 84, col 8 to line 84, col 109 of module fullmesh: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 85, col 8 to line 85, col 51 of module fullmesh: 0
line 101, col 8 to line 101, col 51 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2202:0 @!@!@
End of statistics.
@!@!@ENDMSG 2202 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(3) at 2025-01-19 16:09:40: 46 states generated (1.044 s/min), 6 distinct states found (136 ds/min), 2 states left on queue.
Progress(2) at 2025-01-19 18:27:38: 5 states generated (121 s/min), 2 distinct states found (48 ds/min), 0 states left on queue.
@!@!@ENDMSG 2200 @!@!@
@!@!@STARTMSG 2199:0 @!@!@
46 states generated, 6 distinct states found, 2 states left on queue.
5 states generated, 2 distinct states found, 0 states left on queue.
@!@!@ENDMSG 2199 @!@!@
@!@!@STARTMSG 2194:0 @!@!@
The depth of the complete state graph search is 3.
The depth of the complete state graph search is 2.
@!@!@ENDMSG 2194 @!@!@
@!@!@STARTMSG 2268:0 @!@!@
The average outdegree of the complete state graph is 2 (minimum is 2, the maximum 2 and the 95th percentile is 2).
@!@!@ENDMSG 2268 @!@!@
@!@!@STARTMSG 2186:0 @!@!@
Finished in 2658ms at (2025-01-19 16:09:40)
Finished in 2493ms at (2025-01-19 18:27:38)
@!@!@ENDMSG 2186 @!@!@
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299744229/fullmesh.tla → storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307660221/replicated.tla
+22 -8
View File
@@ -1,8 +1,8 @@
---- MODULE fullmesh ----
---- MODULE replicated ----
EXTENDS Integers
EXTENDS Integers, FiniteSets
VARIABLES broker_state, safekeeper_state, pageserver_state
VARIABLES broker_state, safekeeper_state, pageserver_state, online
CONSTANT
@@ -29,14 +29,23 @@ StateConstraint ==
InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0]
InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]]
InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]]
InitOnline == safekeepers \cup brokers \cup pageservers
Init ==
/\ broker_state = [b \in brokers |-> InitBroker]
/\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper]
/\ pageserver_state = [p \in pageservers |-> InitPageserver]
/\ online = InitOnline
NodeOnlineOffline ==
/\ online' = CHOOSE ss \in SUBSET InitOnline:
/\ Cardinality(ss \cap safekeepers) >= 2
/\ Cardinality(ss \cap brokers) >= 2
/\ ss \cap pageservers = pageservers \* assume no PS failures for now
/\ UNCHANGED <<safekeeper_state,broker_state,pageserver_state>>
SkCommit(s1, s2) ==
/\ {s1, s2} \subseteq online
/\ s1 # s2
/\ safekeeper_state[s1].commit_lsn = safekeeper_state[s2].commit_lsn
/\ LET
@@ -48,11 +57,13 @@ SkCommit(s1, s2) ==
/\ UNCHANGED <<broker_state, pageserver_state>>
SkPeerRecovery(s1,s2) ==
/\ {s1, s2} \subseteq online
/\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn
/\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn]
/\ UNCHANGED <<broker_state, pageserver_state>>
SkPushToBroker(s,b) ==
/\ {s, b} \subseteq online
/\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn
THEN
LET
@@ -64,6 +75,7 @@ SkPushToBroker(s,b) ==
/\ UNCHANGED <<safekeeper_state, pageserver_state>>
PsRecvBroker(b,p,s) ==
/\ {b,p,s} \subseteq online
/\ LET
bsk == broker_state[b].sk[s]
psk == pageserver_state[p].sk[s]
@@ -76,10 +88,12 @@ PsRecvBroker(b,p,s) ==
SksWithNewerWal(p) ==
LET
ps == pageserver_state[p]
IN
{s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn}
/\ {p} \subseteq online
/\
LET
ps == pageserver_state[p]
IN
{s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn}
PsChooseSk(p) ==
/\ SksWithNewerWal(p) # {}
@@ -88,7 +102,7 @@ PsChooseSk(p) ==
Next ==
\/ NodeOnlineOffline
\/ \E s1 \in safekeepers: \E s2 \in safekeepers:
\/ SkCommit(s1, s2)
\/ SkPeerRecovery(s1, s2)
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299542008/MC.cfg → storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307704621/MC.cfg
+9 -9
View File
@@ -19,33 +19,33 @@ az2 = az2
az3 = az3
\* MV CONSTANT definitions
CONSTANT
brokers <- const_1737299528165230000
brokers <- const_173730770045629000
\* CONSTANT declarations
CONSTANT NULL = NULL
\* MV CONSTANT definitions
CONSTANT
safekeepers <- const_1737299528166231000
safekeepers <- const_173730770045630000
\* MV CONSTANT definitions
CONSTANT
pageservers <- const_1737299528166232000
pageservers <- const_173730770045731000
\* MV CONSTANT definitions
CONSTANT
azs <- const_1737299528166233000
azs <- const_173730770045732000
\* SYMMETRY definition
SYMMETRY symm_1737299528166234000
SYMMETRY symm_173730770045733000
\* CONSTANT definitions
CONSTANT
max_commit_lsn <- const_1737299528166235000
max_commit_lsn <- const_173730770045734000
\* CONSTANT definitions
CONSTANT
az_mapping <- const_1737299528166236000
az_mapping <- const_173730770045735000
\* CONSTRAINT definition
CONSTRAINT
constr_1737299528166237000
constr_173730770045736000
\* SPECIFICATION definition
SPECIFICATION
Spec
\* PROPERTY definition
PROPERTY
EventuallyLaggingSkIsNotPreferredSk
\* Generated on Sun Jan 19 16:12:08 CET 2025
\* Generated on Sun Jan 19 18:28:20 CET 2025
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307704621/MC.out
+282
View File
@@ -0,0 +1,282 @@
@!@!@STARTMSG 2262:0 @!@!@
TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802)
@!@!@ENDMSG 2262 @!@!@
@!@!@STARTMSG 2187:0 @!@!@
Running breadth-first search Model-Checking with fp 128 and seed -4991617861993001241 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11510] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
@!@!@ENDMSG 2187 @!@!@
@!@!@STARTMSG 2220:0 @!@!@
Starting SANY...
@!@!@ENDMSG 2220 @!@!@
Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla
Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla
Semantic processing of module Naturals
Semantic processing of module Integers
Semantic processing of module Sequences
Semantic processing of module FiniteSets
Semantic processing of module replicated
Semantic processing of module TLC
Semantic processing of module MC
@!@!@STARTMSG 2219:0 @!@!@
SANY finished.
@!@!@ENDMSG 2219 @!@!@
@!@!@STARTMSG 2185:0 @!@!@
Starting... (2025-01-19 18:28:21)
@!@!@ENDMSG 2185 @!@!@
@!@!@STARTMSG 2279:3 @!@!@
Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined.
@!@!@ENDMSG 2279 @!@!@
@!@!@STARTMSG 2284:3 @!@!@
Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details.
@!@!@ENDMSG 2284 @!@!@
@!@!@STARTMSG 2212:0 @!@!@
Implied-temporal checking--satisfiability problem has 1 branches.
@!@!@ENDMSG 2212 @!@!@
@!@!@STARTMSG 2189:0 @!@!@
Computing initial states...
@!@!@ENDMSG 2189 @!@!@
@!@!@STARTMSG 2190:0 @!@!@
Finished computing initial states: 1 distinct state generated at 2025-01-19 18:28:23.
@!@!@ENDMSG 2190 @!@!@
@!@!@STARTMSG 1000:1 @!@!@
TLC threw an unexpected exception.
This was probably caused by an error in the spec or model.
See the User Output or TLC Console for clues to what happened.
The exception was a java.lang.RuntimeException
: A non-boolean expression (a set of the form {e1, ... ,eN}) was used as a formula in a conjunction.
line 93, col 9 to line 96, col 70 of module replicated
@!@!@ENDMSG 1000 @!@!@
@!@!@STARTMSG 2121:1 @!@!@
The behavior up to this point is:
@!@!@ENDMSG 2121 @!@!@
@!@!@STARTMSG 2217:4 @!@!@
1: <Initial predicate>
/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL])
/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])])
/\ online = {b1, b2, b3, s1, s2, s3, p1, p2}
/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0])
@!@!@ENDMSG 2217 @!@!@
@!@!@STARTMSG 2217:4 @!@!@
2: <NodeOnlineOffline line 41, col 5 to line 45, col 67 of module replicated>
/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL])
/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])])
/\ online = {b1, b2, s1, s2, p1, p2}
/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0])
@!@!@ENDMSG 2217 @!@!@
@!@!@STARTMSG 2103:1 @!@!@
The error occurred when TLC was evaluating the nested
expressions at the following positions:
0. Line 99, column 5 to line 101, column 58 in replicated
1. Line 99, column 8 to line 99, column 30 in replicated
2. Line 99, column 8 to line 99, column 25 in replicated
3. Line 91, column 5 to line 96, column 70 in replicated
@!@!@ENDMSG 2103 @!@!@
@!@!@STARTMSG 2201:0 @!@!@
The coverage statistics at 2025-01-19 18:28:23
@!@!@ENDMSG 2201 @!@!@
@!@!@STARTMSG 2773:0 @!@!@
<Init line 34, col 1 to line 34, col 4 of module replicated>: 2:2
@!@!@ENDMSG 2773 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 35, col 5 to line 38, col 26 of module replicated: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<NodeOnlineOffline line 40, col 1 to line 40, col 17 of module replicated>: 1:6
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 41, col 8 to line 44, col 44 of module replicated: 6
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 41, col 18 to line 44, col 44 of module replicated: 6
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 42, col 9 to line 44, col 44 of module replicated: 1392
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 42, col 12 to line 42, col 48 of module replicated: 1392
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 43, col 12 to line 43, col 44 of module replicated: 624
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 44, col 12 to line 44, col 44 of module replicated: 258
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 41, col 32 to line 41, col 48 of module replicated: 6
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 45, col 8 to line 45, col 67 of module replicated: 6
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkCommit line 47, col 1 to line 47, col 16 of module replicated>: 4:14
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 48, col 8 to line 48, col 32 of module replicated: 59
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2775:0 @!@!@
|line 48, col 8 to line 48, col 15 of module replicated: 45:105
@!@!@ENDMSG 2775 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 48, col 27 to line 48, col 32 of module replicated: 45
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 49, col 8 to line 49, col 14 of module replicated: 44
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 49, col 8 to line 49, col 9 of module replicated: 30
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 49, col 13 to line 49, col 14 of module replicated: 30
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 50, col 8 to line 50, col 72 of module replicated: 32
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 50, col 8 to line 50, col 38 of module replicated: 18
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 50, col 42 to line 50, col 72 of module replicated: 18
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 54, col 13 to line 56, col 50 of module replicated: 14
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 57, col 8 to line 57, col 58 of module replicated: 14
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkPeerRecovery line 59, col 1 to line 59, col 21 of module replicated>: 1:2
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 60, col 8 to line 60, col 32 of module replicated: 47
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2775:0 @!@!@
|line 60, col 8 to line 60, col 15 of module replicated: 45:105
@!@!@ENDMSG 2775 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 60, col 27 to line 60, col 32 of module replicated: 45
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 61, col 8 to line 61, col 72 of module replicated: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 61, col 8 to line 61, col 38 of module replicated: 30
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 61, col 42 to line 61, col 72 of module replicated: 30
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 62, col 8 to line 62, col 102 of module replicated: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 63, col 8 to line 63, col 58 of module replicated: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkPushToBroker line 65, col 1 to line 65, col 19 of module replicated>: 2:30
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 66, col 8 to line 66, col 30 of module replicated: 75
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2775:0 @!@!@
|line 66, col 8 to line 66, col 13 of module replicated: 45:111
@!@!@ENDMSG 2775 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 66, col 25 to line 66, col 30 of module replicated: 45
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 67, col 8 to line 74, col 29 of module replicated: 30
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 67, col 24 to line 74, col 29 of module replicated: 30
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 67, col 27 to line 67, col 91 of module replicated: 30
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 70, col 28 to line 70, col 45 of module replicated: 10
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 71, col 31 to line 71, col 91 of module replicated: 10
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 73, col 17 to line 73, col 54 of module replicated: 10
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 74, col 18 to line 74, col 29 of module replicated: 20
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 75, col 8 to line 75, col 62 of module replicated: 30
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<PsRecvBroker line 77, col 1 to line 77, col 19 of module replicated>: 0:60
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 78, col 8 to line 78, col 31 of module replicated: 150
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2775:0 @!@!@
|line 78, col 8 to line 78, col 14 of module replicated: 90:282
@!@!@ENDMSG 2775 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 78, col 26 to line 78, col 31 of module replicated: 90
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 84, col 13 to line 86, col 37 of module replicated: 60
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 87, col 8 to line 87, col 58 of module replicated: 60
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<PsChooseSk line 98, col 1 to line 98, col 13 of module replicated>: 0:0
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 99, col 8 to line 99, col 30 of module replicated: 5
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 99, col 8 to line 99, col 25 of module replicated: 5
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 91, col 5 to line 96, col 70 of module replicated: 5
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 91, col 8 to line 91, col 27 of module replicated: 5
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 94, col 19 to line 94, col 37 of module replicated: 5
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 96, col 9 to line 96, col 70 of module replicated: 5
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||||line 96, col 30 to line 96, col 69 of module replicated: 15
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||||line 96, col 16 to line 96, col 27 of module replicated: 5
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 99, col 24 to line 99, col 24 of module replicated: 5
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 100, col 8 to line 100, col 109 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 101, col 8 to line 101, col 58 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2202:0 @!@!@
End of statistics.
@!@!@ENDMSG 2202 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(4) at 2025-01-19 18:28:23: 97 states generated (2.165 s/min), 9 distinct states found (200 ds/min), 5 states left on queue.
@!@!@ENDMSG 2200 @!@!@
@!@!@STARTMSG 2199:0 @!@!@
97 states generated, 9 distinct states found, 5 states left on queue.
@!@!@ENDMSG 2199 @!@!@
@!@!@STARTMSG 2186:0 @!@!@
Finished in 2701ms at (2025-01-19 18:28:23)
@!@!@ENDMSG 2186 @!@!@
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299352762/MC.tla → storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307704621/MC.tla
+11 -11
View File
@@ -1,5 +1,5 @@
---- MODULE MC ----
EXTENDS fullmesh, TLC
EXTENDS replicated, TLC
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
@@ -22,44 +22,44 @@ az1, az2, az3
----
\* MV CONSTANT definitions brokers
const_1737299350679194000 ==
const_173730770045629000 ==
{b1, b2, b3}
----
\* MV CONSTANT definitions safekeepers
const_1737299350679195000 ==
const_173730770045630000 ==
{s1, s2, s3}
----
\* MV CONSTANT definitions pageservers
const_1737299350679196000 ==
const_173730770045731000 ==
{p1, p2}
----
\* MV CONSTANT definitions azs
const_1737299350679197000 ==
const_173730770045732000 ==
{az1, az2, az3}
----
\* SYMMETRY definition
symm_1737299350679198000 ==
Permutations(const_1737299350679194000) \union Permutations(const_1737299350679195000) \union Permutations(const_1737299350679196000) \union Permutations(const_1737299350679197000)
symm_173730770045733000 ==
Permutations(const_173730770045629000) \union Permutations(const_173730770045630000) \union Permutations(const_173730770045731000) \union Permutations(const_173730770045732000)
----
\* CONSTANT definitions @modelParameterConstants:4max_commit_lsn
const_1737299350679199000 ==
const_173730770045734000 ==
2
----
\* CONSTANT definitions @modelParameterConstants:5az_mapping
const_1737299350679200000 ==
const_173730770045735000 ==
[ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2,p2} , az3 |-> {b3,s3}]
----
\* CONSTRAINT definition @modelParameterContraint:0
constr_1737299350680201000 ==
constr_173730770045736000 ==
StateConstraint
----
=============================================================================
\* Modification History
\* Created Sun Jan 19 16:09:10 CET 2025 by cs
\* Created Sun Jan 19 18:28:20 CET 2025 by cs
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307704621/MC_TE.out
+282
View File
@@ -0,0 +1,282 @@
@!@!@STARTMSG 2262:0 @!@!@
TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802)
@!@!@ENDMSG 2262 @!@!@
@!@!@STARTMSG 2187:0 @!@!@
Running breadth-first search Model-Checking with fp 128 and seed -4991617861993001241 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11510] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
@!@!@ENDMSG 2187 @!@!@
@!@!@STARTMSG 2220:0 @!@!@
Starting SANY...
@!@!@ENDMSG 2220 @!@!@
Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla
Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla
Semantic processing of module Naturals
Semantic processing of module Integers
Semantic processing of module Sequences
Semantic processing of module FiniteSets
Semantic processing of module replicated
Semantic processing of module TLC
Semantic processing of module MC
@!@!@STARTMSG 2219:0 @!@!@
SANY finished.
@!@!@ENDMSG 2219 @!@!@
@!@!@STARTMSG 2185:0 @!@!@
Starting... (2025-01-19 18:28:21)
@!@!@ENDMSG 2185 @!@!@
@!@!@STARTMSG 2279:3 @!@!@
Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined.
@!@!@ENDMSG 2279 @!@!@
@!@!@STARTMSG 2284:3 @!@!@
Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details.
@!@!@ENDMSG 2284 @!@!@
@!@!@STARTMSG 2212:0 @!@!@
Implied-temporal checking--satisfiability problem has 1 branches.
@!@!@ENDMSG 2212 @!@!@
@!@!@STARTMSG 2189:0 @!@!@
Computing initial states...
@!@!@ENDMSG 2189 @!@!@
@!@!@STARTMSG 2190:0 @!@!@
Finished computing initial states: 1 distinct state generated at 2025-01-19 18:28:23.
@!@!@ENDMSG 2190 @!@!@
@!@!@STARTMSG 1000:1 @!@!@
TLC threw an unexpected exception.
This was probably caused by an error in the spec or model.
See the User Output or TLC Console for clues to what happened.
The exception was a java.lang.RuntimeException
: A non-boolean expression (a set of the form {e1, ... ,eN}) was used as a formula in a conjunction.
line 93, col 9 to line 96, col 70 of module replicated
@!@!@ENDMSG 1000 @!@!@
@!@!@STARTMSG 2121:1 @!@!@
The behavior up to this point is:
@!@!@ENDMSG 2121 @!@!@
@!@!@STARTMSG 2217:4 @!@!@
1: <Initial predicate>
/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL])
/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])])
/\ online = {b1, b2, b3, s1, s2, s3, p1, p2}
/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0])
@!@!@ENDMSG 2217 @!@!@
@!@!@STARTMSG 2217:4 @!@!@
2: <NodeOnlineOffline line 41, col 5 to line 45, col 67 of module replicated>
/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL])
/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])])
/\ online = {b1, b2, s1, s2, p1, p2}
/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0])
@!@!@ENDMSG 2217 @!@!@
@!@!@STARTMSG 2103:1 @!@!@
The error occurred when TLC was evaluating the nested
expressions at the following positions:
0. Line 99, column 5 to line 101, column 58 in replicated
1. Line 99, column 8 to line 99, column 30 in replicated
2. Line 99, column 8 to line 99, column 25 in replicated
3. Line 91, column 5 to line 96, column 70 in replicated
@!@!@ENDMSG 2103 @!@!@
@!@!@STARTMSG 2201:0 @!@!@
The coverage statistics at 2025-01-19 18:28:23
@!@!@ENDMSG 2201 @!@!@
@!@!@STARTMSG 2773:0 @!@!@
<Init line 34, col 1 to line 34, col 4 of module replicated>: 2:2
@!@!@ENDMSG 2773 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 35, col 5 to line 38, col 26 of module replicated: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<NodeOnlineOffline line 40, col 1 to line 40, col 17 of module replicated>: 1:6
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 41, col 8 to line 44, col 44 of module replicated: 6
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 41, col 18 to line 44, col 44 of module replicated: 6
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 42, col 9 to line 44, col 44 of module replicated: 1392
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 42, col 12 to line 42, col 48 of module replicated: 1392
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 43, col 12 to line 43, col 44 of module replicated: 624
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 44, col 12 to line 44, col 44 of module replicated: 258
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 41, col 32 to line 41, col 48 of module replicated: 6
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 45, col 8 to line 45, col 67 of module replicated: 6
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkCommit line 47, col 1 to line 47, col 16 of module replicated>: 4:14
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 48, col 8 to line 48, col 32 of module replicated: 59
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2775:0 @!@!@
|line 48, col 8 to line 48, col 15 of module replicated: 45:105
@!@!@ENDMSG 2775 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 48, col 27 to line 48, col 32 of module replicated: 45
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 49, col 8 to line 49, col 14 of module replicated: 44
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 49, col 8 to line 49, col 9 of module replicated: 30
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 49, col 13 to line 49, col 14 of module replicated: 30
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 50, col 8 to line 50, col 72 of module replicated: 32
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 50, col 8 to line 50, col 38 of module replicated: 18
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 50, col 42 to line 50, col 72 of module replicated: 18
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 54, col 13 to line 56, col 50 of module replicated: 14
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 57, col 8 to line 57, col 58 of module replicated: 14
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkPeerRecovery line 59, col 1 to line 59, col 21 of module replicated>: 1:2
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 60, col 8 to line 60, col 32 of module replicated: 47
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2775:0 @!@!@
|line 60, col 8 to line 60, col 15 of module replicated: 45:105
@!@!@ENDMSG 2775 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 60, col 27 to line 60, col 32 of module replicated: 45
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 61, col 8 to line 61, col 72 of module replicated: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 61, col 8 to line 61, col 38 of module replicated: 30
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 61, col 42 to line 61, col 72 of module replicated: 30
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 62, col 8 to line 62, col 102 of module replicated: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 63, col 8 to line 63, col 58 of module replicated: 2
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkPushToBroker line 65, col 1 to line 65, col 19 of module replicated>: 2:30
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 66, col 8 to line 66, col 30 of module replicated: 75
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2775:0 @!@!@
|line 66, col 8 to line 66, col 13 of module replicated: 45:111
@!@!@ENDMSG 2775 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 66, col 25 to line 66, col 30 of module replicated: 45
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 67, col 8 to line 74, col 29 of module replicated: 30
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 67, col 24 to line 74, col 29 of module replicated: 30
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 67, col 27 to line 67, col 91 of module replicated: 30
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 70, col 28 to line 70, col 45 of module replicated: 10
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 71, col 31 to line 71, col 91 of module replicated: 10
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 73, col 17 to line 73, col 54 of module replicated: 10
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 74, col 18 to line 74, col 29 of module replicated: 20
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 75, col 8 to line 75, col 62 of module replicated: 30
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<PsRecvBroker line 77, col 1 to line 77, col 19 of module replicated>: 0:60
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 78, col 8 to line 78, col 31 of module replicated: 150
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2775:0 @!@!@
|line 78, col 8 to line 78, col 14 of module replicated: 90:282
@!@!@ENDMSG 2775 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 78, col 26 to line 78, col 31 of module replicated: 90
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 84, col 13 to line 86, col 37 of module replicated: 60
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 87, col 8 to line 87, col 58 of module replicated: 60
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<PsChooseSk line 98, col 1 to line 98, col 13 of module replicated>: 0:0
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 99, col 8 to line 99, col 30 of module replicated: 5
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 99, col 8 to line 99, col 25 of module replicated: 5
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 91, col 5 to line 96, col 70 of module replicated: 5
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 91, col 8 to line 91, col 27 of module replicated: 5
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 94, col 19 to line 94, col 37 of module replicated: 5
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 96, col 9 to line 96, col 70 of module replicated: 5
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||||line 96, col 30 to line 96, col 69 of module replicated: 15
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||||line 96, col 16 to line 96, col 27 of module replicated: 5
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 99, col 24 to line 99, col 24 of module replicated: 5
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 100, col 8 to line 100, col 109 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 101, col 8 to line 101, col 58 of module replicated: 0
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2202:0 @!@!@
End of statistics.
@!@!@ENDMSG 2202 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(4) at 2025-01-19 18:28:23: 97 states generated (2.165 s/min), 9 distinct states found (200 ds/min), 5 states left on queue.
@!@!@ENDMSG 2200 @!@!@
@!@!@STARTMSG 2199:0 @!@!@
97 states generated, 9 distinct states found, 5 states left on queue.
@!@!@ENDMSG 2199 @!@!@
@!@!@STARTMSG 2186:0 @!@!@
Finished in 2701ms at (2025-01-19 18:28:23)
@!@!@ENDMSG 2186 @!@!@
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307704621/replicated.tla
+131
View File
@@ -0,0 +1,131 @@
---- MODULE replicated ----
EXTENDS Integers, FiniteSets
VARIABLES broker_state, safekeeper_state, pageserver_state, online
CONSTANT
brokers,
safekeepers,
pageservers,
azs,
az_mapping
CONSTANT
NULL
CONSTANT
max_commit_lsn
StateConstraint ==
/\ \A s \in safekeepers:
/\ safekeeper_state[s].commit_lsn <= max_commit_lsn
/\ \A b \in brokers:
/\ \A s \in DOMAIN broker_state[b].sk:
/\ broker_state[b].sk[s].commit_lsn <= max_commit_lsn
InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0]
InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]]
InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]]
InitOnline == safekeepers \cup brokers \cup pageservers
Init ==
/\ broker_state = [b \in brokers |-> InitBroker]
/\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper]
/\ pageserver_state = [p \in pageservers |-> InitPageserver]
/\ online = InitOnline
NodeOnlineOffline ==
/\ online' = CHOOSE ss \in SUBSET InitOnline:
/\ Cardinality(ss \cap safekeepers) >= 2
/\ Cardinality(ss \cap brokers) >= 2
/\ ss \cap pageservers = pageservers \* assume no PS failures for now
/\ UNCHANGED <<safekeeper_state,broker_state,pageserver_state>>
SkCommit(s1, s2) ==
/\ {s1, s2} \subseteq online
/\ s1 # s2
/\ safekeeper_state[s1].commit_lsn = safekeeper_state[s2].commit_lsn
/\ LET
new_commit_lsn == safekeeper_state[s1].commit_lsn + 1
IN
safekeeper_state' = [safekeeper_state EXCEPT
![s1].commit_lsn = new_commit_lsn,
![s2].commit_lsn = new_commit_lsn]
/\ UNCHANGED <<broker_state, pageserver_state,online>>
SkPeerRecovery(s1,s2) ==
/\ {s1, s2} \subseteq online
/\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn
/\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn]
/\ UNCHANGED <<broker_state, pageserver_state,online>>
SkPushToBroker(s,b) ==
/\ {s, b} \subseteq online
/\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn
THEN
LET
bsk == broker_state[b].sk
updbsk == [bsk EXCEPT ![s].commit_lsn = safekeeper_state[s].commit_lsn]
IN
[broker_state EXCEPT ![b].sk = updbsk]
ELSE broker_state
/\ UNCHANGED <<safekeeper_state, pageserver_state,online>>
PsRecvBroker(b,p,s) ==
/\ {b,p,s} \subseteq online
/\ LET
bsk == broker_state[b].sk[s]
psk == pageserver_state[p].sk[s]
updpsk == [psk EXCEPT !["commit_lsn"] = bsk.commit_lsn]
IN
pageserver_state' = IF bsk.commit_lsn > psk.commit_lsn
THEN [pageserver_state EXCEPT ![p].sk[s] = updpsk]
ELSE pageserver_state
/\ UNCHANGED <<safekeeper_state, broker_state,online>>
SksWithNewerWal(p) ==
/\ {p} \subseteq online
/\
LET
ps == pageserver_state[p]
IN
{s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn}
PsChooseSk(p) ==
/\ SksWithNewerWal(p) # {}
/\ pageserver_state' = [pageserver_state EXCEPT![p].preferred_sk = CHOOSE s \in SksWithNewerWal(p): TRUE]
/\ UNCHANGED <<safekeeper_state, broker_state,online>>
Next ==
\/ NodeOnlineOffline
\/ \E s1 \in safekeepers: \E s2 \in safekeepers:
\/ SkCommit(s1, s2)
\/ SkPeerRecovery(s1, s2)
\/ \E s \in safekeepers: \E b \in brokers: SkPushToBroker(s, b)
\/ \E s \in safekeepers: \E b \in brokers: \E p \in pageservers: PsRecvBroker(b,p,s)
\/ \E p \in pageservers: PsChooseSk(p)
Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state,online>>
\* invariants
EventuallyLaggingSkIsNotPreferredSk == <>(
LET
sks == safekeeper_state
lagging_sks == { s \in safekeepers: \A s2 \in safekeepers: sks[s].commit_lsn <= sks[s2].commit_lsn }
preferred_sks == {pageserver_state[p].preferred_sk: p \in pageservers}
IN
preferred_sks \cap lagging_sks = {}
)
====
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307769810/MC.cfg
+51
View File
@@ -0,0 +1,51 @@
\* MV CONSTANT declarations
CONSTANTS
b1 = b1
b2 = b2
b3 = b3
\* MV CONSTANT declarations
CONSTANTS
s1 = s1
s2 = s2
s3 = s3
\* MV CONSTANT declarations
CONSTANTS
p1 = p1
p2 = p2
\* MV CONSTANT declarations
CONSTANTS
az1 = az1
az2 = az2
az3 = az3
\* MV CONSTANT definitions
CONSTANT
brokers <- const_173730775393038000
\* CONSTANT declarations
CONSTANT NULL = NULL
\* MV CONSTANT definitions
CONSTANT
safekeepers <- const_173730775393039000
\* MV CONSTANT definitions
CONSTANT
pageservers <- const_173730775393040000
\* MV CONSTANT definitions
CONSTANT
azs <- const_173730775393041000
\* SYMMETRY definition
SYMMETRY symm_173730775393042000
\* CONSTANT definitions
CONSTANT
max_commit_lsn <- const_173730775393043000
\* CONSTANT definitions
CONSTANT
az_mapping <- const_173730775393044000
\* CONSTRAINT definition
CONSTRAINT
constr_173730775393045000
\* SPECIFICATION definition
SPECIFICATION
Spec
\* PROPERTY definition
PROPERTY
EventuallyLaggingSkIsNotPreferredSk
\* Generated on Sun Jan 19 18:29:13 CET 2025
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737301223409/MC.out → storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307769810/MC.out
+8 -8
View File
@@ -2,7 +2,7 @@
TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802)
@!@!@ENDMSG 2262 @!@!@
@!@!@STARTMSG 2187:0 @!@!@
Running breadth-first search Model-Checking with fp 20 and seed 6372772458573668883 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 9898] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
Running breadth-first search Model-Checking with fp 19 and seed -4959290627086969114 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11541] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
@!@!@ENDMSG 2187 @!@!@
@!@!@STARTMSG 2220:0 @!@!@
Starting SANY...
@@ -11,21 +11,21 @@ Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbo
Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Semantic processing of module Naturals
Semantic processing of module Integers
Semantic processing of module replicated
Semantic processing of module Sequences
Semantic processing of module FiniteSets
Semantic processing of module replicated
Semantic processing of module TLC
Semantic processing of module MC
@!@!@STARTMSG 2219:0 @!@!@
SANY finished.
@!@!@ENDMSG 2219 @!@!@
@!@!@STARTMSG 2185:0 @!@!@
Starting... (2025-01-19 16:40:16)
Starting... (2025-01-19 18:29:15)
@!@!@ENDMSG 2185 @!@!@
@!@!@STARTMSG 2279:3 @!@!@
Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined.
@@ -40,14 +40,14 @@ Implied-temporal checking--satisfiability problem has 1 branches.
Computing initial states...
@!@!@ENDMSG 2189 @!@!@
@!@!@STARTMSG 2190:0 @!@!@
Finished computing initial states: 1 distinct state generated at 2025-01-19 16:40:18.
Finished computing initial states: 1 distinct state generated at 2025-01-19 18:29:16.
@!@!@ENDMSG 2190 @!@!@
@!@!@STARTMSG 2192:0 @!@!@
Checking temporal properties for the current state space with 1217 total distinct states at (2025-01-19 16:40:21)
Checking temporal properties for the current state space with 1431 total distinct states at (2025-01-19 18:29:19)
@!@!@ENDMSG 2192 @!@!@
@!@!@STARTMSG 2267:0 @!@!@
Finished checking temporal properties in 00s at 2025-01-19 16:40:21
Finished checking temporal properties in 00s at 2025-01-19 18:29:19
@!@!@ENDMSG 2267 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(11) at 2025-01-19 16:40:21: 39.816 states generated (39.816 s/min), 3.288 distinct states found (3.288 ds/min), 2.067 states left on queue.
Progress(10) at 2025-01-19 18:29:19: 38.274 states generated (38.274 s/min), 4.060 distinct states found (4.060 ds/min), 2.625 states left on queue.
@!@!@ENDMSG 2200 @!@!@
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307769810/MC.tla
+65
View File
@@ -0,0 +1,65 @@
---- MODULE MC ----
EXTENDS replicated, TLC
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
b1, b2, b3
----
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
s1, s2, s3
----
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
p1, p2
----
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
az1, az2, az3
----
\* MV CONSTANT definitions brokers
const_173730775393038000 ==
{b1, b2, b3}
----
\* MV CONSTANT definitions safekeepers
const_173730775393039000 ==
{s1, s2, s3}
----
\* MV CONSTANT definitions pageservers
const_173730775393040000 ==
{p1, p2}
----
\* MV CONSTANT definitions azs
const_173730775393041000 ==
{az1, az2, az3}
----
\* SYMMETRY definition
symm_173730775393042000 ==
Permutations(const_173730775393038000) \union Permutations(const_173730775393039000) \union Permutations(const_173730775393040000) \union Permutations(const_173730775393041000)
----
\* CONSTANT definitions @modelParameterConstants:4max_commit_lsn
const_173730775393043000 ==
2
----
\* CONSTANT definitions @modelParameterConstants:5az_mapping
const_173730775393044000 ==
[ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2,p2} , az3 |-> {b3,s3}]
----
\* CONSTRAINT definition @modelParameterContraint:0
constr_173730775393045000 ==
StateConstraint
----
=============================================================================
\* Modification History
\* Created Sun Jan 19 18:29:13 CET 2025 by cs
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737301223409/MC_TE.out → storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307769810/MC_TE.out
+8 -8
View File
@@ -2,7 +2,7 @@
TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802)
@!@!@ENDMSG 2262 @!@!@
@!@!@STARTMSG 2187:0 @!@!@
Running breadth-first search Model-Checking with fp 20 and seed 6372772458573668883 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 9898] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
Running breadth-first search Model-Checking with fp 19 and seed -4959290627086969114 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11541] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
@!@!@ENDMSG 2187 @!@!@
@!@!@STARTMSG 2220:0 @!@!@
Starting SANY...
@@ -11,21 +11,21 @@ Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbo
Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Semantic processing of module Naturals
Semantic processing of module Integers
Semantic processing of module replicated
Semantic processing of module Sequences
Semantic processing of module FiniteSets
Semantic processing of module replicated
Semantic processing of module TLC
Semantic processing of module MC
@!@!@STARTMSG 2219:0 @!@!@
SANY finished.
@!@!@ENDMSG 2219 @!@!@
@!@!@STARTMSG 2185:0 @!@!@
Starting... (2025-01-19 16:40:16)
Starting... (2025-01-19 18:29:15)
@!@!@ENDMSG 2185 @!@!@
@!@!@STARTMSG 2279:3 @!@!@
Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined.
@@ -40,14 +40,14 @@ Implied-temporal checking--satisfiability problem has 1 branches.
Computing initial states...
@!@!@ENDMSG 2189 @!@!@
@!@!@STARTMSG 2190:0 @!@!@
Finished computing initial states: 1 distinct state generated at 2025-01-19 16:40:18.
Finished computing initial states: 1 distinct state generated at 2025-01-19 18:29:16.
@!@!@ENDMSG 2190 @!@!@
@!@!@STARTMSG 2192:0 @!@!@
Checking temporal properties for the current state space with 1217 total distinct states at (2025-01-19 16:40:21)
Checking temporal properties for the current state space with 1431 total distinct states at (2025-01-19 18:29:19)
@!@!@ENDMSG 2192 @!@!@
@!@!@STARTMSG 2267:0 @!@!@
Finished checking temporal properties in 00s at 2025-01-19 16:40:21
Finished checking temporal properties in 00s at 2025-01-19 18:29:19
@!@!@ENDMSG 2267 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(11) at 2025-01-19 16:40:21: 39.816 states generated (39.816 s/min), 3.288 distinct states found (3.288 ds/min), 2.067 states left on queue.
Progress(10) at 2025-01-19 18:29:19: 38.274 states generated (38.274 s/min), 4.060 distinct states found (4.060 ds/min), 2.625 states left on queue.
@!@!@ENDMSG 2200 @!@!@
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299469039/fullmesh.tla → storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307769810/replicated.tla
+23 -9
View File
@@ -1,8 +1,8 @@
---- MODULE fullmesh ----
---- MODULE replicated ----
EXTENDS Integers
EXTENDS Integers, FiniteSets
VARIABLES broker_state, safekeeper_state, pageserver_state
VARIABLES broker_state, safekeeper_state, pageserver_state, online
CONSTANT
@@ -29,14 +29,23 @@ StateConstraint ==
InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0]
InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]]
InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]]
InitOnline == safekeepers \cup brokers \cup pageservers
Init ==
/\ broker_state = [b \in brokers |-> InitBroker]
/\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper]
/\ pageserver_state = [p \in pageservers |-> InitPageserver]
/\ online = InitOnline
NodeOnlineOffline ==
/\ online' = CHOOSE ss \in SUBSET InitOnline:
/\ Cardinality(ss \cap safekeepers) >= 2
/\ Cardinality(ss \cap brokers) >= 2
/\ ss \cap pageservers = pageservers \* assume no PS failures for now
/\ UNCHANGED <<safekeeper_state,broker_state,pageserver_state>>
SkCommit(s1, s2) ==
/\ {s1, s2} \subseteq online
/\ s1 # s2
/\ safekeeper_state[s1].commit_lsn = safekeeper_state[s2].commit_lsn
/\ LET
@@ -45,13 +54,16 @@ SkCommit(s1, s2) ==
safekeeper_state' = [safekeeper_state EXCEPT
![s1].commit_lsn = new_commit_lsn,
![s2].commit_lsn = new_commit_lsn]
/\ UNCHANGED <<broker_state, pageserver_state>>
/\ UNCHANGED <<broker_state, pageserver_state,online>>
SkPeerRecovery(s1,s2) ==
/\ {s1, s2} \subseteq online
/\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn
/\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn]
/\ UNCHANGED <<broker_state, pageserver_state,online>>
SkPushToBroker(s,b) ==
/\ {s, b} \subseteq online
/\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn
THEN
LET
@@ -60,9 +72,10 @@ SkPushToBroker(s,b) ==
IN
[broker_state EXCEPT ![b].sk = updbsk]
ELSE broker_state
/\ UNCHANGED <<safekeeper_state, pageserver_state>>
/\ UNCHANGED <<safekeeper_state, pageserver_state,online>>
PsRecvBroker(b,p,s) ==
/\ {b,p,s} \subseteq online
/\ LET
bsk == broker_state[b].sk[s]
psk == pageserver_state[p].sk[s]
@@ -71,7 +84,7 @@ PsRecvBroker(b,p,s) ==
pageserver_state' = IF bsk.commit_lsn > psk.commit_lsn
THEN [pageserver_state EXCEPT ![p].sk[s] = updpsk]
ELSE pageserver_state
/\ UNCHANGED <<safekeeper_state, broker_state>>
/\ UNCHANGED <<safekeeper_state, broker_state,online>>
SksWithNewerWal(p) ==
@@ -81,13 +94,14 @@ SksWithNewerWal(p) ==
{s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn}
PsChooseSk(p) ==
/\ {p} \subseteq online
/\ SksWithNewerWal(p) # {}
/\ pageserver_state' = [pageserver_state EXCEPT![p].preferred_sk = CHOOSE s \in SksWithNewerWal(p): TRUE]
/\ UNCHANGED <<safekeeper_state, broker_state>>
/\ UNCHANGED <<safekeeper_state, broker_state,online>>
Next ==
\/ NodeOnlineOffline
\/ \E s1 \in safekeepers: \E s2 \in safekeepers:
\/ SkCommit(s1, s2)
\/ SkPeerRecovery(s1, s2)
@@ -96,7 +110,7 @@ Next ==
\/ \E p \in pageservers: PsChooseSk(p)
Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state >>
Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state,online>>
\* invariants
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307828738/MC.cfg
+50
View File
@@ -0,0 +1,50 @@
\* MV CONSTANT declarations
CONSTANTS
b1 = b1
b2 = b2
b3 = b3
\* MV CONSTANT declarations
CONSTANTS
s1 = s1
s2 = s2
s3 = s3
\* MV CONSTANT declarations
CONSTANTS
p1 = p1
\* MV CONSTANT declarations
CONSTANTS
az1 = az1
az2 = az2
az3 = az3
\* MV CONSTANT definitions
CONSTANT
brokers <- const_173730781391774000
\* CONSTANT declarations
CONSTANT NULL = NULL
\* MV CONSTANT definitions
CONSTANT
safekeepers <- const_173730781391775000
\* MV CONSTANT definitions
CONSTANT
pageservers <- const_173730781391776000
\* MV CONSTANT definitions
CONSTANT
azs <- const_173730781391777000
\* SYMMETRY definition
SYMMETRY symm_173730781391778000
\* CONSTANT definitions
CONSTANT
max_commit_lsn <- const_173730781391779000
\* CONSTANT definitions
CONSTANT
az_mapping <- const_173730781391780000
\* CONSTRAINT definition
CONSTRAINT
constr_173730781391781000
\* SPECIFICATION definition
SPECIFICATION
Spec
\* PROPERTY definition
PROPERTY
EventuallyLaggingSkIsNotPreferredSk
\* Generated on Sun Jan 19 18:30:13 CET 2025
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737301172627/MC.out → storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307828738/MC.out
+14 -5
View File
@@ -2,7 +2,7 @@
TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802)
@!@!@ENDMSG 2262 @!@!@
@!@!@STARTMSG 2187:0 @!@!@
Running breadth-first search Model-Checking with fp 71 and seed 2330797625274141225 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 9710] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
Running breadth-first search Model-Checking with fp 24 and seed -1042781833563910669 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11591] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
@!@!@ENDMSG 2187 @!@!@
@!@!@STARTMSG 2220:0 @!@!@
Starting SANY...
@@ -11,21 +11,21 @@ Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbo
Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Semantic processing of module Naturals
Semantic processing of module Integers
Semantic processing of module replicated
Semantic processing of module Sequences
Semantic processing of module FiniteSets
Semantic processing of module replicated
Semantic processing of module TLC
Semantic processing of module MC
@!@!@STARTMSG 2219:0 @!@!@
SANY finished.
@!@!@ENDMSG 2219 @!@!@
@!@!@STARTMSG 2185:0 @!@!@
Starting... (2025-01-19 16:39:29)
Starting... (2025-01-19 18:30:15)
@!@!@ENDMSG 2185 @!@!@
@!@!@STARTMSG 2279:3 @!@!@
Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined.
@@ -40,5 +40,14 @@ Implied-temporal checking--satisfiability problem has 1 branches.
Computing initial states...
@!@!@ENDMSG 2189 @!@!@
@!@!@STARTMSG 2190:0 @!@!@
Finished computing initial states: 1 distinct state generated at 2025-01-19 16:39:31.
Finished computing initial states: 1 distinct state generated at 2025-01-19 18:30:16.
@!@!@ENDMSG 2190 @!@!@
@!@!@STARTMSG 2192:0 @!@!@
Checking temporal properties for the current state space with 3889 total distinct states at (2025-01-19 18:30:19)
@!@!@ENDMSG 2192 @!@!@
@!@!@STARTMSG 2267:0 @!@!@
Finished checking temporal properties in 00s at 2025-01-19 18:30:19
@!@!@ENDMSG 2267 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(11) at 2025-01-19 18:30:19: 78.397 states generated (78.397 s/min), 8.627 distinct states found (8.627 ds/min), 4.735 states left on queue.
@!@!@ENDMSG 2200 @!@!@
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307828738/MC.tla
+65
View File
@@ -0,0 +1,65 @@
---- MODULE MC ----
EXTENDS replicated, TLC
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
b1, b2, b3
----
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
s1, s2, s3
----
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
p1
----
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
az1, az2, az3
----
\* MV CONSTANT definitions brokers
const_173730781391774000 ==
{b1, b2, b3}
----
\* MV CONSTANT definitions safekeepers
const_173730781391775000 ==
{s1, s2, s3}
----
\* MV CONSTANT definitions pageservers
const_173730781391776000 ==
{p1}
----
\* MV CONSTANT definitions azs
const_173730781391777000 ==
{az1, az2, az3}
----
\* SYMMETRY definition
symm_173730781391778000 ==
Permutations(const_173730781391774000) \union Permutations(const_173730781391775000) \union Permutations(const_173730781391776000) \union Permutations(const_173730781391777000)
----
\* CONSTANT definitions @modelParameterConstants:4max_commit_lsn
const_173730781391779000 ==
2
----
\* CONSTANT definitions @modelParameterConstants:5az_mapping
const_173730781391780000 ==
[ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2} , az3 |-> {b3,s3}]
----
\* CONSTRAINT definition @modelParameterContraint:0
constr_173730781391781000 ==
StateConstraint
----
=============================================================================
\* Modification History
\* Created Sun Jan 19 18:30:13 CET 2025 by cs
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737301172627/MC_TE.out → storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307828738/MC_TE.out
+14 -5
View File
@@ -2,7 +2,7 @@
TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802)
@!@!@ENDMSG 2262 @!@!@
@!@!@STARTMSG 2187:0 @!@!@
Running breadth-first search Model-Checking with fp 71 and seed 2330797625274141225 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 9710] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
Running breadth-first search Model-Checking with fp 24 and seed -1042781833563910669 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11591] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
@!@!@ENDMSG 2187 @!@!@
@!@!@STARTMSG 2220:0 @!@!@
Starting SANY...
@@ -11,21 +11,21 @@ Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbo
Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Semantic processing of module Naturals
Semantic processing of module Integers
Semantic processing of module replicated
Semantic processing of module Sequences
Semantic processing of module FiniteSets
Semantic processing of module replicated
Semantic processing of module TLC
Semantic processing of module MC
@!@!@STARTMSG 2219:0 @!@!@
SANY finished.
@!@!@ENDMSG 2219 @!@!@
@!@!@STARTMSG 2185:0 @!@!@
Starting... (2025-01-19 16:39:29)
Starting... (2025-01-19 18:30:15)
@!@!@ENDMSG 2185 @!@!@
@!@!@STARTMSG 2279:3 @!@!@
Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined.
@@ -40,5 +40,14 @@ Implied-temporal checking--satisfiability problem has 1 branches.
Computing initial states...
@!@!@ENDMSG 2189 @!@!@
@!@!@STARTMSG 2190:0 @!@!@
Finished computing initial states: 1 distinct state generated at 2025-01-19 16:39:31.
Finished computing initial states: 1 distinct state generated at 2025-01-19 18:30:16.
@!@!@ENDMSG 2190 @!@!@
@!@!@STARTMSG 2192:0 @!@!@
Checking temporal properties for the current state space with 3889 total distinct states at (2025-01-19 18:30:19)
@!@!@ENDMSG 2192 @!@!@
@!@!@STARTMSG 2267:0 @!@!@
Finished checking temporal properties in 00s at 2025-01-19 18:30:19
@!@!@ENDMSG 2267 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(11) at 2025-01-19 18:30:19: 78.397 states generated (78.397 s/min), 8.627 distinct states found (8.627 ds/min), 4.735 states left on queue.
@!@!@ENDMSG 2200 @!@!@
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299542008/fullmesh.tla → storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307828738/replicated.tla
+23 -10
View File
@@ -1,8 +1,8 @@
---- MODULE fullmesh ----
---- MODULE replicated ----
EXTENDS Integers
EXTENDS Integers, FiniteSets
VARIABLES broker_state, safekeeper_state, pageserver_state
VARIABLES broker_state, safekeeper_state, pageserver_state, online
CONSTANT
@@ -29,14 +29,23 @@ StateConstraint ==
InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0]
InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]]
InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]]
InitOnline == safekeepers \cup brokers \cup pageservers
Init ==
/\ broker_state = [b \in brokers |-> InitBroker]
/\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper]
/\ pageserver_state = [p \in pageservers |-> InitPageserver]
/\ online = InitOnline
NodeOnlineOffline ==
/\ online' = CHOOSE ss \in SUBSET InitOnline:
/\ Cardinality(ss \cap safekeepers) >= 2
/\ Cardinality(ss \cap brokers) >= 2
/\ ss \cap pageservers = pageservers \* assume no PS failures for now
/\ UNCHANGED <<safekeeper_state,broker_state,pageserver_state>>
SkCommit(s1, s2) ==
/\ {s1, s2} \subseteq online
/\ s1 # s2
/\ safekeeper_state[s1].commit_lsn = safekeeper_state[s2].commit_lsn
/\ LET
@@ -45,14 +54,16 @@ SkCommit(s1, s2) ==
safekeeper_state' = [safekeeper_state EXCEPT
![s1].commit_lsn = new_commit_lsn,
![s2].commit_lsn = new_commit_lsn]
/\ UNCHANGED <<broker_state, pageserver_state>>
/\ UNCHANGED <<broker_state, pageserver_state,online>>
SkPeerRecovery(s1,s2) ==
/\ {s1, s2} \subseteq online
/\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn
/\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn]
/\ UNCHANGED <<broker_state, safekeeper_state>>
/\ UNCHANGED <<broker_state, pageserver_state,online>>
SkPushToBroker(s,b) ==
/\ {s, b} \subseteq online
/\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn
THEN
LET
@@ -61,9 +72,10 @@ SkPushToBroker(s,b) ==
IN
[broker_state EXCEPT ![b].sk = updbsk]
ELSE broker_state
/\ UNCHANGED <<safekeeper_state, pageserver_state>>
/\ UNCHANGED <<safekeeper_state, pageserver_state,online>>
PsRecvBroker(b,p,s) ==
/\ {b,p,s} \subseteq online
/\ LET
bsk == broker_state[b].sk[s]
psk == pageserver_state[p].sk[s]
@@ -72,7 +84,7 @@ PsRecvBroker(b,p,s) ==
pageserver_state' = IF bsk.commit_lsn > psk.commit_lsn
THEN [pageserver_state EXCEPT ![p].sk[s] = updpsk]
ELSE pageserver_state
/\ UNCHANGED <<safekeeper_state, broker_state>>
/\ UNCHANGED <<safekeeper_state, broker_state,online>>
SksWithNewerWal(p) ==
@@ -82,13 +94,14 @@ SksWithNewerWal(p) ==
{s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn}
PsChooseSk(p) ==
/\ {p} \subseteq online
/\ SksWithNewerWal(p) # {}
/\ pageserver_state' = [pageserver_state EXCEPT![p].preferred_sk = CHOOSE s \in SksWithNewerWal(p): TRUE]
/\ UNCHANGED <<safekeeper_state, broker_state>>
/\ UNCHANGED <<safekeeper_state, broker_state,online>>
Next ==
\/ NodeOnlineOffline
\/ \E s1 \in safekeepers: \E s2 \in safekeepers:
\/ SkCommit(s1, s2)
\/ SkPeerRecovery(s1, s2)
@@ -97,7 +110,7 @@ Next ==
\/ \E p \in pageservers: PsChooseSk(p)
Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state >>
Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state,online>>
\* invariants
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299352762/MC.cfg → storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308024914/MC.cfg
+12 -10
View File
@@ -11,7 +11,6 @@ s3 = s3
\* MV CONSTANT declarations
CONSTANTS
p1 = p1
p2 = p2
\* MV CONSTANT declarations
CONSTANTS
az1 = az1
@@ -19,33 +18,36 @@ az2 = az2
az3 = az3
\* MV CONSTANT definitions
CONSTANT
brokers <- const_1737299350679194000
brokers <- const_1737308022622113000
\* CONSTANT declarations
CONSTANT NULL = NULL
\* MV CONSTANT definitions
CONSTANT
safekeepers <- const_1737299350679195000
safekeepers <- const_1737308022622114000
\* MV CONSTANT definitions
CONSTANT
pageservers <- const_1737299350679196000
pageservers <- const_1737308022622115000
\* MV CONSTANT definitions
CONSTANT
azs <- const_1737299350679197000
azs <- const_1737308022622116000
\* SYMMETRY definition
SYMMETRY symm_1737299350679198000
SYMMETRY symm_1737308022622117000
\* CONSTANT definitions
CONSTANT
max_commit_lsn <- const_1737299350679199000
max_commit_lsn <- const_1737308022622118000
\* CONSTANT definitions
CONSTANT
az_mapping <- const_1737299350679200000
az_mapping <- const_1737308022622119000
\* CONSTRAINT definition
CONSTRAINT
constr_1737299350680201000
constr_1737308022622120000
\* SPECIFICATION definition
SPECIFICATION
Spec
\* INVARIANT definition
INVARIANT
PsLagsSk
\* PROPERTY definition
PROPERTY
EventuallyLaggingSkIsNotPreferredSk
\* Generated on Sun Jan 19 16:09:10 CET 2025
\* Generated on Sun Jan 19 18:33:42 CET 2025
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299352762/MC.out → storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308024914/MC.out
+8 -8
View File
@@ -2,34 +2,34 @@
TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802)
@!@!@ENDMSG 2262 @!@!@
@!@!@STARTMSG 2187:0 @!@!@
Running breadth-first search Model-Checking with fp 119 and seed -1908114041878732601 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 7665] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
Running breadth-first search Model-Checking with fp 95 and seed 5720921755138129000 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11738] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
@!@!@ENDMSG 2187 @!@!@
@!@!@STARTMSG 2220:0 @!@!@
Starting SANY...
@!@!@ENDMSG 2220 @!@!@
Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/MC.tla
Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/fullmesh.tla
Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla
Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Semantic processing of module Naturals
Semantic processing of module Integers
Semantic processing of module fullmesh
Semantic processing of module Sequences
Semantic processing of module FiniteSets
Semantic processing of module replicated
Semantic processing of module TLC
Semantic processing of module MC
@!@!@STARTMSG 2219:0 @!@!@
SANY finished.
@!@!@ENDMSG 2219 @!@!@
@!@!@STARTMSG 2185:0 @!@!@
Starting... (2025-01-19 16:09:11)
Starting... (2025-01-19 18:33:43)
@!@!@ENDMSG 2185 @!@!@
@!@!@STARTMSG 2146:1 @!@!@
The invariant EventuallyLaggingSkIsNotPreferredSk is not a state predicate (one with no primes or temporal operators).
The invariant PsLagsSk is not a state predicate (one with no primes or temporal operators).
@!@!@ENDMSG 2146 @!@!@
@!@!@STARTMSG 2186:0 @!@!@
Finished in 994ms at (2025-01-19 16:09:11)
Finished in 1009ms at (2025-01-19 18:33:43)
@!@!@ENDMSG 2186 @!@!@
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308024914/MC.tla
+65
View File
@@ -0,0 +1,65 @@
---- MODULE MC ----
EXTENDS replicated, TLC
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
b1, b2, b3
----
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
s1, s2, s3
----
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
p1
----
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
az1, az2, az3
----
\* MV CONSTANT definitions brokers
const_1737308022622113000 ==
{b1, b2, b3}
----
\* MV CONSTANT definitions safekeepers
const_1737308022622114000 ==
{s1, s2, s3}
----
\* MV CONSTANT definitions pageservers
const_1737308022622115000 ==
{p1}
----
\* MV CONSTANT definitions azs
const_1737308022622116000 ==
{az1, az2, az3}
----
\* SYMMETRY definition
symm_1737308022622117000 ==
Permutations(const_1737308022622113000) \union Permutations(const_1737308022622114000) \union Permutations(const_1737308022622115000) \union Permutations(const_1737308022622116000)
----
\* CONSTANT definitions @modelParameterConstants:4max_commit_lsn
const_1737308022622118000 ==
2
----
\* CONSTANT definitions @modelParameterConstants:5az_mapping
const_1737308022622119000 ==
[ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2} , az3 |-> {b3,s3}]
----
\* CONSTRAINT definition @modelParameterContraint:0
constr_1737308022622120000 ==
StateConstraint
----
=============================================================================
\* Modification History
\* Created Sun Jan 19 18:33:42 CET 2025 by cs
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299352762/MC_TE.out → storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308024914/MC_TE.out
+8 -8
View File
@@ -2,34 +2,34 @@
TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802)
@!@!@ENDMSG 2262 @!@!@
@!@!@STARTMSG 2187:0 @!@!@
Running breadth-first search Model-Checking with fp 119 and seed -1908114041878732601 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 7665] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
Running breadth-first search Model-Checking with fp 95 and seed 5720921755138129000 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11738] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
@!@!@ENDMSG 2187 @!@!@
@!@!@STARTMSG 2220:0 @!@!@
Starting SANY...
@!@!@ENDMSG 2220 @!@!@
Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/MC.tla
Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/fullmesh.tla
Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla
Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Semantic processing of module Naturals
Semantic processing of module Integers
Semantic processing of module fullmesh
Semantic processing of module Sequences
Semantic processing of module FiniteSets
Semantic processing of module replicated
Semantic processing of module TLC
Semantic processing of module MC
@!@!@STARTMSG 2219:0 @!@!@
SANY finished.
@!@!@ENDMSG 2219 @!@!@
@!@!@STARTMSG 2185:0 @!@!@
Starting... (2025-01-19 16:09:11)
Starting... (2025-01-19 18:33:43)
@!@!@ENDMSG 2185 @!@!@
@!@!@STARTMSG 2146:1 @!@!@
The invariant EventuallyLaggingSkIsNotPreferredSk is not a state predicate (one with no primes or temporal operators).
The invariant PsLagsSk is not a state predicate (one with no primes or temporal operators).
@!@!@ENDMSG 2146 @!@!@
@!@!@STARTMSG 2186:0 @!@!@
Finished in 994ms at (2025-01-19 16:09:11)
Finished in 1009ms at (2025-01-19 18:33:43)
@!@!@ENDMSG 2186 @!@!@
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308024914/replicated.tla
+135
View File
@@ -0,0 +1,135 @@
---- MODULE replicated ----
EXTENDS Integers, FiniteSets
VARIABLES broker_state, safekeeper_state, pageserver_state, online
CONSTANT
brokers,
safekeepers,
pageservers,
azs,
az_mapping
CONSTANT
NULL
CONSTANT
max_commit_lsn
StateConstraint ==
/\ \A s \in safekeepers:
/\ safekeeper_state[s].commit_lsn <= max_commit_lsn
/\ \A b \in brokers:
/\ \A s \in DOMAIN broker_state[b].sk:
/\ broker_state[b].sk[s].commit_lsn <= max_commit_lsn
InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0]
InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]]
InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]]
InitOnline == safekeepers \cup brokers \cup pageservers
Init ==
/\ broker_state = [b \in brokers |-> InitBroker]
/\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper]
/\ pageserver_state = [p \in pageservers |-> InitPageserver]
/\ online = InitOnline
NodeOnlineOffline ==
/\ online' = CHOOSE ss \in SUBSET InitOnline:
/\ Cardinality(ss \cap safekeepers) >= 2
/\ Cardinality(ss \cap brokers) >= 2
/\ ss \cap pageservers = pageservers \* assume no PS failures for now
/\ UNCHANGED <<safekeeper_state,broker_state,pageserver_state>>
SkCommit(s1, s2) ==
/\ {s1, s2} \subseteq online
/\ s1 # s2
/\ safekeeper_state[s1].commit_lsn = safekeeper_state[s2].commit_lsn
/\ LET
new_commit_lsn == safekeeper_state[s1].commit_lsn + 1
IN
safekeeper_state' = [safekeeper_state EXCEPT
![s1].commit_lsn = new_commit_lsn,
![s2].commit_lsn = new_commit_lsn]
/\ UNCHANGED <<broker_state, pageserver_state,online>>
SkPeerRecovery(s1,s2) ==
/\ {s1, s2} \subseteq online
/\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn
/\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn]
/\ UNCHANGED <<broker_state, pageserver_state,online>>
SkPushToBroker(s,b) ==
/\ {s, b} \subseteq online
/\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn
THEN
LET
bsk == broker_state[b].sk
updbsk == [bsk EXCEPT ![s].commit_lsn = safekeeper_state[s].commit_lsn]
IN
[broker_state EXCEPT ![b].sk = updbsk]
ELSE broker_state
/\ UNCHANGED <<safekeeper_state, pageserver_state,online>>
PsRecvBroker(b,p,s) ==
/\ {b,p,s} \subseteq online
/\ LET
bsk == broker_state[b].sk[s]
psk == pageserver_state[p].sk[s]
updpsk == [psk EXCEPT !["commit_lsn"] = bsk.commit_lsn]
IN
pageserver_state' = IF bsk.commit_lsn > psk.commit_lsn
THEN [pageserver_state EXCEPT ![p].sk[s] = updpsk]
ELSE pageserver_state
/\ UNCHANGED <<safekeeper_state, broker_state,online>>
SksWithNewerWal(p) ==
LET
ps == pageserver_state[p]
IN
{s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn}
PsChooseSk(p) ==
/\ {p} \subseteq online
/\ SksWithNewerWal(p) # {}
/\ pageserver_state' = [pageserver_state EXCEPT![p].preferred_sk = CHOOSE s \in SksWithNewerWal(p): TRUE]
/\ UNCHANGED <<safekeeper_state, broker_state,online>>
Next ==
\/ NodeOnlineOffline
\/ \E s1 \in safekeepers: \E s2 \in safekeepers:
\/ SkCommit(s1, s2)
\/ SkPeerRecovery(s1, s2)
\/ \E s \in safekeepers: \E b \in brokers: SkPushToBroker(s, b)
\/ \E s \in safekeepers: \E b \in brokers: \E p \in pageservers: PsRecvBroker(b,p,s)
\/ \E p \in pageservers: PsChooseSk(p)
Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state,online>>
\* invariants
PsLagsSk == [](
\A p \in pageservers: \A s \in DOMAIN pageserver_state[p].sk:
/\ pageserver_state[p].sk[s].commit_lsn < safekeeper_state[s].commit_lsn
)
EventuallyLaggingSkIsNotPreferredSk == <>(
LET
sks == safekeeper_state
lagging_sks == { s \in safekeepers: \A s2 \in safekeepers: sks[s].commit_lsn <= sks[s2].commit_lsn }
preferred_sks == {pageserver_state[p].preferred_sk: p \in pageservers}
IN
preferred_sks \cap lagging_sks = {}
)
====
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299381423/MC.cfg → storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308183077/MC.cfg
+12 -10
View File
@@ -11,7 +11,6 @@ s3 = s3
\* MV CONSTANT declarations
CONSTANTS
p1 = p1
p2 = p2
\* MV CONSTANT declarations
CONSTANTS
az1 = az1
@@ -19,33 +18,36 @@ az2 = az2
az3 = az3
\* MV CONSTANT definitions
CONSTANT
brokers <- const_1737299377376212000
brokers <- const_1737308178999123000
\* CONSTANT declarations
CONSTANT NULL = NULL
\* MV CONSTANT definitions
CONSTANT
safekeepers <- const_1737299377376213000
safekeepers <- const_1737308178999124000
\* MV CONSTANT definitions
CONSTANT
pageservers <- const_1737299377376214000
pageservers <- const_1737308178999125000
\* MV CONSTANT definitions
CONSTANT
azs <- const_1737299377376215000
azs <- const_1737308178999126000
\* SYMMETRY definition
SYMMETRY symm_1737299377376216000
SYMMETRY symm_1737308178999127000
\* CONSTANT definitions
CONSTANT
max_commit_lsn <- const_1737299377376217000
max_commit_lsn <- const_1737308178999128000
\* CONSTANT definitions
CONSTANT
az_mapping <- const_1737299377376218000
az_mapping <- const_1737308178999129000
\* CONSTRAINT definition
CONSTRAINT
constr_1737299377376219000
constr_1737308178999130000
\* SPECIFICATION definition
SPECIFICATION
Spec
\* INVARIANT definition
INVARIANT
PsLagsSk
\* PROPERTY definition
PROPERTY
EventuallyLaggingSkIsNotPreferredSk
\* Generated on Sun Jan 19 16:09:37 CET 2025
\* Generated on Sun Jan 19 18:36:19 CET 2025
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308183077/MC.out
+52
View File
@@ -0,0 +1,52 @@
@!@!@STARTMSG 2262:0 @!@!@
TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802)
@!@!@ENDMSG 2262 @!@!@
@!@!@STARTMSG 2187:0 @!@!@
Running breadth-first search Model-Checking with fp 92 and seed -5681728403679829533 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11930] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
@!@!@ENDMSG 2187 @!@!@
@!@!@STARTMSG 2220:0 @!@!@
Starting SANY...
@!@!@ENDMSG 2220 @!@!@
Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla
Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla
Semantic processing of module Naturals
Semantic processing of module Integers
Semantic processing of module Sequences
Semantic processing of module FiniteSets
Semantic processing of module replicated
Semantic processing of module TLC
Semantic processing of module MC
@!@!@STARTMSG 2219:0 @!@!@
SANY finished.
@!@!@ENDMSG 2219 @!@!@
@!@!@STARTMSG 2185:0 @!@!@
Starting... (2025-01-19 18:36:20)
@!@!@ENDMSG 2185 @!@!@
@!@!@STARTMSG 2279:3 @!@!@
Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined.
@!@!@ENDMSG 2279 @!@!@
@!@!@STARTMSG 2284:3 @!@!@
Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details.
@!@!@ENDMSG 2284 @!@!@
@!@!@STARTMSG 2212:0 @!@!@
Implied-temporal checking--satisfiability problem has 1 branches.
@!@!@ENDMSG 2212 @!@!@
@!@!@STARTMSG 2189:0 @!@!@
Computing initial states...
@!@!@ENDMSG 2189 @!@!@
@!@!@STARTMSG 2107:1 @!@!@
Invariant PsLagsSk is violated by the initial state:
/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL])
/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])])
/\ online = {b1, b2, b3, s1, s2, s3, p1}
/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0])
@!@!@ENDMSG 2107 @!@!@
@!@!@STARTMSG 2186:0 @!@!@
Finished in 2710ms at (2025-01-19 18:36:21)
@!@!@ENDMSG 2186 @!@!@
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308183077/MC.tla
+65
View File
@@ -0,0 +1,65 @@
---- MODULE MC ----
EXTENDS replicated, TLC
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
b1, b2, b3
----
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
s1, s2, s3
----
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
p1
----
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
az1, az2, az3
----
\* MV CONSTANT definitions brokers
const_1737308178999123000 ==
{b1, b2, b3}
----
\* MV CONSTANT definitions safekeepers
const_1737308178999124000 ==
{s1, s2, s3}
----
\* MV CONSTANT definitions pageservers
const_1737308178999125000 ==
{p1}
----
\* MV CONSTANT definitions azs
const_1737308178999126000 ==
{az1, az2, az3}
----
\* SYMMETRY definition
symm_1737308178999127000 ==
Permutations(const_1737308178999123000) \union Permutations(const_1737308178999124000) \union Permutations(const_1737308178999125000) \union Permutations(const_1737308178999126000)
----
\* CONSTANT definitions @modelParameterConstants:4max_commit_lsn
const_1737308178999128000 ==
2
----
\* CONSTANT definitions @modelParameterConstants:5az_mapping
const_1737308178999129000 ==
[ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2} , az3 |-> {b3,s3}]
----
\* CONSTRAINT definition @modelParameterContraint:0
constr_1737308178999130000 ==
StateConstraint
----
=============================================================================
\* Modification History
\* Created Sun Jan 19 18:36:19 CET 2025 by cs
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308183077/MC_TE.out
+52
View File
@@ -0,0 +1,52 @@
@!@!@STARTMSG 2262:0 @!@!@
TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802)
@!@!@ENDMSG 2262 @!@!@
@!@!@STARTMSG 2187:0 @!@!@
Running breadth-first search Model-Checking with fp 92 and seed -5681728403679829533 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11930] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
@!@!@ENDMSG 2187 @!@!@
@!@!@STARTMSG 2220:0 @!@!@
Starting SANY...
@!@!@ENDMSG 2220 @!@!@
Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla
Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla
Semantic processing of module Naturals
Semantic processing of module Integers
Semantic processing of module Sequences
Semantic processing of module FiniteSets
Semantic processing of module replicated
Semantic processing of module TLC
Semantic processing of module MC
@!@!@STARTMSG 2219:0 @!@!@
SANY finished.
@!@!@ENDMSG 2219 @!@!@
@!@!@STARTMSG 2185:0 @!@!@
Starting... (2025-01-19 18:36:20)
@!@!@ENDMSG 2185 @!@!@
@!@!@STARTMSG 2279:3 @!@!@
Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined.
@!@!@ENDMSG 2279 @!@!@
@!@!@STARTMSG 2284:3 @!@!@
Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details.
@!@!@ENDMSG 2284 @!@!@
@!@!@STARTMSG 2212:0 @!@!@
Implied-temporal checking--satisfiability problem has 1 branches.
@!@!@ENDMSG 2212 @!@!@
@!@!@STARTMSG 2189:0 @!@!@
Computing initial states...
@!@!@ENDMSG 2189 @!@!@
@!@!@STARTMSG 2107:1 @!@!@
Invariant PsLagsSk is violated by the initial state:
/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL])
/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])])
/\ online = {b1, b2, b3, s1, s2, s3, p1}
/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0])
@!@!@ENDMSG 2107 @!@!@
@!@!@STARTMSG 2186:0 @!@!@
Finished in 2710ms at (2025-01-19 18:36:21)
@!@!@ENDMSG 2186 @!@!@
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308183077/replicated.tla
+134
View File
@@ -0,0 +1,134 @@
---- MODULE replicated ----
EXTENDS Integers, FiniteSets
VARIABLES broker_state, safekeeper_state, pageserver_state, online
CONSTANT
brokers,
safekeepers,
pageservers,
azs,
az_mapping
CONSTANT
NULL
CONSTANT
max_commit_lsn
StateConstraint ==
/\ \A s \in safekeepers:
/\ safekeeper_state[s].commit_lsn <= max_commit_lsn
/\ \A b \in brokers:
/\ \A s \in DOMAIN broker_state[b].sk:
/\ broker_state[b].sk[s].commit_lsn <= max_commit_lsn
InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0]
InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]]
InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]]
InitOnline == safekeepers \cup brokers \cup pageservers
Init ==
/\ broker_state = [b \in brokers |-> InitBroker]
/\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper]
/\ pageserver_state = [p \in pageservers |-> InitPageserver]
/\ online = InitOnline
NodeOnlineOffline ==
/\ online' = CHOOSE ss \in SUBSET InitOnline:
/\ Cardinality(ss \cap safekeepers) >= 2
/\ Cardinality(ss \cap brokers) >= 2
/\ ss \cap pageservers = pageservers \* assume no PS failures for now
/\ UNCHANGED <<safekeeper_state,broker_state,pageserver_state>>
SkCommit(s1, s2) ==
/\ {s1, s2} \subseteq online
/\ s1 # s2
/\ safekeeper_state[s1].commit_lsn = safekeeper_state[s2].commit_lsn
/\ LET
new_commit_lsn == safekeeper_state[s1].commit_lsn + 1
IN
safekeeper_state' = [safekeeper_state EXCEPT
![s1].commit_lsn = new_commit_lsn,
![s2].commit_lsn = new_commit_lsn]
/\ UNCHANGED <<broker_state, pageserver_state,online>>
SkPeerRecovery(s1,s2) ==
/\ {s1, s2} \subseteq online
/\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn
/\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn]
/\ UNCHANGED <<broker_state, pageserver_state,online>>
SkPushToBroker(s,b) ==
/\ {s, b} \subseteq online
/\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn
THEN
LET
bsk == broker_state[b].sk
updbsk == [bsk EXCEPT ![s].commit_lsn = safekeeper_state[s].commit_lsn]
IN
[broker_state EXCEPT ![b].sk = updbsk]
ELSE broker_state
/\ UNCHANGED <<safekeeper_state, pageserver_state,online>>
PsRecvBroker(b,p,s) ==
/\ {b,p,s} \subseteq online
/\ LET
bsk == broker_state[b].sk[s]
psk == pageserver_state[p].sk[s]
updpsk == [psk EXCEPT !["commit_lsn"] = bsk.commit_lsn]
IN
pageserver_state' = IF bsk.commit_lsn > psk.commit_lsn
THEN [pageserver_state EXCEPT ![p].sk[s] = updpsk]
ELSE pageserver_state
/\ UNCHANGED <<safekeeper_state, broker_state,online>>
SksWithNewerWal(p) ==
LET
ps == pageserver_state[p]
IN
{s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn}
PsChooseSk(p) ==
/\ {p} \subseteq online
/\ SksWithNewerWal(p) # {}
/\ pageserver_state' = [pageserver_state EXCEPT![p].preferred_sk = CHOOSE s \in SksWithNewerWal(p): TRUE]
/\ UNCHANGED <<safekeeper_state, broker_state,online>>
Next ==
\/ NodeOnlineOffline
\/ \E s1 \in safekeepers: \E s2 \in safekeepers:
\/ SkCommit(s1, s2)
\/ SkPeerRecovery(s1, s2)
\/ \E s \in safekeepers: \E b \in brokers: SkPushToBroker(s, b)
\/ \E s \in safekeepers: \E b \in brokers: \E p \in pageservers: PsRecvBroker(b,p,s)
\/ \E p \in pageservers: PsChooseSk(p)
Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state,online>>
\* invariants
PsLagsSk == \A p \in pageservers: \A s \in DOMAIN pageserver_state[p].sk:
/\ pageserver_state[p].sk[s].commit_lsn < safekeeper_state[s].commit_lsn
EventuallyLaggingSkIsNotPreferredSk == <>(
LET
sks == safekeeper_state
lagging_sks == { s \in safekeepers: \A s2 \in safekeepers: sks[s].commit_lsn <= sks[s2].commit_lsn }
preferred_sks == {pageserver_state[p].preferred_sk: p \in pageservers}
IN
preferred_sks \cap lagging_sks = {}
)
====
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308216766/MC.cfg
+53
View File
@@ -0,0 +1,53 @@
\* MV CONSTANT declarations
CONSTANTS
b1 = b1
b2 = b2
b3 = b3
\* MV CONSTANT declarations
CONSTANTS
s1 = s1
s2 = s2
s3 = s3
\* MV CONSTANT declarations
CONSTANTS
p1 = p1
\* MV CONSTANT declarations
CONSTANTS
az1 = az1
az2 = az2
az3 = az3
\* MV CONSTANT definitions
CONSTANT
brokers <- const_1737308198937133000
\* CONSTANT declarations
CONSTANT NULL = NULL
\* MV CONSTANT definitions
CONSTANT
safekeepers <- const_1737308198937134000
\* MV CONSTANT definitions
CONSTANT
pageservers <- const_1737308198937135000
\* MV CONSTANT definitions
CONSTANT
azs <- const_1737308198937136000
\* SYMMETRY definition
SYMMETRY symm_1737308198937137000
\* CONSTANT definitions
CONSTANT
max_commit_lsn <- const_1737308198937138000
\* CONSTANT definitions
CONSTANT
az_mapping <- const_1737308198937139000
\* CONSTRAINT definition
CONSTRAINT
constr_1737308198937140000
\* SPECIFICATION definition
SPECIFICATION
Spec
\* INVARIANT definition
INVARIANT
PsLagsSk
\* PROPERTY definition
PROPERTY
EventuallyLaggingSkIsNotPreferredSk
\* Generated on Sun Jan 19 18:36:38 CET 2025
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308216766/MC.out
+53
View File
@@ -0,0 +1,53 @@
@!@!@STARTMSG 2262:0 @!@!@
TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802)
@!@!@ENDMSG 2262 @!@!@
@!@!@STARTMSG 2187:0 @!@!@
Running breadth-first search Model-Checking with fp 39 and seed -9180611051874563891 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11941] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
@!@!@ENDMSG 2187 @!@!@
@!@!@STARTMSG 2220:0 @!@!@
Starting SANY...
@!@!@ENDMSG 2220 @!@!@
Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla
Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla
Semantic processing of module Naturals
Semantic processing of module Integers
Semantic processing of module Sequences
Semantic processing of module FiniteSets
Semantic processing of module replicated
Semantic processing of module TLC
Semantic processing of module MC
@!@!@STARTMSG 2219:0 @!@!@
SANY finished.
@!@!@ENDMSG 2219 @!@!@
@!@!@STARTMSG 2185:0 @!@!@
Starting... (2025-01-19 18:36:40)
@!@!@ENDMSG 2185 @!@!@
@!@!@STARTMSG 2279:3 @!@!@
Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined.
@!@!@ENDMSG 2279 @!@!@
@!@!@STARTMSG 2284:3 @!@!@
Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details.
@!@!@ENDMSG 2284 @!@!@
@!@!@STARTMSG 2212:0 @!@!@
Implied-temporal checking--satisfiability problem has 1 branches.
@!@!@ENDMSG 2212 @!@!@
@!@!@STARTMSG 2189:0 @!@!@
Computing initial states...
@!@!@ENDMSG 2189 @!@!@
@!@!@STARTMSG 2190:0 @!@!@
Finished computing initial states: 1 distinct state generated at 2025-01-19 18:36:41.
@!@!@ENDMSG 2190 @!@!@
@!@!@STARTMSG 2192:0 @!@!@
Checking temporal properties for the current state space with 3587 total distinct states at (2025-01-19 18:36:44)
@!@!@ENDMSG 2192 @!@!@
@!@!@STARTMSG 2267:0 @!@!@
Finished checking temporal properties in 00s at 2025-01-19 18:36:44
@!@!@ENDMSG 2267 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(11) at 2025-01-19 18:36:44: 73.018 states generated (73.018 s/min), 8.206 distinct states found (8.206 ds/min), 4.615 states left on queue.
@!@!@ENDMSG 2200 @!@!@
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308216766/MC.tla
+65
View File
@@ -0,0 +1,65 @@
---- MODULE MC ----
EXTENDS replicated, TLC
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
b1, b2, b3
----
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
s1, s2, s3
----
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
p1
----
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
az1, az2, az3
----
\* MV CONSTANT definitions brokers
const_1737308198937133000 ==
{b1, b2, b3}
----
\* MV CONSTANT definitions safekeepers
const_1737308198937134000 ==
{s1, s2, s3}
----
\* MV CONSTANT definitions pageservers
const_1737308198937135000 ==
{p1}
----
\* MV CONSTANT definitions azs
const_1737308198937136000 ==
{az1, az2, az3}
----
\* SYMMETRY definition
symm_1737308198937137000 ==
Permutations(const_1737308198937133000) \union Permutations(const_1737308198937134000) \union Permutations(const_1737308198937135000) \union Permutations(const_1737308198937136000)
----
\* CONSTANT definitions @modelParameterConstants:4max_commit_lsn
const_1737308198937138000 ==
2
----
\* CONSTANT definitions @modelParameterConstants:5az_mapping
const_1737308198937139000 ==
[ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2} , az3 |-> {b3,s3}]
----
\* CONSTRAINT definition @modelParameterContraint:0
constr_1737308198937140000 ==
StateConstraint
----
=============================================================================
\* Modification History
\* Created Sun Jan 19 18:36:38 CET 2025 by cs
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308216766/MC_TE.out
+53
View File
@@ -0,0 +1,53 @@
@!@!@STARTMSG 2262:0 @!@!@
TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802)
@!@!@ENDMSG 2262 @!@!@
@!@!@STARTMSG 2187:0 @!@!@
Running breadth-first search Model-Checking with fp 39 and seed -9180611051874563891 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11941] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
@!@!@ENDMSG 2187 @!@!@
@!@!@STARTMSG 2220:0 @!@!@
Starting SANY...
@!@!@ENDMSG 2220 @!@!@
Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla
Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla
Semantic processing of module Naturals
Semantic processing of module Integers
Semantic processing of module Sequences
Semantic processing of module FiniteSets
Semantic processing of module replicated
Semantic processing of module TLC
Semantic processing of module MC
@!@!@STARTMSG 2219:0 @!@!@
SANY finished.
@!@!@ENDMSG 2219 @!@!@
@!@!@STARTMSG 2185:0 @!@!@
Starting... (2025-01-19 18:36:40)
@!@!@ENDMSG 2185 @!@!@
@!@!@STARTMSG 2279:3 @!@!@
Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined.
@!@!@ENDMSG 2279 @!@!@
@!@!@STARTMSG 2284:3 @!@!@
Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details.
@!@!@ENDMSG 2284 @!@!@
@!@!@STARTMSG 2212:0 @!@!@
Implied-temporal checking--satisfiability problem has 1 branches.
@!@!@ENDMSG 2212 @!@!@
@!@!@STARTMSG 2189:0 @!@!@
Computing initial states...
@!@!@ENDMSG 2189 @!@!@
@!@!@STARTMSG 2190:0 @!@!@
Finished computing initial states: 1 distinct state generated at 2025-01-19 18:36:41.
@!@!@ENDMSG 2190 @!@!@
@!@!@STARTMSG 2192:0 @!@!@
Checking temporal properties for the current state space with 3587 total distinct states at (2025-01-19 18:36:44)
@!@!@ENDMSG 2192 @!@!@
@!@!@STARTMSG 2267:0 @!@!@
Finished checking temporal properties in 00s at 2025-01-19 18:36:44
@!@!@ENDMSG 2267 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(11) at 2025-01-19 18:36:44: 73.018 states generated (73.018 s/min), 8.206 distinct states found (8.206 ds/min), 4.615 states left on queue.
@!@!@ENDMSG 2200 @!@!@
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308216766/replicated.tla
+134
View File
@@ -0,0 +1,134 @@
---- MODULE replicated ----
EXTENDS Integers, FiniteSets
VARIABLES broker_state, safekeeper_state, pageserver_state, online
CONSTANT
brokers,
safekeepers,
pageservers,
azs,
az_mapping
CONSTANT
NULL
CONSTANT
max_commit_lsn
StateConstraint ==
/\ \A s \in safekeepers:
/\ safekeeper_state[s].commit_lsn <= max_commit_lsn
/\ \A b \in brokers:
/\ \A s \in DOMAIN broker_state[b].sk:
/\ broker_state[b].sk[s].commit_lsn <= max_commit_lsn
InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0]
InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]]
InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]]
InitOnline == safekeepers \cup brokers \cup pageservers
Init ==
/\ broker_state = [b \in brokers |-> InitBroker]
/\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper]
/\ pageserver_state = [p \in pageservers |-> InitPageserver]
/\ online = InitOnline
NodeOnlineOffline ==
/\ online' = CHOOSE ss \in SUBSET InitOnline:
/\ Cardinality(ss \cap safekeepers) >= 2
/\ Cardinality(ss \cap brokers) >= 2
/\ ss \cap pageservers = pageservers \* assume no PS failures for now
/\ UNCHANGED <<safekeeper_state,broker_state,pageserver_state>>
SkCommit(s1, s2) ==
/\ {s1, s2} \subseteq online
/\ s1 # s2
/\ safekeeper_state[s1].commit_lsn = safekeeper_state[s2].commit_lsn
/\ LET
new_commit_lsn == safekeeper_state[s1].commit_lsn + 1
IN
safekeeper_state' = [safekeeper_state EXCEPT
![s1].commit_lsn = new_commit_lsn,
![s2].commit_lsn = new_commit_lsn]
/\ UNCHANGED <<broker_state, pageserver_state,online>>
SkPeerRecovery(s1,s2) ==
/\ {s1, s2} \subseteq online
/\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn
/\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn]
/\ UNCHANGED <<broker_state, pageserver_state,online>>
SkPushToBroker(s,b) ==
/\ {s, b} \subseteq online
/\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn
THEN
LET
bsk == broker_state[b].sk
updbsk == [bsk EXCEPT ![s].commit_lsn = safekeeper_state[s].commit_lsn]
IN
[broker_state EXCEPT ![b].sk = updbsk]
ELSE broker_state
/\ UNCHANGED <<safekeeper_state, pageserver_state,online>>
PsRecvBroker(b,p,s) ==
/\ {b,p,s} \subseteq online
/\ LET
bsk == broker_state[b].sk[s]
psk == pageserver_state[p].sk[s]
updpsk == [psk EXCEPT !["commit_lsn"] = bsk.commit_lsn]
IN
pageserver_state' = IF bsk.commit_lsn > psk.commit_lsn
THEN [pageserver_state EXCEPT ![p].sk[s] = updpsk]
ELSE pageserver_state
/\ UNCHANGED <<safekeeper_state, broker_state,online>>
SksWithNewerWal(p) ==
LET
ps == pageserver_state[p]
IN
{s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn}
PsChooseSk(p) ==
/\ {p} \subseteq online
/\ SksWithNewerWal(p) # {}
/\ pageserver_state' = [pageserver_state EXCEPT![p].preferred_sk = CHOOSE s \in SksWithNewerWal(p): TRUE]
/\ UNCHANGED <<safekeeper_state, broker_state,online>>
Next ==
\/ NodeOnlineOffline
\/ \E s1 \in safekeepers: \E s2 \in safekeepers:
\/ SkCommit(s1, s2)
\/ SkPeerRecovery(s1, s2)
\/ \E s \in safekeepers: \E b \in brokers: SkPushToBroker(s, b)
\/ \E s \in safekeepers: \E b \in brokers: \E p \in pageservers: PsRecvBroker(b,p,s)
\/ \E p \in pageservers: PsChooseSk(p)
Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state,online>>
\* invariants
PsLagsSk == \A p \in pageservers: \A s \in DOMAIN pageserver_state[p].sk:
/\ pageserver_state[p].sk[s].commit_lsn <= safekeeper_state[s].commit_lsn
EventuallyLaggingSkIsNotPreferredSk == <>(
LET
sks == safekeeper_state
lagging_sks == { s \in safekeepers: \A s2 \in safekeepers: sks[s].commit_lsn <= sks[s2].commit_lsn }
preferred_sks == {pageserver_state[p].preferred_sk: p \in pageservers}
IN
preferred_sks \cap lagging_sks = {}
)
====
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308355472/MC.cfg
+53
View File
@@ -0,0 +1,53 @@
\* MV CONSTANT declarations
CONSTANTS
b1 = b1
b2 = b2
b3 = b3
\* MV CONSTANT declarations
CONSTANTS
s1 = s1
s2 = s2
s3 = s3
\* MV CONSTANT declarations
CONSTANTS
p1 = p1
\* MV CONSTANT declarations
CONSTANTS
az1 = az1
az2 = az2
az3 = az3
\* MV CONSTANT definitions
CONSTANT
brokers <- const_1737308284086143000
\* CONSTANT declarations
CONSTANT NULL = NULL
\* MV CONSTANT definitions
CONSTANT
safekeepers <- const_1737308284086144000
\* MV CONSTANT definitions
CONSTANT
pageservers <- const_1737308284086145000
\* MV CONSTANT definitions
CONSTANT
azs <- const_1737308284086146000
\* SYMMETRY definition
SYMMETRY symm_1737308284086147000
\* CONSTANT definitions
CONSTANT
max_commit_lsn <- const_1737308284086148000
\* CONSTANT definitions
CONSTANT
az_mapping <- const_1737308284086149000
\* CONSTRAINT definition
CONSTRAINT
constr_1737308284086150000
\* SPECIFICATION definition
SPECIFICATION
Spec
\* INVARIANT definition
INVARIANT
PsLagsSk
\* PROPERTY definition
PROPERTY
EventuallyLaggingSkIsNotPreferredSk
\* Generated on Sun Jan 19 18:38:04 CET 2025
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308355472/MC.out
+354
View File
@@ -0,0 +1,354 @@
@!@!@STARTMSG 2262:0 @!@!@
TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802)
@!@!@ENDMSG 2262 @!@!@
@!@!@STARTMSG 2187:0 @!@!@
Running breadth-first search Model-Checking with fp 96 and seed 147884281130356166 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 12007] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
@!@!@ENDMSG 2187 @!@!@
@!@!@STARTMSG 2220:0 @!@!@
Starting SANY...
@!@!@ENDMSG 2220 @!@!@
Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla
Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla
Semantic processing of module Naturals
Semantic processing of module Integers
Semantic processing of module Sequences
Semantic processing of module FiniteSets
Semantic processing of module replicated
Semantic processing of module TLC
Semantic processing of module MC
@!@!@STARTMSG 2219:0 @!@!@
SANY finished.
@!@!@ENDMSG 2219 @!@!@
@!@!@STARTMSG 2185:0 @!@!@
Starting... (2025-01-19 18:38:05)
@!@!@ENDMSG 2185 @!@!@
@!@!@STARTMSG 2279:3 @!@!@
Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined.
@!@!@ENDMSG 2279 @!@!@
@!@!@STARTMSG 2284:3 @!@!@
Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details.
@!@!@ENDMSG 2284 @!@!@
@!@!@STARTMSG 2212:0 @!@!@
Implied-temporal checking--satisfiability problem has 1 branches.
@!@!@ENDMSG 2212 @!@!@
@!@!@STARTMSG 2189:0 @!@!@
Computing initial states...
@!@!@ENDMSG 2189 @!@!@
@!@!@STARTMSG 2190:0 @!@!@
Finished computing initial states: 1 distinct state generated at 2025-01-19 18:38:06.
@!@!@ENDMSG 2190 @!@!@
@!@!@STARTMSG 2192:0 @!@!@
Checking temporal properties for the current state space with 3861 total distinct states at (2025-01-19 18:38:09)
@!@!@ENDMSG 2192 @!@!@
@!@!@STARTMSG 2267:0 @!@!@
Finished checking temporal properties in 00s at 2025-01-19 18:38:09
@!@!@ENDMSG 2267 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(11) at 2025-01-19 18:38:09: 77.856 states generated (77.856 s/min), 8.653 distinct states found (8.653 ds/min), 4.790 states left on queue.
@!@!@ENDMSG 2200 @!@!@
@!@!@STARTMSG 2192:0 @!@!@
Checking temporal properties for the current state space with 197257 total distinct states at (2025-01-19 18:39:09)
@!@!@ENDMSG 2192 @!@!@
@!@!@STARTMSG 2267:0 @!@!@
Finished checking temporal properties in 00s at 2025-01-19 18:39:09
@!@!@ENDMSG 2267 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(20) at 2025-01-19 18:39:09: 3.084.377 states generated (3.006.521 s/min), 204.964 distinct states found (196.311 ds/min), 7.704 states left on queue.
@!@!@ENDMSG 2200 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(25) at 2025-01-19 18:39:12: 3.224.329 states generated, 208.868 distinct states found, 0 states left on queue.
@!@!@ENDMSG 2200 @!@!@
@!@!@STARTMSG 2192:0 @!@!@
Checking temporal properties for the complete state space with 208868 total distinct states at (2025-01-19 18:39:12)
@!@!@ENDMSG 2192 @!@!@
@!@!@STARTMSG 2267:0 @!@!@
Finished checking temporal properties in 00s at 2025-01-19 18:39:12
@!@!@ENDMSG 2267 @!@!@
@!@!@STARTMSG 2193:0 @!@!@
Model checking completed. No error has been found.
Estimates of the probability that TLC did not check all reachable states
because two distinct states had the same fingerprint:
calculated (optimistic): val = 3.4E-8
based on the actual fingerprints: val = 6.3E-10
@!@!@ENDMSG 2193 @!@!@
@!@!@STARTMSG 2201:0 @!@!@
The coverage statistics at 2025-01-19 18:39:14
@!@!@ENDMSG 2201 @!@!@
@!@!@STARTMSG 2773:0 @!@!@
<Init line 34, col 1 to line 34, col 4 of module replicated>: 1:1
@!@!@ENDMSG 2773 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 35, col 5 to line 38, col 26 of module replicated: 1
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<NodeOnlineOffline line 40, col 1 to line 40, col 17 of module replicated>: 14290:208868
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 41, col 8 to line 44, col 44 of module replicated: 208868
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 41, col 18 to line 44, col 44 of module replicated: 208868
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 42, col 9 to line 44, col 44 of module replicated: 22348876
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 42, col 12 to line 42, col 48 of module replicated: 22348876
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 43, col 12 to line 43, col 44 of module replicated: 8981324
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 44, col 12 to line 44, col 44 of module replicated: 2924152
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 41, col 32 to line 41, col 48 of module replicated: 208868
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 45, col 8 to line 45, col 67 of module replicated: 208868
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkCommit line 47, col 1 to line 47, col 16 of module replicated>: 84:530666
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 48, col 8 to line 48, col 32 of module replicated: 2410478
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2775:0 @!@!@
|line 48, col 8 to line 48, col 15 of module replicated: 1879812:4246157
@!@!@ENDMSG 2775 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 48, col 27 to line 48, col 32 of module replicated: 1879812
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 49, col 8 to line 49, col 14 of module replicated: 1643803
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 49, col 8 to line 49, col 9 of module replicated: 1113137
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 49, col 13 to line 49, col 14 of module replicated: 1113137
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 50, col 8 to line 50, col 72 of module replicated: 1170534
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 50, col 8 to line 50, col 38 of module replicated: 639868
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 50, col 42 to line 50, col 72 of module replicated: 639868
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 54, col 13 to line 56, col 50 of module replicated: 530666
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 57, col 8 to line 57, col 58 of module replicated: 530666
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkPeerRecovery line 59, col 1 to line 59, col 21 of module replicated>: 682:54601
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 60, col 8 to line 60, col 32 of module replicated: 1934413
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2775:0 @!@!@
|line 60, col 8 to line 60, col 15 of module replicated: 1879812:4246157
@!@!@ENDMSG 2775 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 60, col 27 to line 60, col 32 of module replicated: 1879812
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 61, col 8 to line 61, col 72 of module replicated: 54601
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 61, col 8 to line 61, col 38 of module replicated: 1113137
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 61, col 42 to line 61, col 72 of module replicated: 1113137
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 62, col 8 to line 62, col 102 of module replicated: 54601
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 63, col 8 to line 63, col 58 of module replicated: 54601
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkPushToBroker line 65, col 1 to line 65, col 19 of module replicated>: 45241:1113137
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 66, col 8 to line 66, col 30 of module replicated: 2992949
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2775:0 @!@!@
|line 66, col 8 to line 66, col 13 of module replicated: 1879812:4412756
@!@!@ENDMSG 2775 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 66, col 25 to line 66, col 30 of module replicated: 1879812
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 67, col 8 to line 74, col 29 of module replicated: 1113137
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 67, col 24 to line 74, col 29 of module replicated: 1113137
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 67, col 27 to line 67, col 91 of module replicated: 1113137
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 70, col 28 to line 70, col 45 of module replicated: 611653
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 71, col 31 to line 71, col 91 of module replicated: 611653
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 73, col 17 to line 73, col 54 of module replicated: 611653
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 74, col 18 to line 74, col 29 of module replicated: 501484
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 75, col 8 to line 75, col 62 of module replicated: 1113137
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<PsRecvBroker line 77, col 1 to line 77, col 19 of module replicated>: 90643:1113137
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 78, col 8 to line 78, col 31 of module replicated: 2992949
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2775:0 @!@!@
|line 78, col 8 to line 78, col 14 of module replicated: 1879812:5525893
@!@!@ENDMSG 2775 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 78, col 26 to line 78, col 31 of module replicated: 1879812
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 84, col 13 to line 86, col 37 of module replicated: 1113137
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 84, col 33 to line 86, col 37 of module replicated: 1113137
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 84, col 36 to line 84, col 66 of module replicated: 1113137
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 85, col 22 to line 85, col 66 of module replicated: 406880
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 86, col 22 to line 86, col 37 of module replicated: 706257
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 87, col 8 to line 87, col 58 of module replicated: 1113137
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<PsChooseSk line 96, col 1 to line 96, col 13 of module replicated>: 57927:203919
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 97, col 8 to line 97, col 27 of module replicated: 412787
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2775:0 @!@!@
|line 97, col 8 to line 97, col 10 of module replicated: 208868:417736
@!@!@ENDMSG 2775 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 97, col 22 to line 97, col 27 of module replicated: 208868
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 98, col 8 to line 98, col 30 of module replicated: 412787
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 98, col 8 to line 98, col 25 of module replicated: 208868
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 92, col 15 to line 92, col 33 of module replicated: 208868
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 94, col 5 to line 94, col 66 of module replicated: 208868
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 94, col 26 to line 94, col 65 of module replicated: 626604
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 94, col 12 to line 94, col 23 of module replicated: 208868
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 98, col 24 to line 98, col 24 of module replicated: 208868
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 98, col 29 to line 98, col 30 of module replicated: 208868
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 99, col 8 to line 99, col 109 of module replicated: 203919
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 99, col 28 to line 99, col 109 of module replicated: 203919
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 99, col 29 to line 99, col 44 of module replicated: 203919
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 99, col 52 to line 99, col 108 of module replicated: 203919
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 99, col 72 to line 99, col 108 of module replicated: 203919
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 99, col 105 to line 99, col 108 of module replicated: 203919
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 99, col 85 to line 99, col 102 of module replicated: 203919
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||||line 92, col 15 to line 92, col 33 of module replicated: 203919
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2775:0 @!@!@
||||line 94, col 5 to line 94, col 66 of module replicated: 203919:203919
@!@!@ENDMSG 2775 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||||line 94, col 26 to line 94, col 65 of module replicated: 611757
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||||line 94, col 12 to line 94, col 23 of module replicated: 203919
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||||line 99, col 101 to line 99, col 101 of module replicated: 203919
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 100, col 8 to line 100, col 58 of module replicated: 203919
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2774:0 @!@!@
<PsLagsSk line 118, col 1 to line 118, col 8 of module replicated>
@!@!@ENDMSG 2774 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 118, col 13 to line 119, col 81 of module replicated: 736274
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 118, col 35 to line 119, col 81 of module replicated: 736274
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 119, col 9 to line 119, col 81 of module replicated: 2208822
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 118, col 44 to line 118, col 72 of module replicated: 736274
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 118, col 22 to line 118, col 32 of module replicated: 736274
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2202:0 @!@!@
End of statistics.
@!@!@ENDMSG 2202 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(25) at 2025-01-19 18:39:14: 3.224.329 states generated (2.761.383 s/min), 208.868 distinct states found (178.878 ds/min), 0 states left on queue.
@!@!@ENDMSG 2200 @!@!@
@!@!@STARTMSG 2199:0 @!@!@
3224329 states generated, 208868 distinct states found, 0 states left on queue.
@!@!@ENDMSG 2199 @!@!@
@!@!@STARTMSG 2194:0 @!@!@
The depth of the complete state graph search is 25.
@!@!@ENDMSG 2194 @!@!@
@!@!@STARTMSG 2268:0 @!@!@
The average outdegree of the complete state graph is 1 (minimum is 0, the maximum 9 and the 95th percentile is 3).
@!@!@ENDMSG 2268 @!@!@
@!@!@STARTMSG 2186:0 @!@!@
Finished in 70074ms at (2025-01-19 18:39:14)
@!@!@ENDMSG 2186 @!@!@
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308355472/MC.tla
+65
View File
@@ -0,0 +1,65 @@
---- MODULE MC ----
EXTENDS replicated, TLC
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
b1, b2, b3
----
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
s1, s2, s3
----
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
p1
----
\* MV CONSTANT declarations@modelParameterConstants
CONSTANTS
az1, az2, az3
----
\* MV CONSTANT definitions brokers
const_1737308284086143000 ==
{b1, b2, b3}
----
\* MV CONSTANT definitions safekeepers
const_1737308284086144000 ==
{s1, s2, s3}
----
\* MV CONSTANT definitions pageservers
const_1737308284086145000 ==
{p1}
----
\* MV CONSTANT definitions azs
const_1737308284086146000 ==
{az1, az2, az3}
----
\* SYMMETRY definition
symm_1737308284086147000 ==
Permutations(const_1737308284086143000) \union Permutations(const_1737308284086144000) \union Permutations(const_1737308284086145000) \union Permutations(const_1737308284086146000)
----
\* CONSTANT definitions @modelParameterConstants:4max_commit_lsn
const_1737308284086148000 ==
2
----
\* CONSTANT definitions @modelParameterConstants:5az_mapping
const_1737308284086149000 ==
[ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2} , az3 |-> {b3,s3}]
----
\* CONSTRAINT definition @modelParameterContraint:0
constr_1737308284086150000 ==
StateConstraint
----
=============================================================================
\* Modification History
\* Created Sun Jan 19 18:38:04 CET 2025 by cs
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308355472/MC_TE.out
+354
View File
@@ -0,0 +1,354 @@
@!@!@STARTMSG 2262:0 @!@!@
TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802)
@!@!@ENDMSG 2262 @!@!@
@!@!@STARTMSG 2187:0 @!@!@
Running breadth-first search Model-Checking with fp 96 and seed 147884281130356166 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 12007] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue).
@!@!@ENDMSG 2187 @!@!@
@!@!@STARTMSG 2220:0 @!@!@
Starting SANY...
@!@!@ENDMSG 2220 @!@!@
Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla
Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla
Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla
Semantic processing of module Naturals
Semantic processing of module Integers
Semantic processing of module Sequences
Semantic processing of module FiniteSets
Semantic processing of module replicated
Semantic processing of module TLC
Semantic processing of module MC
@!@!@STARTMSG 2219:0 @!@!@
SANY finished.
@!@!@ENDMSG 2219 @!@!@
@!@!@STARTMSG 2185:0 @!@!@
Starting... (2025-01-19 18:38:05)
@!@!@ENDMSG 2185 @!@!@
@!@!@STARTMSG 2279:3 @!@!@
Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined.
@!@!@ENDMSG 2279 @!@!@
@!@!@STARTMSG 2284:3 @!@!@
Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details.
@!@!@ENDMSG 2284 @!@!@
@!@!@STARTMSG 2212:0 @!@!@
Implied-temporal checking--satisfiability problem has 1 branches.
@!@!@ENDMSG 2212 @!@!@
@!@!@STARTMSG 2189:0 @!@!@
Computing initial states...
@!@!@ENDMSG 2189 @!@!@
@!@!@STARTMSG 2190:0 @!@!@
Finished computing initial states: 1 distinct state generated at 2025-01-19 18:38:06.
@!@!@ENDMSG 2190 @!@!@
@!@!@STARTMSG 2192:0 @!@!@
Checking temporal properties for the current state space with 3861 total distinct states at (2025-01-19 18:38:09)
@!@!@ENDMSG 2192 @!@!@
@!@!@STARTMSG 2267:0 @!@!@
Finished checking temporal properties in 00s at 2025-01-19 18:38:09
@!@!@ENDMSG 2267 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(11) at 2025-01-19 18:38:09: 77.856 states generated (77.856 s/min), 8.653 distinct states found (8.653 ds/min), 4.790 states left on queue.
@!@!@ENDMSG 2200 @!@!@
@!@!@STARTMSG 2192:0 @!@!@
Checking temporal properties for the current state space with 197257 total distinct states at (2025-01-19 18:39:09)
@!@!@ENDMSG 2192 @!@!@
@!@!@STARTMSG 2267:0 @!@!@
Finished checking temporal properties in 00s at 2025-01-19 18:39:09
@!@!@ENDMSG 2267 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(20) at 2025-01-19 18:39:09: 3.084.377 states generated (3.006.521 s/min), 204.964 distinct states found (196.311 ds/min), 7.704 states left on queue.
@!@!@ENDMSG 2200 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(25) at 2025-01-19 18:39:12: 3.224.329 states generated, 208.868 distinct states found, 0 states left on queue.
@!@!@ENDMSG 2200 @!@!@
@!@!@STARTMSG 2192:0 @!@!@
Checking temporal properties for the complete state space with 208868 total distinct states at (2025-01-19 18:39:12)
@!@!@ENDMSG 2192 @!@!@
@!@!@STARTMSG 2267:0 @!@!@
Finished checking temporal properties in 00s at 2025-01-19 18:39:12
@!@!@ENDMSG 2267 @!@!@
@!@!@STARTMSG 2193:0 @!@!@
Model checking completed. No error has been found.
Estimates of the probability that TLC did not check all reachable states
because two distinct states had the same fingerprint:
calculated (optimistic): val = 3.4E-8
based on the actual fingerprints: val = 6.3E-10
@!@!@ENDMSG 2193 @!@!@
@!@!@STARTMSG 2201:0 @!@!@
The coverage statistics at 2025-01-19 18:39:14
@!@!@ENDMSG 2201 @!@!@
@!@!@STARTMSG 2773:0 @!@!@
<Init line 34, col 1 to line 34, col 4 of module replicated>: 1:1
@!@!@ENDMSG 2773 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 35, col 5 to line 38, col 26 of module replicated: 1
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<NodeOnlineOffline line 40, col 1 to line 40, col 17 of module replicated>: 14290:208868
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 41, col 8 to line 44, col 44 of module replicated: 208868
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 41, col 18 to line 44, col 44 of module replicated: 208868
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 42, col 9 to line 44, col 44 of module replicated: 22348876
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 42, col 12 to line 42, col 48 of module replicated: 22348876
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 43, col 12 to line 43, col 44 of module replicated: 8981324
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 44, col 12 to line 44, col 44 of module replicated: 2924152
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 41, col 32 to line 41, col 48 of module replicated: 208868
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 45, col 8 to line 45, col 67 of module replicated: 208868
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkCommit line 47, col 1 to line 47, col 16 of module replicated>: 84:530666
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 48, col 8 to line 48, col 32 of module replicated: 2410478
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2775:0 @!@!@
|line 48, col 8 to line 48, col 15 of module replicated: 1879812:4246157
@!@!@ENDMSG 2775 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 48, col 27 to line 48, col 32 of module replicated: 1879812
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 49, col 8 to line 49, col 14 of module replicated: 1643803
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 49, col 8 to line 49, col 9 of module replicated: 1113137
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 49, col 13 to line 49, col 14 of module replicated: 1113137
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 50, col 8 to line 50, col 72 of module replicated: 1170534
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 50, col 8 to line 50, col 38 of module replicated: 639868
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 50, col 42 to line 50, col 72 of module replicated: 639868
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 54, col 13 to line 56, col 50 of module replicated: 530666
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 57, col 8 to line 57, col 58 of module replicated: 530666
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkPeerRecovery line 59, col 1 to line 59, col 21 of module replicated>: 682:54601
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 60, col 8 to line 60, col 32 of module replicated: 1934413
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2775:0 @!@!@
|line 60, col 8 to line 60, col 15 of module replicated: 1879812:4246157
@!@!@ENDMSG 2775 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 60, col 27 to line 60, col 32 of module replicated: 1879812
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 61, col 8 to line 61, col 72 of module replicated: 54601
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 61, col 8 to line 61, col 38 of module replicated: 1113137
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 61, col 42 to line 61, col 72 of module replicated: 1113137
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 62, col 8 to line 62, col 102 of module replicated: 54601
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 63, col 8 to line 63, col 58 of module replicated: 54601
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<SkPushToBroker line 65, col 1 to line 65, col 19 of module replicated>: 45241:1113137
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 66, col 8 to line 66, col 30 of module replicated: 2992949
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2775:0 @!@!@
|line 66, col 8 to line 66, col 13 of module replicated: 1879812:4412756
@!@!@ENDMSG 2775 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 66, col 25 to line 66, col 30 of module replicated: 1879812
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 67, col 8 to line 74, col 29 of module replicated: 1113137
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 67, col 24 to line 74, col 29 of module replicated: 1113137
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 67, col 27 to line 67, col 91 of module replicated: 1113137
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 70, col 28 to line 70, col 45 of module replicated: 611653
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 71, col 31 to line 71, col 91 of module replicated: 611653
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 73, col 17 to line 73, col 54 of module replicated: 611653
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 74, col 18 to line 74, col 29 of module replicated: 501484
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 75, col 8 to line 75, col 62 of module replicated: 1113137
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<PsRecvBroker line 77, col 1 to line 77, col 19 of module replicated>: 90643:1113137
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 78, col 8 to line 78, col 31 of module replicated: 2992949
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2775:0 @!@!@
|line 78, col 8 to line 78, col 14 of module replicated: 1879812:5525893
@!@!@ENDMSG 2775 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 78, col 26 to line 78, col 31 of module replicated: 1879812
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 84, col 13 to line 86, col 37 of module replicated: 1113137
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 84, col 33 to line 86, col 37 of module replicated: 1113137
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 84, col 36 to line 84, col 66 of module replicated: 1113137
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 85, col 22 to line 85, col 66 of module replicated: 406880
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 86, col 22 to line 86, col 37 of module replicated: 706257
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 87, col 8 to line 87, col 58 of module replicated: 1113137
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2772:0 @!@!@
<PsChooseSk line 96, col 1 to line 96, col 13 of module replicated>: 57927:203919
@!@!@ENDMSG 2772 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 97, col 8 to line 97, col 27 of module replicated: 412787
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2775:0 @!@!@
|line 97, col 8 to line 97, col 10 of module replicated: 208868:417736
@!@!@ENDMSG 2775 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 97, col 22 to line 97, col 27 of module replicated: 208868
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 98, col 8 to line 98, col 30 of module replicated: 412787
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 98, col 8 to line 98, col 25 of module replicated: 208868
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 92, col 15 to line 92, col 33 of module replicated: 208868
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 94, col 5 to line 94, col 66 of module replicated: 208868
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 94, col 26 to line 94, col 65 of module replicated: 626604
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 94, col 12 to line 94, col 23 of module replicated: 208868
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 98, col 24 to line 98, col 24 of module replicated: 208868
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 98, col 29 to line 98, col 30 of module replicated: 208868
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 99, col 8 to line 99, col 109 of module replicated: 203919
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 99, col 28 to line 99, col 109 of module replicated: 203919
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 99, col 29 to line 99, col 44 of module replicated: 203919
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 99, col 52 to line 99, col 108 of module replicated: 203919
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 99, col 72 to line 99, col 108 of module replicated: 203919
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 99, col 105 to line 99, col 108 of module replicated: 203919
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||line 99, col 85 to line 99, col 102 of module replicated: 203919
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||||line 92, col 15 to line 92, col 33 of module replicated: 203919
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2775:0 @!@!@
||||line 94, col 5 to line 94, col 66 of module replicated: 203919:203919
@!@!@ENDMSG 2775 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||||line 94, col 26 to line 94, col 65 of module replicated: 611757
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|||||line 94, col 12 to line 94, col 23 of module replicated: 203919
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||||line 99, col 101 to line 99, col 101 of module replicated: 203919
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 100, col 8 to line 100, col 58 of module replicated: 203919
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2774:0 @!@!@
<PsLagsSk line 118, col 1 to line 118, col 8 of module replicated>
@!@!@ENDMSG 2774 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
line 118, col 13 to line 119, col 81 of module replicated: 736274
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 118, col 35 to line 119, col 81 of module replicated: 736274
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 119, col 9 to line 119, col 81 of module replicated: 2208822
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
||line 118, col 44 to line 118, col 72 of module replicated: 736274
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2221:0 @!@!@
|line 118, col 22 to line 118, col 32 of module replicated: 736274
@!@!@ENDMSG 2221 @!@!@
@!@!@STARTMSG 2202:0 @!@!@
End of statistics.
@!@!@ENDMSG 2202 @!@!@
@!@!@STARTMSG 2200:0 @!@!@
Progress(25) at 2025-01-19 18:39:14: 3.224.329 states generated (2.761.383 s/min), 208.868 distinct states found (178.878 ds/min), 0 states left on queue.
@!@!@ENDMSG 2200 @!@!@
@!@!@STARTMSG 2199:0 @!@!@
3224329 states generated, 208868 distinct states found, 0 states left on queue.
@!@!@ENDMSG 2199 @!@!@
@!@!@STARTMSG 2194:0 @!@!@
The depth of the complete state graph search is 25.
@!@!@ENDMSG 2194 @!@!@
@!@!@STARTMSG 2268:0 @!@!@
The average outdegree of the complete state graph is 1 (minimum is 0, the maximum 9 and the 95th percentile is 3).
@!@!@ENDMSG 2268 @!@!@
@!@!@STARTMSG 2186:0 @!@!@
Finished in 70074ms at (2025-01-19 18:39:14)
@!@!@ENDMSG 2186 @!@!@
storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308355472/replicated.tla
+134
View File
@@ -0,0 +1,134 @@
---- MODULE replicated ----
EXTENDS Integers, FiniteSets
VARIABLES broker_state, safekeeper_state, pageserver_state, online
CONSTANT
brokers,
safekeepers,
pageservers,
azs,
az_mapping
CONSTANT
NULL
CONSTANT
max_commit_lsn
StateConstraint ==
/\ \A s \in safekeepers:
/\ safekeeper_state[s].commit_lsn <= max_commit_lsn
/\ \A b \in brokers:
/\ \A s \in DOMAIN broker_state[b].sk:
/\ broker_state[b].sk[s].commit_lsn <= max_commit_lsn
InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0]
InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]]
InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]]
InitOnline == safekeepers \cup brokers \cup pageservers
Init ==
/\ broker_state = [b \in brokers |-> InitBroker]
/\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper]
/\ pageserver_state = [p \in pageservers |-> InitPageserver]
/\ online = InitOnline
NodeOnlineOffline ==
/\ online' = CHOOSE ss \in SUBSET InitOnline:
/\ Cardinality(ss \cap safekeepers) >= 2
/\ Cardinality(ss \cap brokers) >= 2
/\ ss \cap pageservers = pageservers \* assume no PS failures for now
/\ UNCHANGED <<safekeeper_state,broker_state,pageserver_state>>
SkCommit(s1, s2) ==
/\ {s1, s2} \subseteq online
/\ s1 # s2
/\ safekeeper_state[s1].commit_lsn = safekeeper_state[s2].commit_lsn
/\ LET
new_commit_lsn == safekeeper_state[s1].commit_lsn + 1
IN
safekeeper_state' = [safekeeper_state EXCEPT
![s1].commit_lsn = new_commit_lsn,
![s2].commit_lsn = new_commit_lsn]
/\ UNCHANGED <<broker_state, pageserver_state,online>>
SkPeerRecovery(s1,s2) ==
/\ {s1, s2} \subseteq online
/\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn
/\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn]
/\ UNCHANGED <<broker_state, pageserver_state,online>>
SkPushToBroker(s,b) ==
/\ {s, b} \subseteq online
/\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn
THEN
LET
bsk == broker_state[b].sk
updbsk == [bsk EXCEPT ![s].commit_lsn = safekeeper_state[s].commit_lsn]
IN
[broker_state EXCEPT ![b].sk = updbsk]
ELSE broker_state
/\ UNCHANGED <<safekeeper_state, pageserver_state,online>>
PsRecvBroker(b,p,s) ==
/\ {b,p,s} \subseteq online
/\ LET
bsk == broker_state[b].sk[s]
psk == pageserver_state[p].sk[s]
updpsk == [psk EXCEPT !["commit_lsn"] = bsk.commit_lsn]
IN
pageserver_state' = IF bsk.commit_lsn > psk.commit_lsn
THEN [pageserver_state EXCEPT ![p].sk[s] = updpsk]
ELSE pageserver_state
/\ UNCHANGED <<safekeeper_state, broker_state,online>>
SksWithNewerWal(p) ==
LET
ps == pageserver_state[p]
IN
{s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn}
PsChooseSk(p) ==
/\ {p} \subseteq online
/\ SksWithNewerWal(p) # {}
/\ pageserver_state' = [pageserver_state EXCEPT![p].preferred_sk = CHOOSE s \in SksWithNewerWal(p): TRUE]
/\ UNCHANGED <<safekeeper_state, broker_state,online>>
Next ==
\/ NodeOnlineOffline
\/ \E s1 \in safekeepers: \E s2 \in safekeepers:
\/ SkCommit(s1, s2)
\/ SkPeerRecovery(s1, s2)
\/ \E s \in safekeepers: \E b \in brokers: SkPushToBroker(s, b)
\/ \E s \in safekeepers: \E b \in brokers: \E p \in pageservers: PsRecvBroker(b,p,s)
\/ \E p \in pageservers: PsChooseSk(p)
Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state,online>>
\* invariants
PsLagsSk == \A p \in pageservers: \A s \in DOMAIN pageserver_state[p].sk:
/\ pageserver_state[p].sk[s].commit_lsn <= safekeeper_state[s].commit_lsn
EventuallyLaggingSkIsNotPreferredSk == <>(
LET
sks == safekeeper_state
lagging_sks == { s \in safekeepers: \A s2 \in safekeepers: sks[s].commit_lsn <= sks[s2].commit_lsn }
preferred_sks == {pageserver_state[p].preferred_sk: p \in pageservers}
IN
preferred_sks \cap lagging_sks = {}
)
====
storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1.launch
+7 -5
View File
@@ -12,7 +12,7 @@
<stringAttribute key="distributedTLC" value="off"/>
<stringAttribute key="distributedTLCVMArgs" value=""/>
<intAttribute key="fpBits" value="1"/>
<intAttribute key="fpIndex" value="119"/>
<intAttribute key="fpIndex" value="24"/>
<booleanAttribute key="fpIndexRandom" value="true"/>
<intAttribute key="maxHeapSize" value="25"/>
<intAttribute key="maxSetSize" value="1000000"/>
@@ -21,10 +21,12 @@
<stringAttribute key="modelBehaviorNext" value=""/>
<stringAttribute key="modelBehaviorSpec" value="Spec"/>
<intAttribute key="modelBehaviorSpecType" value="1"/>
<stringAttribute key="modelBehaviorVars" value="pageserver_state, broker_state, safekeeper_state"/>
<stringAttribute key="modelBehaviorVars" value="pageserver_state, broker_state, online, safekeeper_state"/>
<stringAttribute key="modelComments" value=""/>
<booleanAttribute key="modelCorrectnessCheckDeadlock" value="true"/>
<listAttribute key="modelCorrectnessInvariants"/>
<listAttribute key="modelCorrectnessInvariants">
<listEntry value="1PsLagsSk"/>
</listAttribute>
<listAttribute key="modelCorrectnessProperties">
<listEntry value="1EventuallyLaggingSkIsNotPreferredSk"/>
</listAttribute>
@@ -35,9 +37,9 @@
<listEntry value="brokers;;{b1, b2, b3};1;1"/>
<listEntry value="NULL;;NULL;1;0"/>
<listEntry value="safekeepers;;{s1, s2, s3};1;1"/>
<listEntry value="pageservers;;{p1, p2};1;1"/>
<listEntry value="pageservers;;{p1};1;1"/>
<listEntry value="max_commit_lsn;;2;0;0"/>
<listEntry value="az_mapping;;[ az1 |-&gt; {b1,s1,p1} , az2 |-&gt; {b2,s2,p2} , az3 |-&gt; {b3,s3}];0;0"/>
<listEntry value="az_mapping;;[ az1 |-&gt; {b1,s1,p1} , az2 |-&gt; {b2,s2} , az3 |-&gt; {b3,s3}];0;0"/>
<listEntry value="azs;;{az1, az2, az3};1;1"/>
</listAttribute>
<stringAttribute key="modelParameterContraint" value="StateConstraint"/>
storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737296416956.launch
-38
View File
@@ -1,38 +0,0 @@
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<launchConfiguration type="org.lamport.tla.toolbox.tool.tlc.modelCheck">
<stringAttribute key="configurationName" value="Model_1_SnapShot_1737296416956"/>
<intAttribute key="distributedFPSetCount" value="0"/>
<stringAttribute key="distributedNetworkInterface" value="100.65.224.26"/>
<intAttribute key="distributedNodesCount" value="1"/>
<stringAttribute key="distributedTLC" value="off"/>
<intAttribute key="fpIndex" value="60"/>
<intAttribute key="maxHeapSize" value="25"/>
<stringAttribute key="modelBehaviorInit" value=""/>
<stringAttribute key="modelBehaviorNext" value=""/>
<stringAttribute key="modelBehaviorSpec" value="Spec"/>
<intAttribute key="modelBehaviorSpecType" value="1"/>
<stringAttribute key="modelBehaviorVars" value="pageserver_state, broker_state, safekeeper_state"/>
<stringAttribute key="modelComments" value=""/>
<booleanAttribute key="modelCorrectnessCheckDeadlock" value="true"/>
<listAttribute key="modelCorrectnessInvariants"/>
<listAttribute key="modelCorrectnessProperties"/>
<intAttribute key="modelEditorOpenTabs" value="10"/>
<stringAttribute key="modelExpressionEval" value=""/>
<stringAttribute key="modelParameterActionConstraint" value=""/>
<listAttribute key="modelParameterConstants">
<listEntry value="brokers;;{b1, b2, b3};1;1"/>
<listEntry value="NULL;;NULL;1;0"/>
<listEntry value="safekeepers;;{s1, s2, s3};1;1"/>
<listEntry value="pageservers;;{p1, p2};1;1"/>
<listEntry value="max_commit_lsn;;2;0;0"/>
</listAttribute>
<stringAttribute key="modelParameterContraint" value="StateConstraint"/>
<listAttribute key="modelParameterDefinitions"/>
<stringAttribute key="modelParameterModelValues" value="{}"/>
<stringAttribute key="modelParameterNewDefinitions" value=""/>
<intAttribute key="modelVersion" value="20191005"/>
<intAttribute key="numberOfWorkers" value="4"/>
<stringAttribute key="result.mail.address" value=""/>
<stringAttribute key="specName" value="replicated"/>
<stringAttribute key="tlcResourcesProfile" value="local custom"/>
</launchConfiguration>
storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737297534393.launch
-40
View File
@@ -1,40 +0,0 @@
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<launchConfiguration type="org.lamport.tla.toolbox.tool.tlc.modelCheck">
<stringAttribute key="configurationName" value="Model_1_SnapShot_1737297534393"/>
<intAttribute key="distributedFPSetCount" value="0"/>
<stringAttribute key="distributedNetworkInterface" value="100.65.224.26"/>
<intAttribute key="distributedNodesCount" value="1"/>
<stringAttribute key="distributedTLC" value="off"/>
<intAttribute key="fpIndex" value="130"/>
<intAttribute key="maxHeapSize" value="25"/>
<stringAttribute key="modelBehaviorInit" value=""/>
<stringAttribute key="modelBehaviorNext" value=""/>
<stringAttribute key="modelBehaviorSpec" value="Spec"/>
<intAttribute key="modelBehaviorSpecType" value="1"/>
<stringAttribute key="modelBehaviorVars" value="pageserver_state, broker_state, safekeeper_state"/>
<stringAttribute key="modelComments" value=""/>
<booleanAttribute key="modelCorrectnessCheckDeadlock" value="true"/>
<listAttribute key="modelCorrectnessInvariants"/>
<listAttribute key="modelCorrectnessProperties"/>
<intAttribute key="modelEditorOpenTabs" value="10"/>
<stringAttribute key="modelExpressionEval" value=""/>
<stringAttribute key="modelParameterActionConstraint" value=""/>
<listAttribute key="modelParameterConstants">
<listEntry value="brokers;;{b1, b2, b3};1;1"/>
<listEntry value="NULL;;NULL;1;0"/>
<listEntry value="safekeepers;;{s1, s2, s3};1;1"/>
<listEntry value="pageservers;;{p1, p2};1;1"/>
<listEntry value="max_commit_lsn;;2;0;0"/>
<listEntry value="az_mapping;;[ az1 |-&gt; {b1,s1,p1} , az2 |-&gt; {b2,s2,p2} , az3 |-&gt; {b3,s3}];0;0"/>
<listEntry value="azs;;{az1, az2, az3};1;1"/>
</listAttribute>
<stringAttribute key="modelParameterContraint" value="StateConstraint"/>
<listAttribute key="modelParameterDefinitions"/>
<stringAttribute key="modelParameterModelValues" value="{}"/>
<stringAttribute key="modelParameterNewDefinitions" value=""/>
<intAttribute key="modelVersion" value="20191005"/>
<intAttribute key="numberOfWorkers" value="4"/>
<stringAttribute key="result.mail.address" value=""/>
<stringAttribute key="specName" value="replicated"/>
<stringAttribute key="tlcResourcesProfile" value="local custom"/>
</launchConfiguration>
storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737297999722.launch
-40
View File
@@ -1,40 +0,0 @@
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<launchConfiguration type="org.lamport.tla.toolbox.tool.tlc.modelCheck">
<stringAttribute key="configurationName" value="Model_1_SnapShot_1737297999722"/>
<intAttribute key="distributedFPSetCount" value="0"/>
<stringAttribute key="distributedNetworkInterface" value="100.65.224.26"/>
<intAttribute key="distributedNodesCount" value="1"/>
<stringAttribute key="distributedTLC" value="off"/>
<intAttribute key="fpIndex" value="0"/>
<intAttribute key="maxHeapSize" value="25"/>
<stringAttribute key="modelBehaviorInit" value=""/>
<stringAttribute key="modelBehaviorNext" value=""/>
<stringAttribute key="modelBehaviorSpec" value="Spec"/>
<intAttribute key="modelBehaviorSpecType" value="1"/>
<stringAttribute key="modelBehaviorVars" value="pageserver_state, broker_state, safekeeper_state"/>
<stringAttribute key="modelComments" value=""/>
<booleanAttribute key="modelCorrectnessCheckDeadlock" value="true"/>
<listAttribute key="modelCorrectnessInvariants"/>
<listAttribute key="modelCorrectnessProperties"/>
<intAttribute key="modelEditorOpenTabs" value="10"/>
<stringAttribute key="modelExpressionEval" value=""/>
<stringAttribute key="modelParameterActionConstraint" value=""/>
<listAttribute key="modelParameterConstants">
<listEntry value="brokers;;{b1, b2, b3};1;1"/>
<listEntry value="NULL;;NULL;1;0"/>
<listEntry value="safekeepers;;{s1, s2, s3};1;1"/>
<listEntry value="pageservers;;{p1, p2};1;1"/>
<listEntry value="max_commit_lsn;;2;0;0"/>
<listEntry value="az_mapping;;[ az1 |-&gt; {b1,s1,p1} , az2 |-&gt; {b2,s2,p2} , az3 |-&gt; {b3,s3}];0;0"/>
<listEntry value="azs;;{az1, az2, az3};1;1"/>
</listAttribute>
<stringAttribute key="modelParameterContraint" value="StateConstraint"/>
<listAttribute key="modelParameterDefinitions"/>
<stringAttribute key="modelParameterModelValues" value="{}"/>
<stringAttribute key="modelParameterNewDefinitions" value=""/>
<intAttribute key="modelVersion" value="20191005"/>
<intAttribute key="numberOfWorkers" value="4"/>
<stringAttribute key="result.mail.address" value=""/>
<stringAttribute key="specName" value="replicated"/>
<stringAttribute key="tlcResourcesProfile" value="local custom"/>
</launchConfiguration>
storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737299352762.launch
-42
View File
@@ -1,42 +0,0 @@
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<launchConfiguration type="org.lamport.tla.toolbox.tool.tlc.modelCheck">
<stringAttribute key="configurationName" value="Model_1_SnapShot_1737299352762"/>
<intAttribute key="distributedFPSetCount" value="0"/>
<stringAttribute key="distributedNetworkInterface" value="100.65.224.26"/>
<intAttribute key="distributedNodesCount" value="1"/>
<stringAttribute key="distributedTLC" value="off"/>
<intAttribute key="fpIndex" value="119"/>
<intAttribute key="maxHeapSize" value="25"/>
<stringAttribute key="modelBehaviorInit" value=""/>
<stringAttribute key="modelBehaviorNext" value=""/>
<stringAttribute key="modelBehaviorSpec" value="Spec"/>
<intAttribute key="modelBehaviorSpecType" value="1"/>
<stringAttribute key="modelBehaviorVars" value="pageserver_state, broker_state, safekeeper_state"/>
<stringAttribute key="modelComments" value=""/>
<booleanAttribute key="modelCorrectnessCheckDeadlock" value="true"/>
<listAttribute key="modelCorrectnessInvariants">
<listEntry value="1EventuallyLaggingSkIsNotPreferredSk"/>
</listAttribute>
<listAttribute key="modelCorrectnessProperties"/>
<intAttribute key="modelEditorOpenTabs" value="10"/>
<stringAttribute key="modelExpressionEval" value=""/>
<stringAttribute key="modelParameterActionConstraint" value=""/>
<listAttribute key="modelParameterConstants">
<listEntry value="brokers;;{b1, b2, b3};1;1"/>
<listEntry value="NULL;;NULL;1;0"/>
<listEntry value="safekeepers;;{s1, s2, s3};1;1"/>
<listEntry value="pageservers;;{p1, p2};1;1"/>
<listEntry value="max_commit_lsn;;2;0;0"/>
<listEntry value="az_mapping;;[ az1 |-&gt; {b1,s1,p1} , az2 |-&gt; {b2,s2,p2} , az3 |-&gt; {b3,s3}];0;0"/>
<listEntry value="azs;;{az1, az2, az3};1;1"/>
</listAttribute>
<stringAttribute key="modelParameterContraint" value="StateConstraint"/>
<listAttribute key="modelParameterDefinitions"/>
<stringAttribute key="modelParameterModelValues" value="{}"/>
<stringAttribute key="modelParameterNewDefinitions" value=""/>
<intAttribute key="modelVersion" value="20191005"/>
<intAttribute key="numberOfWorkers" value="4"/>
<stringAttribute key="result.mail.address" value=""/>
<stringAttribute key="specName" value="replicated"/>
<stringAttribute key="tlcResourcesProfile" value="local custom"/>
</launchConfiguration>
storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737301172627.launch
-58
View File
@@ -1,58 +0,0 @@
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<launchConfiguration type="org.lamport.tla.toolbox.tool.tlc.modelCheck">
<stringAttribute key="TLCCmdLineParameters" value=""/>
<intAttribute key="collectCoverage" value="1"/>
<stringAttribute key="configurationName" value="Model_1_SnapShot_1737301172627"/>
<booleanAttribute key="deferLiveness" value="false"/>
<intAttribute key="dfidDepth" value="100"/>
<booleanAttribute key="dfidMode" value="false"/>
<intAttribute key="distributedFPSetCount" value="0"/>
<stringAttribute key="distributedNetworkInterface" value="100.65.224.26"/>
<intAttribute key="distributedNodesCount" value="1"/>
<stringAttribute key="distributedTLC" value="off"/>
<stringAttribute key="distributedTLCVMArgs" value=""/>
<intAttribute key="fpBits" value="1"/>
<intAttribute key="fpIndex" value="119"/>
<booleanAttribute key="fpIndexRandom" value="true"/>
<intAttribute key="maxHeapSize" value="25"/>
<intAttribute key="maxSetSize" value="1000000"/>
<booleanAttribute key="mcMode" value="true"/>
<stringAttribute key="modelBehaviorInit" value=""/>
<stringAttribute key="modelBehaviorNext" value=""/>
<stringAttribute key="modelBehaviorSpec" value="Spec"/>
<intAttribute key="modelBehaviorSpecType" value="1"/>
<stringAttribute key="modelBehaviorVars" value="pageserver_state, broker_state, safekeeper_state"/>
<stringAttribute key="modelComments" value=""/>
<booleanAttribute key="modelCorrectnessCheckDeadlock" value="true"/>
<listAttribute key="modelCorrectnessInvariants"/>
<listAttribute key="modelCorrectnessProperties">
<listEntry value="1EventuallyLaggingSkIsNotPreferredSk"/>
</listAttribute>
<intAttribute key="modelEditorOpenTabs" value="14"/>
<stringAttribute key="modelExpressionEval" value=""/>
<stringAttribute key="modelParameterActionConstraint" value=""/>
<listAttribute key="modelParameterConstants">
<listEntry value="brokers;;{b1, b2, b3};1;1"/>
<listEntry value="NULL;;NULL;1;0"/>
<listEntry value="safekeepers;;{s1, s2, s3};1;1"/>
<listEntry value="pageservers;;{p1, p2};1;1"/>
<listEntry value="max_commit_lsn;;2;0;0"/>
<listEntry value="az_mapping;;[ az1 |-&gt; {b1,s1,p1} , az2 |-&gt; {b2,s2,p2} , az3 |-&gt; {b3,s3}];0;0"/>
<listEntry value="azs;;{az1, az2, az3};1;1"/>
</listAttribute>
<stringAttribute key="modelParameterContraint" value="StateConstraint"/>
<listAttribute key="modelParameterDefinitions"/>
<stringAttribute key="modelParameterModelValues" value="{}"/>
<stringAttribute key="modelParameterNewDefinitions" value=""/>
<intAttribute key="modelVersion" value="20191005"/>
<intAttribute key="numberOfWorkers" value="4"/>
<booleanAttribute key="recover" value="false"/>
<stringAttribute key="result.mail.address" value=""/>
<intAttribute key="simuAril" value="-1"/>
<intAttribute key="simuDepth" value="100"/>
<intAttribute key="simuSeed" value="-1"/>
<stringAttribute key="specName" value="replicated"/>
<stringAttribute key="tlcResourcesProfile" value="local custom"/>
<stringAttribute key="view" value=""/>
<booleanAttribute key="visualizeStateGraph" value="false"/>
</launchConfiguration>

Some files were not shown because too many files have changed in this diff Show More