diff --git a/storage_broker/spec/replicated/replicated.tla b/storage_broker/spec/replicated/replicated.tla index 14910364fe..33971e3071 100644 --- a/storage_broker/spec/replicated/replicated.tla +++ b/storage_broker/spec/replicated/replicated.tla @@ -1,8 +1,8 @@ ---- MODULE replicated ---- -EXTENDS Integers +EXTENDS Integers, FiniteSets -VARIABLES broker_state, safekeeper_state, pageserver_state +VARIABLES broker_state, safekeeper_state, pageserver_state, online CONSTANT @@ -29,14 +29,23 @@ StateConstraint == InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0] InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] +InitOnline == safekeepers \cup brokers \cup pageservers Init == /\ broker_state = [b \in brokers |-> InitBroker] /\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper] /\ pageserver_state = [p \in pageservers |-> InitPageserver] + /\ online = InitOnline +NodeOnlineOffline == + /\ online' = CHOOSE ss \in SUBSET InitOnline: + /\ Cardinality(ss \cap safekeepers) >= 2 + /\ Cardinality(ss \cap brokers) >= 2 + /\ ss \cap pageservers = pageservers \* assume no PS failures for now + /\ UNCHANGED <> SkCommit(s1, s2) == + /\ {s1, s2} \subseteq online /\ s1 # s2 /\ safekeeper_state[s1].commit_lsn = safekeeper_state[s2].commit_lsn /\ LET @@ -45,14 +54,16 @@ SkCommit(s1, s2) == safekeeper_state' = [safekeeper_state EXCEPT ![s1].commit_lsn = new_commit_lsn, ![s2].commit_lsn = new_commit_lsn] - /\ UNCHANGED <> + /\ UNCHANGED <> SkPeerRecovery(s1,s2) == + /\ {s1, s2} \subseteq online /\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn /\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn] - /\ UNCHANGED <> + /\ UNCHANGED <> SkPushToBroker(s,b) == + /\ {s, b} \subseteq online /\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn THEN LET @@ -61,9 +72,10 @@ SkPushToBroker(s,b) == IN [broker_state EXCEPT ![b].sk = updbsk] ELSE broker_state - /\ UNCHANGED <> + /\ UNCHANGED <> PsRecvBroker(b,p,s) == + /\ {b,p,s} \subseteq online /\ LET bsk == broker_state[b].sk[s] psk == pageserver_state[p].sk[s] @@ -72,7 +84,7 @@ PsRecvBroker(b,p,s) == pageserver_state' = IF bsk.commit_lsn > psk.commit_lsn THEN [pageserver_state EXCEPT ![p].sk[s] = updpsk] ELSE pageserver_state - /\ UNCHANGED <> + /\ UNCHANGED <> SksWithNewerWal(p) == @@ -82,13 +94,14 @@ SksWithNewerWal(p) == {s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn} PsChooseSk(p) == + /\ {p} \subseteq online /\ SksWithNewerWal(p) # {} /\ pageserver_state' = [pageserver_state EXCEPT![p].preferred_sk = CHOOSE s \in SksWithNewerWal(p): TRUE] - /\ UNCHANGED <> + /\ UNCHANGED <> Next == - + \/ NodeOnlineOffline \/ \E s1 \in safekeepers: \E s2 \in safekeepers: \/ SkCommit(s1, s2) \/ SkPeerRecovery(s1, s2) @@ -97,11 +110,15 @@ Next == \/ \E p \in pageservers: PsChooseSk(p) -Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state >> +Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state,online>> \* invariants +PsLagsSk == \A p \in pageservers: \A s \in DOMAIN pageserver_state[p].sk: + /\ pageserver_state[p].sk[s].commit_lsn <= safekeeper_state[s].commit_lsn + + EventuallyLaggingSkIsNotPreferredSk == <>( LET sks == safekeeper_state diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-16-40-15/MC-0.st b/storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-16-40-15/MC-0.st deleted file mode 100644 index ea733796c7..0000000000 Binary files a/storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-16-40-15/MC-0.st and /dev/null differ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-16-40-15/MC-1.st b/storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-16-40-15/MC-1.st deleted file mode 100644 index 0b468bb253..0000000000 Binary files a/storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-16-40-15/MC-1.st and /dev/null differ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-16-40-15/MC-2.st b/storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-16-40-15/MC-2.st deleted file mode 100644 index 5a85056577..0000000000 Binary files a/storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-16-40-15/MC-2.st and /dev/null differ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-16-40-15/MC-3.st b/storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-16-40-15/MC-3.st deleted file mode 100644 index 2eece7fbb5..0000000000 Binary files a/storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-16-40-15/MC-3.st and /dev/null differ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.cfg b/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.cfg index 1dcac21267..f7828ba1ce 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.cfg +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.cfg @@ -11,7 +11,6 @@ s3 = s3 \* MV CONSTANT declarations CONSTANTS p1 = p1 -p2 = p2 \* MV CONSTANT declarations CONSTANTS az1 = az1 @@ -19,33 +18,36 @@ az2 = az2 az3 = az3 \* MV CONSTANT definitions CONSTANT -brokers <- const_17373012151752000 +brokers <- const_1737309054555163000 \* CONSTANT declarations CONSTANT NULL = NULL \* MV CONSTANT definitions CONSTANT -safekeepers <- const_17373012151763000 +safekeepers <- const_1737309054555164000 \* MV CONSTANT definitions CONSTANT -pageservers <- const_17373012151764000 +pageservers <- const_1737309054555165000 \* MV CONSTANT definitions CONSTANT -azs <- const_17373012151765000 +azs <- const_1737309054555166000 \* SYMMETRY definition -SYMMETRY symm_17373012151766000 +SYMMETRY symm_1737309054555167000 \* CONSTANT definitions CONSTANT -max_commit_lsn <- const_17373012151767000 +max_commit_lsn <- const_1737309054555168000 \* CONSTANT definitions CONSTANT -az_mapping <- const_17373012151768000 +az_mapping <- const_1737309054555169000 \* CONSTRAINT definition CONSTRAINT -constr_17373012151769000 +constr_1737309054555170000 \* SPECIFICATION definition SPECIFICATION Spec +\* INVARIANT definition +INVARIANT +PsLagsSk \* PROPERTY definition PROPERTY EventuallyLaggingSkIsNotPreferredSk -\* Generated on Sun Jan 19 16:40:15 CET 2025 \ No newline at end of file +\* Generated on Sun Jan 19 18:50:54 CET 2025 \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.out index ab92cbb3d7..e69de29bb2 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.out +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.out @@ -1,53 +0,0 @@ -@!@!@STARTMSG 2262:0 @!@!@ -TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) -@!@!@ENDMSG 2262 @!@!@ -@!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 20 and seed 6372772458573668883 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 9898] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). -@!@!@ENDMSG 2187 @!@!@ -@!@!@STARTMSG 2220:0 @!@!@ -Starting SANY... -@!@!@ENDMSG 2220 @!@!@ -Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla -Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla -Semantic processing of module Naturals -Semantic processing of module Integers -Semantic processing of module replicated -Semantic processing of module Sequences -Semantic processing of module FiniteSets -Semantic processing of module TLC -Semantic processing of module MC -@!@!@STARTMSG 2219:0 @!@!@ -SANY finished. -@!@!@ENDMSG 2219 @!@!@ -@!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 16:40:16) -@!@!@ENDMSG 2185 @!@!@ -@!@!@STARTMSG 2279:3 @!@!@ -Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. -@!@!@ENDMSG 2279 @!@!@ -@!@!@STARTMSG 2284:3 @!@!@ -Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. -@!@!@ENDMSG 2284 @!@!@ -@!@!@STARTMSG 2212:0 @!@!@ -Implied-temporal checking--satisfiability problem has 1 branches. -@!@!@ENDMSG 2212 @!@!@ -@!@!@STARTMSG 2189:0 @!@!@ -Computing initial states... -@!@!@ENDMSG 2189 @!@!@ -@!@!@STARTMSG 2190:0 @!@!@ -Finished computing initial states: 1 distinct state generated at 2025-01-19 16:40:18. -@!@!@ENDMSG 2190 @!@!@ -@!@!@STARTMSG 2192:0 @!@!@ -Checking temporal properties for the current state space with 1217 total distinct states at (2025-01-19 16:40:21) -@!@!@ENDMSG 2192 @!@!@ -@!@!@STARTMSG 2267:0 @!@!@ -Finished checking temporal properties in 00s at 2025-01-19 16:40:21 -@!@!@ENDMSG 2267 @!@!@ -@!@!@STARTMSG 2200:0 @!@!@ -Progress(11) at 2025-01-19 16:40:21: 39.816 states generated (39.816 s/min), 3.288 distinct states found (3.288 ds/min), 2.067 states left on queue. -@!@!@ENDMSG 2200 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla index 316c6f4df7..b2245ec002 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla @@ -13,7 +13,7 @@ s1, s2, s3 \* MV CONSTANT declarations@modelParameterConstants CONSTANTS -p1, p2 +p1 ---- \* MV CONSTANT declarations@modelParameterConstants @@ -22,44 +22,44 @@ az1, az2, az3 ---- \* MV CONSTANT definitions brokers -const_17373012151752000 == +const_1737309054555163000 == {b1, b2, b3} ---- \* MV CONSTANT definitions safekeepers -const_17373012151763000 == +const_1737309054555164000 == {s1, s2, s3} ---- \* MV CONSTANT definitions pageservers -const_17373012151764000 == -{p1, p2} +const_1737309054555165000 == +{p1} ---- \* MV CONSTANT definitions azs -const_17373012151765000 == +const_1737309054555166000 == {az1, az2, az3} ---- \* SYMMETRY definition -symm_17373012151766000 == -Permutations(const_17373012151752000) \union Permutations(const_17373012151763000) \union Permutations(const_17373012151764000) \union Permutations(const_17373012151765000) +symm_1737309054555167000 == +Permutations(const_1737309054555163000) \union Permutations(const_1737309054555164000) \union Permutations(const_1737309054555165000) \union Permutations(const_1737309054555166000) ---- \* CONSTANT definitions @modelParameterConstants:4max_commit_lsn -const_17373012151767000 == +const_1737309054555168000 == 2 ---- \* CONSTANT definitions @modelParameterConstants:5az_mapping -const_17373012151768000 == -[ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2,p2} , az3 |-> {b3,s3}] +const_1737309054555169000 == +[ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2} , az3 |-> {b3,s3}] ---- \* CONSTRAINT definition @modelParameterContraint:0 -constr_17373012151769000 == +constr_1737309054555170000 == StateConstraint ---- ============================================================================= \* Modification History -\* Created Sun Jan 19 16:40:15 CET 2025 by cs +\* Created Sun Jan 19 18:50:54 CET 2025 by cs diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC_TE.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC_TE.out index ab92cbb3d7..72ebe05b45 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC_TE.out +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC_TE.out @@ -2,7 +2,7 @@ TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) @!@!@ENDMSG 2262 @!@!@ @!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 20 and seed 6372772458573668883 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 9898] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +Running breadth-first search Model-Checking with fp 96 and seed 147884281130356166 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 12007] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). @!@!@ENDMSG 2187 @!@!@ @!@!@STARTMSG 2220:0 @!@!@ Starting SANY... @@ -11,21 +11,21 @@ Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbo Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla Semantic processing of module Naturals Semantic processing of module Integers -Semantic processing of module replicated Semantic processing of module Sequences Semantic processing of module FiniteSets +Semantic processing of module replicated Semantic processing of module TLC Semantic processing of module MC @!@!@STARTMSG 2219:0 @!@!@ SANY finished. @!@!@ENDMSG 2219 @!@!@ @!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 16:40:16) +Starting... (2025-01-19 18:38:05) @!@!@ENDMSG 2185 @!@!@ @!@!@STARTMSG 2279:3 @!@!@ Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. @@ -40,14 +40,315 @@ Implied-temporal checking--satisfiability problem has 1 branches. Computing initial states... @!@!@ENDMSG 2189 @!@!@ @!@!@STARTMSG 2190:0 @!@!@ -Finished computing initial states: 1 distinct state generated at 2025-01-19 16:40:18. +Finished computing initial states: 1 distinct state generated at 2025-01-19 18:38:06. @!@!@ENDMSG 2190 @!@!@ @!@!@STARTMSG 2192:0 @!@!@ -Checking temporal properties for the current state space with 1217 total distinct states at (2025-01-19 16:40:21) +Checking temporal properties for the current state space with 3861 total distinct states at (2025-01-19 18:38:09) @!@!@ENDMSG 2192 @!@!@ @!@!@STARTMSG 2267:0 @!@!@ -Finished checking temporal properties in 00s at 2025-01-19 16:40:21 +Finished checking temporal properties in 00s at 2025-01-19 18:38:09 @!@!@ENDMSG 2267 @!@!@ @!@!@STARTMSG 2200:0 @!@!@ -Progress(11) at 2025-01-19 16:40:21: 39.816 states generated (39.816 s/min), 3.288 distinct states found (3.288 ds/min), 2.067 states left on queue. +Progress(11) at 2025-01-19 18:38:09: 77.856 states generated (77.856 s/min), 8.653 distinct states found (8.653 ds/min), 4.790 states left on queue. @!@!@ENDMSG 2200 @!@!@ +@!@!@STARTMSG 2192:0 @!@!@ +Checking temporal properties for the current state space with 197257 total distinct states at (2025-01-19 18:39:09) +@!@!@ENDMSG 2192 @!@!@ +@!@!@STARTMSG 2267:0 @!@!@ +Finished checking temporal properties in 00s at 2025-01-19 18:39:09 +@!@!@ENDMSG 2267 @!@!@ +@!@!@STARTMSG 2200:0 @!@!@ +Progress(20) at 2025-01-19 18:39:09: 3.084.377 states generated (3.006.521 s/min), 204.964 distinct states found (196.311 ds/min), 7.704 states left on queue. +@!@!@ENDMSG 2200 @!@!@ +@!@!@STARTMSG 2200:0 @!@!@ +Progress(25) at 2025-01-19 18:39:12: 3.224.329 states generated, 208.868 distinct states found, 0 states left on queue. +@!@!@ENDMSG 2200 @!@!@ +@!@!@STARTMSG 2192:0 @!@!@ +Checking temporal properties for the complete state space with 208868 total distinct states at (2025-01-19 18:39:12) +@!@!@ENDMSG 2192 @!@!@ +@!@!@STARTMSG 2267:0 @!@!@ +Finished checking temporal properties in 00s at 2025-01-19 18:39:12 +@!@!@ENDMSG 2267 @!@!@ +@!@!@STARTMSG 2193:0 @!@!@ +Model checking completed. No error has been found. + Estimates of the probability that TLC did not check all reachable states + because two distinct states had the same fingerprint: + calculated (optimistic): val = 3.4E-8 + based on the actual fingerprints: val = 6.3E-10 +@!@!@ENDMSG 2193 @!@!@ +@!@!@STARTMSG 2201:0 @!@!@ +The coverage statistics at 2025-01-19 18:39:14 +@!@!@ENDMSG 2201 @!@!@ +@!@!@STARTMSG 2773:0 @!@!@ +: 1:1 +@!@!@ENDMSG 2773 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 35, col 5 to line 38, col 26 of module replicated: 1 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 14290:208868 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 41, col 8 to line 44, col 44 of module replicated: 208868 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 41, col 18 to line 44, col 44 of module replicated: 208868 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 42, col 9 to line 44, col 44 of module replicated: 22348876 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 42, col 12 to line 42, col 48 of module replicated: 22348876 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 43, col 12 to line 43, col 44 of module replicated: 8981324 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 44, col 12 to line 44, col 44 of module replicated: 2924152 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 41, col 32 to line 41, col 48 of module replicated: 208868 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 45, col 8 to line 45, col 67 of module replicated: 208868 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 84:530666 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 48, col 8 to line 48, col 32 of module replicated: 2410478 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 48, col 8 to line 48, col 15 of module replicated: 1879812:4246157 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 48, col 27 to line 48, col 32 of module replicated: 1879812 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 49, col 8 to line 49, col 14 of module replicated: 1643803 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 49, col 8 to line 49, col 9 of module replicated: 1113137 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 49, col 13 to line 49, col 14 of module replicated: 1113137 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 50, col 8 to line 50, col 72 of module replicated: 1170534 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 50, col 8 to line 50, col 38 of module replicated: 639868 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 50, col 42 to line 50, col 72 of module replicated: 639868 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 54, col 13 to line 56, col 50 of module replicated: 530666 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 57, col 8 to line 57, col 58 of module replicated: 530666 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 682:54601 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 60, col 8 to line 60, col 32 of module replicated: 1934413 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 60, col 8 to line 60, col 15 of module replicated: 1879812:4246157 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 60, col 27 to line 60, col 32 of module replicated: 1879812 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 61, col 8 to line 61, col 72 of module replicated: 54601 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 61, col 8 to line 61, col 38 of module replicated: 1113137 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 61, col 42 to line 61, col 72 of module replicated: 1113137 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 62, col 8 to line 62, col 102 of module replicated: 54601 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 63, col 8 to line 63, col 58 of module replicated: 54601 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 45241:1113137 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 66, col 8 to line 66, col 30 of module replicated: 2992949 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 66, col 8 to line 66, col 13 of module replicated: 1879812:4412756 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 66, col 25 to line 66, col 30 of module replicated: 1879812 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 67, col 8 to line 74, col 29 of module replicated: 1113137 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 67, col 24 to line 74, col 29 of module replicated: 1113137 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 67, col 27 to line 67, col 91 of module replicated: 1113137 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 70, col 28 to line 70, col 45 of module replicated: 611653 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 71, col 31 to line 71, col 91 of module replicated: 611653 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 73, col 17 to line 73, col 54 of module replicated: 611653 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 74, col 18 to line 74, col 29 of module replicated: 501484 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 75, col 8 to line 75, col 62 of module replicated: 1113137 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 90643:1113137 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 78, col 8 to line 78, col 31 of module replicated: 2992949 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 78, col 8 to line 78, col 14 of module replicated: 1879812:5525893 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 78, col 26 to line 78, col 31 of module replicated: 1879812 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 84, col 13 to line 86, col 37 of module replicated: 1113137 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 84, col 33 to line 86, col 37 of module replicated: 1113137 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 84, col 36 to line 84, col 66 of module replicated: 1113137 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 85, col 22 to line 85, col 66 of module replicated: 406880 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 86, col 22 to line 86, col 37 of module replicated: 706257 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 87, col 8 to line 87, col 58 of module replicated: 1113137 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 57927:203919 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 97, col 8 to line 97, col 27 of module replicated: 412787 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 97, col 8 to line 97, col 10 of module replicated: 208868:417736 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 97, col 22 to line 97, col 27 of module replicated: 208868 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 98, col 8 to line 98, col 30 of module replicated: 412787 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 98, col 8 to line 98, col 25 of module replicated: 208868 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 92, col 15 to line 92, col 33 of module replicated: 208868 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 94, col 5 to line 94, col 66 of module replicated: 208868 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 94, col 26 to line 94, col 65 of module replicated: 626604 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 94, col 12 to line 94, col 23 of module replicated: 208868 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 98, col 24 to line 98, col 24 of module replicated: 208868 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 98, col 29 to line 98, col 30 of module replicated: 208868 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 99, col 8 to line 99, col 109 of module replicated: 203919 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 99, col 28 to line 99, col 109 of module replicated: 203919 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 99, col 29 to line 99, col 44 of module replicated: 203919 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 99, col 52 to line 99, col 108 of module replicated: 203919 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 99, col 72 to line 99, col 108 of module replicated: 203919 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 99, col 105 to line 99, col 108 of module replicated: 203919 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 99, col 85 to line 99, col 102 of module replicated: 203919 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 92, col 15 to line 92, col 33 of module replicated: 203919 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + ||||line 94, col 5 to line 94, col 66 of module replicated: 203919:203919 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||line 94, col 26 to line 94, col 65 of module replicated: 611757 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||line 94, col 12 to line 94, col 23 of module replicated: 203919 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 99, col 101 to line 99, col 101 of module replicated: 203919 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 100, col 8 to line 100, col 58 of module replicated: 203919 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2774:0 @!@!@ + +@!@!@ENDMSG 2774 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 118, col 13 to line 119, col 81 of module replicated: 736274 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 118, col 35 to line 119, col 81 of module replicated: 736274 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 119, col 9 to line 119, col 81 of module replicated: 2208822 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 118, col 44 to line 118, col 72 of module replicated: 736274 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 118, col 22 to line 118, col 32 of module replicated: 736274 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2202:0 @!@!@ +End of statistics. +@!@!@ENDMSG 2202 @!@!@ +@!@!@STARTMSG 2200:0 @!@!@ +Progress(25) at 2025-01-19 18:39:14: 3.224.329 states generated (2.761.383 s/min), 208.868 distinct states found (178.878 ds/min), 0 states left on queue. +@!@!@ENDMSG 2200 @!@!@ +@!@!@STARTMSG 2199:0 @!@!@ +3224329 states generated, 208868 distinct states found, 0 states left on queue. +@!@!@ENDMSG 2199 @!@!@ +@!@!@STARTMSG 2194:0 @!@!@ +The depth of the complete state graph search is 25. +@!@!@ENDMSG 2194 @!@!@ +@!@!@STARTMSG 2268:0 @!@!@ +The average outdegree of the complete state graph is 1 (minimum is 0, the maximum 9 and the 95th percentile is 3). +@!@!@ENDMSG 2268 @!@!@ +@!@!@STARTMSG 2186:0 @!@!@ +Finished in 70074ms at (2025-01-19 18:39:14) +@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla index 14910364fe..33971e3071 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla @@ -1,8 +1,8 @@ ---- MODULE replicated ---- -EXTENDS Integers +EXTENDS Integers, FiniteSets -VARIABLES broker_state, safekeeper_state, pageserver_state +VARIABLES broker_state, safekeeper_state, pageserver_state, online CONSTANT @@ -29,14 +29,23 @@ StateConstraint == InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0] InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] +InitOnline == safekeepers \cup brokers \cup pageservers Init == /\ broker_state = [b \in brokers |-> InitBroker] /\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper] /\ pageserver_state = [p \in pageservers |-> InitPageserver] + /\ online = InitOnline +NodeOnlineOffline == + /\ online' = CHOOSE ss \in SUBSET InitOnline: + /\ Cardinality(ss \cap safekeepers) >= 2 + /\ Cardinality(ss \cap brokers) >= 2 + /\ ss \cap pageservers = pageservers \* assume no PS failures for now + /\ UNCHANGED <> SkCommit(s1, s2) == + /\ {s1, s2} \subseteq online /\ s1 # s2 /\ safekeeper_state[s1].commit_lsn = safekeeper_state[s2].commit_lsn /\ LET @@ -45,14 +54,16 @@ SkCommit(s1, s2) == safekeeper_state' = [safekeeper_state EXCEPT ![s1].commit_lsn = new_commit_lsn, ![s2].commit_lsn = new_commit_lsn] - /\ UNCHANGED <> + /\ UNCHANGED <> SkPeerRecovery(s1,s2) == + /\ {s1, s2} \subseteq online /\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn /\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn] - /\ UNCHANGED <> + /\ UNCHANGED <> SkPushToBroker(s,b) == + /\ {s, b} \subseteq online /\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn THEN LET @@ -61,9 +72,10 @@ SkPushToBroker(s,b) == IN [broker_state EXCEPT ![b].sk = updbsk] ELSE broker_state - /\ UNCHANGED <> + /\ UNCHANGED <> PsRecvBroker(b,p,s) == + /\ {b,p,s} \subseteq online /\ LET bsk == broker_state[b].sk[s] psk == pageserver_state[p].sk[s] @@ -72,7 +84,7 @@ PsRecvBroker(b,p,s) == pageserver_state' = IF bsk.commit_lsn > psk.commit_lsn THEN [pageserver_state EXCEPT ![p].sk[s] = updpsk] ELSE pageserver_state - /\ UNCHANGED <> + /\ UNCHANGED <> SksWithNewerWal(p) == @@ -82,13 +94,14 @@ SksWithNewerWal(p) == {s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn} PsChooseSk(p) == + /\ {p} \subseteq online /\ SksWithNewerWal(p) # {} /\ pageserver_state' = [pageserver_state EXCEPT![p].preferred_sk = CHOOSE s \in SksWithNewerWal(p): TRUE] - /\ UNCHANGED <> + /\ UNCHANGED <> Next == - + \/ NodeOnlineOffline \/ \E s1 \in safekeepers: \E s2 \in safekeepers: \/ SkCommit(s1, s2) \/ SkPeerRecovery(s1, s2) @@ -97,11 +110,15 @@ Next == \/ \E p \in pageservers: PsChooseSk(p) -Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state >> +Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state,online>> \* invariants +PsLagsSk == \A p \in pageservers: \A s \in DOMAIN pageserver_state[p].sk: + /\ pageserver_state[p].sk[s].commit_lsn <= safekeeper_state[s].commit_lsn + + EventuallyLaggingSkIsNotPreferredSk == <>( LET sks == safekeeper_state diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1/states/25-01-19-18-52-55/0 b/storage_broker/spec/replicated/replicated.toolbox/Model_1/states/25-01-19-18-52-55/0 new file mode 100644 index 0000000000..589450a97d Binary files /dev/null and b/storage_broker/spec/replicated/replicated.toolbox/Model_1/states/25-01-19-18-52-55/0 differ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1/states/25-01-19-18-52-55/MC-0.st b/storage_broker/spec/replicated/replicated.toolbox/Model_1/states/25-01-19-18-52-55/MC-0.st new file mode 100644 index 0000000000..662525646c Binary files /dev/null and b/storage_broker/spec/replicated/replicated.toolbox/Model_1/states/25-01-19-18-52-55/MC-0.st differ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-16-40-15/MC.st b/storage_broker/spec/replicated/replicated.toolbox/Model_1/states/25-01-19-18-52-55/MC.st similarity index 100% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-16-40-15/MC.st rename to storage_broker/spec/replicated/replicated.toolbox/Model_1/states/25-01-19-18-52-55/MC.st diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-16-40-15/MC_0.fp b/storage_broker/spec/replicated/replicated.toolbox/Model_1/states/25-01-19-18-52-55/MC_0.fp similarity index 100% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-16-40-15/MC_0.fp rename to storage_broker/spec/replicated/replicated.toolbox/Model_1/states/25-01-19-18-52-55/MC_0.fp diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-16-40-15/MC_1.fp b/storage_broker/spec/replicated/replicated.toolbox/Model_1/states/25-01-19-18-52-55/MC_1.fp similarity index 100% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-16-40-15/MC_1.fp rename to storage_broker/spec/replicated/replicated.toolbox/Model_1/states/25-01-19-18-52-55/MC_1.fp diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-16-40-15/nodes_0 b/storage_broker/spec/replicated/replicated.toolbox/Model_1/states/25-01-19-18-52-55/nodes_0 similarity index 100% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-16-40-15/nodes_0 rename to storage_broker/spec/replicated/replicated.toolbox/Model_1/states/25-01-19-18-52-55/nodes_0 diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-16-40-15/ptrs_0 b/storage_broker/spec/replicated/replicated.toolbox/Model_1/states/25-01-19-18-52-55/ptrs_0 similarity index 100% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-16-40-15/ptrs_0 rename to storage_broker/spec/replicated/replicated.toolbox/Model_1/states/25-01-19-18-52-55/ptrs_0 diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737296416956/MC.cfg b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737296416956/MC.cfg deleted file mode 100644 index 315dcb696c..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737296416956/MC.cfg +++ /dev/null @@ -1,37 +0,0 @@ -\* MV CONSTANT declarations -CONSTANTS -b1 = b1 -b2 = b2 -b3 = b3 -\* MV CONSTANT declarations -CONSTANTS -s1 = s1 -s2 = s2 -s3 = s3 -\* MV CONSTANT declarations -CONSTANTS -p1 = p1 -p2 = p2 -\* MV CONSTANT definitions -CONSTANT -brokers <- const_1737296402193120000 -\* CONSTANT declarations -CONSTANT NULL = NULL -\* MV CONSTANT definitions -CONSTANT -safekeepers <- const_1737296402194121000 -\* MV CONSTANT definitions -CONSTANT -pageservers <- const_1737296402194122000 -\* SYMMETRY definition -SYMMETRY symm_1737296402194123000 -\* CONSTANT definitions -CONSTANT -max_commit_lsn <- const_1737296402194124000 -\* CONSTRAINT definition -CONSTRAINT -constr_1737296402194125000 -\* SPECIFICATION definition -SPECIFICATION -Spec -\* Generated on Sun Jan 19 15:20:02 CET 2025 \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737296416956/MC.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737296416956/MC.out deleted file mode 100644 index 696943b056..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737296416956/MC.out +++ /dev/null @@ -1,38 +0,0 @@ -@!@!@STARTMSG 2262:0 @!@!@ -TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) -@!@!@ENDMSG 2262 @!@!@ -@!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 60 and seed 6751784514943401101 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 5476] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). -@!@!@ENDMSG 2187 @!@!@ -@!@!@STARTMSG 2220:0 @!@!@ -Starting SANY... -@!@!@ENDMSG 2220 @!@!@ -Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/MC.tla -Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/fullmesh.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla -Semantic processing of module Naturals -Semantic processing of module Integers -Semantic processing of module fullmesh -Semantic processing of module Sequences -Semantic processing of module FiniteSets -Semantic processing of module TLC -Semantic processing of module MC -@!@!@STARTMSG 2219:0 @!@!@ -SANY finished. -@!@!@ENDMSG 2219 @!@!@ -@!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 15:20:03) -@!@!@ENDMSG 2185 @!@!@ -@!@!@STARTMSG 2189:0 @!@!@ -Computing initial states... -@!@!@ENDMSG 2189 @!@!@ -@!@!@STARTMSG 2190:0 @!@!@ -Finished computing initial states: 1 distinct state generated at 2025-01-19 15:20:04. -@!@!@ENDMSG 2190 @!@!@ -@!@!@STARTMSG 2200:0 @!@!@ -Progress(12) at 2025-01-19 15:20:07: 163.015 states generated (163.015 s/min), 12.588 distinct states found (12.588 ds/min), 7.372 states left on queue. -@!@!@ENDMSG 2200 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737296416956/MC.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737296416956/MC.tla deleted file mode 100644 index d30390320b..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737296416956/MC.tla +++ /dev/null @@ -1,50 +0,0 @@ ----- MODULE MC ---- -EXTENDS fullmesh, TLC - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -b1, b2, b3 ----- - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -s1, s2, s3 ----- - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -p1, p2 ----- - -\* MV CONSTANT definitions brokers -const_1737296402193120000 == -{b1, b2, b3} ----- - -\* MV CONSTANT definitions safekeepers -const_1737296402194121000 == -{s1, s2, s3} ----- - -\* MV CONSTANT definitions pageservers -const_1737296402194122000 == -{p1, p2} ----- - -\* SYMMETRY definition -symm_1737296402194123000 == -Permutations(const_1737296402193120000) \union Permutations(const_1737296402194121000) \union Permutations(const_1737296402194122000) ----- - -\* CONSTANT definitions @modelParameterConstants:4max_commit_lsn -const_1737296402194124000 == -2 ----- - -\* CONSTRAINT definition @modelParameterContraint:0 -constr_1737296402194125000 == -StateConstraint ----- -============================================================================= -\* Modification History -\* Created Sun Jan 19 15:20:02 CET 2025 by cs diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737296416956/MC_TE.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737296416956/MC_TE.out deleted file mode 100644 index 696943b056..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737296416956/MC_TE.out +++ /dev/null @@ -1,38 +0,0 @@ -@!@!@STARTMSG 2262:0 @!@!@ -TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) -@!@!@ENDMSG 2262 @!@!@ -@!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 60 and seed 6751784514943401101 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 5476] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). -@!@!@ENDMSG 2187 @!@!@ -@!@!@STARTMSG 2220:0 @!@!@ -Starting SANY... -@!@!@ENDMSG 2220 @!@!@ -Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/MC.tla -Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/fullmesh.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla -Semantic processing of module Naturals -Semantic processing of module Integers -Semantic processing of module fullmesh -Semantic processing of module Sequences -Semantic processing of module FiniteSets -Semantic processing of module TLC -Semantic processing of module MC -@!@!@STARTMSG 2219:0 @!@!@ -SANY finished. -@!@!@ENDMSG 2219 @!@!@ -@!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 15:20:03) -@!@!@ENDMSG 2185 @!@!@ -@!@!@STARTMSG 2189:0 @!@!@ -Computing initial states... -@!@!@ENDMSG 2189 @!@!@ -@!@!@STARTMSG 2190:0 @!@!@ -Finished computing initial states: 1 distinct state generated at 2025-01-19 15:20:04. -@!@!@ENDMSG 2190 @!@!@ -@!@!@STARTMSG 2200:0 @!@!@ -Progress(12) at 2025-01-19 15:20:07: 163.015 states generated (163.015 s/min), 12.588 distinct states found (12.588 ds/min), 7.372 states left on queue. -@!@!@ENDMSG 2200 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737296416956/fullmesh.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737296416956/fullmesh.tla deleted file mode 100644 index a70d3aeb85..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737296416956/fullmesh.tla +++ /dev/null @@ -1,85 +0,0 @@ ----- MODULE fullmesh ---- - -EXTENDS Integers - -VARIABLES broker_state, safekeeper_state, pageserver_state - -vars == << broker_state, safekeeper_state, pageserver_state >> - -CONSTANT - brokers, - safekeepers, - pageservers - -CONSTANT - NULL - -CONSTANT - max_commit_lsn - -StateConstraint == - /\ \A s \in safekeepers: - /\ safekeeper_state[s].commit_lsn <= max_commit_lsn - /\ \A b \in brokers: - /\ \A s \in DOMAIN broker_state[b].sk: - /\ broker_state[b].sk[s].commit_lsn <= max_commit_lsn - - -InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0] -InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] -InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] - -Init == - /\ broker_state = [b \in brokers |-> InitBroker] - /\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper] - /\ pageserver_state = [p \in pageservers |-> InitPageserver] - -SkCommit(s) == - /\ safekeeper_state' = [safekeeper_state EXCEPT ![s].commit_lsn = safekeeper_state[s].commit_lsn + 1] - /\ UNCHANGED <> - -SkPushToBroker(s,b) == - /\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn - THEN - LET - bsk == broker_state[b].sk - updbsk == [bsk EXCEPT ![s].commit_lsn = safekeeper_state[s].commit_lsn] - IN - [broker_state EXCEPT ![b].sk = updbsk] - ELSE broker_state - /\ UNCHANGED <> - -PsRecvBroker(b,p,s) == - /\ LET - bsk == broker_state[b].sk[s] - psk == pageserver_state[p].sk[s] - updpsk == [psk EXCEPT !["commit_lsn"] = bsk.commit_lsn] - IN - pageserver_state' = IF bsk.commit_lsn > psk.commit_lsn - THEN [pageserver_state EXCEPT ![p].sk[s] = updpsk] - ELSE pageserver_state - /\ UNCHANGED <> - - -SksWithNewerWal(p) == - LET - ps == pageserver_state[p] - IN - {s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn} - -PsChooseSk(p) == - /\ SksWithNewerWal(p) # {} - /\ pageserver_state' = [pageserver_state EXCEPT![p].preferred_sk = CHOOSE s \in SksWithNewerWal(p): TRUE] - /\ UNCHANGED <> - - -Next == - \/ \E s \in safekeepers: SkCommit(s) - \/ \E s \in safekeepers: \E b \in brokers: SkPushToBroker(s, b) - \/ \E s \in safekeepers: \E b \in brokers: \E p \in pageservers: PsRecvBroker(b,p,s) - \/ \E p \in pageservers: PsChooseSk(p) - - -Spec == Init /\ [][Next]_vars - -==== \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737297534393/MC.cfg b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737297534393/MC.cfg deleted file mode 100644 index 5d0e77461a..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737297534393/MC.cfg +++ /dev/null @@ -1,48 +0,0 @@ -\* MV CONSTANT declarations -CONSTANTS -b1 = b1 -b2 = b2 -b3 = b3 -\* MV CONSTANT declarations -CONSTANTS -s1 = s1 -s2 = s2 -s3 = s3 -\* MV CONSTANT declarations -CONSTANTS -p1 = p1 -p2 = p2 -\* MV CONSTANT declarations -CONSTANTS -az1 = az1 -az2 = az2 -az3 = az3 -\* MV CONSTANT definitions -CONSTANT -brokers <- const_1737297530693169000 -\* CONSTANT declarations -CONSTANT NULL = NULL -\* MV CONSTANT definitions -CONSTANT -safekeepers <- const_1737297530694170000 -\* MV CONSTANT definitions -CONSTANT -pageservers <- const_1737297530694171000 -\* MV CONSTANT definitions -CONSTANT -azs <- const_1737297530694172000 -\* SYMMETRY definition -SYMMETRY symm_1737297530694173000 -\* CONSTANT definitions -CONSTANT -max_commit_lsn <- const_1737297530694174000 -\* CONSTANT definitions -CONSTANT -az_mapping <- const_1737297530694175000 -\* CONSTRAINT definition -CONSTRAINT -constr_1737297530694176000 -\* SPECIFICATION definition -SPECIFICATION -Spec -\* Generated on Sun Jan 19 15:38:50 CET 2025 \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737297534393/MC.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737297534393/MC.out deleted file mode 100644 index 6ab9f0e5e4..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737297534393/MC.out +++ /dev/null @@ -1,35 +0,0 @@ -@!@!@STARTMSG 2262:0 @!@!@ -TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) -@!@!@ENDMSG 2262 @!@!@ -@!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 130 and seed 4267255892797165884 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 6327] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). -@!@!@ENDMSG 2187 @!@!@ -@!@!@STARTMSG 2220:0 @!@!@ -Starting SANY... -@!@!@ENDMSG 2220 @!@!@ -Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/MC.tla -Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/fullmesh.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla -Semantic processing of module Naturals -Semantic processing of module Integers -Semantic processing of module fullmesh -Semantic processing of module Sequences -Semantic processing of module FiniteSets -Semantic processing of module TLC -Semantic processing of module MC -@!@!@STARTMSG 2219:0 @!@!@ -SANY finished. -@!@!@ENDMSG 2219 @!@!@ -@!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 15:38:51) -@!@!@ENDMSG 2185 @!@!@ -@!@!@STARTMSG 2189:0 @!@!@ -Computing initial states... -@!@!@ENDMSG 2189 @!@!@ -@!@!@STARTMSG 2190:0 @!@!@ -Finished computing initial states: 1 distinct state generated at 2025-01-19 15:38:53. -@!@!@ENDMSG 2190 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737297534393/MC_TE.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737297534393/MC_TE.out deleted file mode 100644 index 6ab9f0e5e4..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737297534393/MC_TE.out +++ /dev/null @@ -1,35 +0,0 @@ -@!@!@STARTMSG 2262:0 @!@!@ -TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) -@!@!@ENDMSG 2262 @!@!@ -@!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 130 and seed 4267255892797165884 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 6327] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). -@!@!@ENDMSG 2187 @!@!@ -@!@!@STARTMSG 2220:0 @!@!@ -Starting SANY... -@!@!@ENDMSG 2220 @!@!@ -Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/MC.tla -Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/fullmesh.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla -Semantic processing of module Naturals -Semantic processing of module Integers -Semantic processing of module fullmesh -Semantic processing of module Sequences -Semantic processing of module FiniteSets -Semantic processing of module TLC -Semantic processing of module MC -@!@!@STARTMSG 2219:0 @!@!@ -SANY finished. -@!@!@ENDMSG 2219 @!@!@ -@!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 15:38:51) -@!@!@ENDMSG 2185 @!@!@ -@!@!@STARTMSG 2189:0 @!@!@ -Computing initial states... -@!@!@ENDMSG 2189 @!@!@ -@!@!@STARTMSG 2190:0 @!@!@ -Finished computing initial states: 1 distinct state generated at 2025-01-19 15:38:53. -@!@!@ENDMSG 2190 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737297534393/fullmesh.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737297534393/fullmesh.tla deleted file mode 100644 index 9346db0d45..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737297534393/fullmesh.tla +++ /dev/null @@ -1,91 +0,0 @@ ----- MODULE fullmesh ---- - -EXTENDS Integers - -VARIABLES broker_state, safekeeper_state, pageserver_state - - -CONSTANT - brokers, - safekeepers, - pageservers, - azs, - az_mapping - -CONSTANT - NULL - -CONSTANT - max_commit_lsn - -StateConstraint == - /\ \A s \in safekeepers: - /\ safekeeper_state[s].commit_lsn <= max_commit_lsn - /\ \A b \in brokers: - /\ \A s \in DOMAIN broker_state[b].sk: - /\ broker_state[b].sk[s].commit_lsn <= max_commit_lsn - - -InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0] -InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] -InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] - -Init == - /\ broker_state = [b \in brokers |-> InitBroker] - /\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper] - /\ pageserver_state = [p \in pageservers |-> InitPageserver] - -SkCommit(s) == - /\ safekeeper_state' = [safekeeper_state EXCEPT ![s].commit_lsn = safekeeper_state[s].commit_lsn + 1] - /\ UNCHANGED <> - -SkPushToBroker(s,b) == - /\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn - THEN - LET - bsk == broker_state[b].sk - updbsk == [bsk EXCEPT ![s].commit_lsn = safekeeper_state[s].commit_lsn] - IN - [broker_state EXCEPT ![b].sk = updbsk] - ELSE broker_state - /\ UNCHANGED <> - -PsRecvBroker(b,p,s) == - /\ LET - bsk == broker_state[b].sk[s] - psk == pageserver_state[p].sk[s] - updpsk == [psk EXCEPT !["commit_lsn"] = bsk.commit_lsn] - IN - pageserver_state' = IF bsk.commit_lsn > psk.commit_lsn - THEN [pageserver_state EXCEPT ![p].sk[s] = updpsk] - ELSE pageserver_state - /\ UNCHANGED <> - - -SksWithNewerWal(p) == - LET - ps == pageserver_state[p] - IN - {s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn} - -PsChooseSk(p) == - /\ SksWithNewerWal(p) # {} - /\ pageserver_state' = [pageserver_state EXCEPT![p].preferred_sk = CHOOSE s \in SksWithNewerWal(p): TRUE] - /\ UNCHANGED <> - - -Next == - \/ \E s \in safekeepers: SkCommit(s) - \/ \E s \in safekeepers: \E b \in brokers: SkPushToBroker(s, b) - \/ \E s \in safekeepers: \E b \in brokers: \E p \in pageservers: PsRecvBroker(b,p,s) - \/ \E p \in pageservers: PsChooseSk(p) - - -Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state >> - - -\* invariants - - - -==== \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737297999722/MC.cfg b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737297999722/MC.cfg deleted file mode 100644 index 317368faaf..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737297999722/MC.cfg +++ /dev/null @@ -1,48 +0,0 @@ -\* MV CONSTANT declarations -CONSTANTS -b1 = b1 -b2 = b2 -b3 = b3 -\* MV CONSTANT declarations -CONSTANTS -s1 = s1 -s2 = s2 -s3 = s3 -\* MV CONSTANT declarations -CONSTANTS -p1 = p1 -p2 = p2 -\* MV CONSTANT declarations -CONSTANTS -az1 = az1 -az2 = az2 -az3 = az3 -\* MV CONSTANT definitions -CONSTANT -brokers <- const_1737297992949177000 -\* CONSTANT declarations -CONSTANT NULL = NULL -\* MV CONSTANT definitions -CONSTANT -safekeepers <- const_1737297992949178000 -\* MV CONSTANT definitions -CONSTANT -pageservers <- const_1737297992949179000 -\* MV CONSTANT definitions -CONSTANT -azs <- const_1737297992949180000 -\* SYMMETRY definition -SYMMETRY symm_1737297992949181000 -\* CONSTANT definitions -CONSTANT -max_commit_lsn <- const_1737297992949182000 -\* CONSTANT definitions -CONSTANT -az_mapping <- const_1737297992949183000 -\* CONSTRAINT definition -CONSTRAINT -constr_1737297992949184000 -\* SPECIFICATION definition -SPECIFICATION -Spec -\* Generated on Sun Jan 19 15:46:32 CET 2025 \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737297999722/MC.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737297999722/MC.out deleted file mode 100644 index be1df74b07..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737297999722/MC.out +++ /dev/null @@ -1,38 +0,0 @@ -@!@!@STARTMSG 2262:0 @!@!@ -TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) -@!@!@ENDMSG 2262 @!@!@ -@!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 0 and seed -5924036830053169413 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 6690] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). -@!@!@ENDMSG 2187 @!@!@ -@!@!@STARTMSG 2220:0 @!@!@ -Starting SANY... -@!@!@ENDMSG 2220 @!@!@ -Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/MC.tla -Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/fullmesh.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla -Semantic processing of module Naturals -Semantic processing of module Integers -Semantic processing of module fullmesh -Semantic processing of module Sequences -Semantic processing of module FiniteSets -Semantic processing of module TLC -Semantic processing of module MC -@!@!@STARTMSG 2219:0 @!@!@ -SANY finished. -@!@!@ENDMSG 2219 @!@!@ -@!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 15:46:33) -@!@!@ENDMSG 2185 @!@!@ -@!@!@STARTMSG 2189:0 @!@!@ -Computing initial states... -@!@!@ENDMSG 2189 @!@!@ -@!@!@STARTMSG 2190:0 @!@!@ -Finished computing initial states: 1 distinct state generated at 2025-01-19 15:46:35. -@!@!@ENDMSG 2190 @!@!@ -@!@!@STARTMSG 2200:0 @!@!@ -Progress(10) at 2025-01-19 15:46:38: 41.300 states generated (41.300 s/min), 3.445 distinct states found (3.445 ds/min), 2.202 states left on queue. -@!@!@ENDMSG 2200 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737297999722/MC.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737297999722/MC.tla deleted file mode 100644 index ee8e18c7a3..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737297999722/MC.tla +++ /dev/null @@ -1,65 +0,0 @@ ----- MODULE MC ---- -EXTENDS fullmesh, TLC - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -b1, b2, b3 ----- - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -s1, s2, s3 ----- - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -p1, p2 ----- - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -az1, az2, az3 ----- - -\* MV CONSTANT definitions brokers -const_1737297992949177000 == -{b1, b2, b3} ----- - -\* MV CONSTANT definitions safekeepers -const_1737297992949178000 == -{s1, s2, s3} ----- - -\* MV CONSTANT definitions pageservers -const_1737297992949179000 == -{p1, p2} ----- - -\* MV CONSTANT definitions azs -const_1737297992949180000 == -{az1, az2, az3} ----- - -\* SYMMETRY definition -symm_1737297992949181000 == -Permutations(const_1737297992949177000) \union Permutations(const_1737297992949178000) \union Permutations(const_1737297992949179000) \union Permutations(const_1737297992949180000) ----- - -\* CONSTANT definitions @modelParameterConstants:4max_commit_lsn -const_1737297992949182000 == -2 ----- - -\* CONSTANT definitions @modelParameterConstants:5az_mapping -const_1737297992949183000 == -[ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2,p2} , az3 |-> {b3,s3}] ----- - -\* CONSTRAINT definition @modelParameterContraint:0 -constr_1737297992949184000 == -StateConstraint ----- -============================================================================= -\* Modification History -\* Created Sun Jan 19 15:46:32 CET 2025 by cs diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737297999722/MC_TE.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737297999722/MC_TE.out deleted file mode 100644 index be1df74b07..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737297999722/MC_TE.out +++ /dev/null @@ -1,38 +0,0 @@ -@!@!@STARTMSG 2262:0 @!@!@ -TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) -@!@!@ENDMSG 2262 @!@!@ -@!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 0 and seed -5924036830053169413 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 6690] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). -@!@!@ENDMSG 2187 @!@!@ -@!@!@STARTMSG 2220:0 @!@!@ -Starting SANY... -@!@!@ENDMSG 2220 @!@!@ -Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/MC.tla -Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/fullmesh.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla -Semantic processing of module Naturals -Semantic processing of module Integers -Semantic processing of module fullmesh -Semantic processing of module Sequences -Semantic processing of module FiniteSets -Semantic processing of module TLC -Semantic processing of module MC -@!@!@STARTMSG 2219:0 @!@!@ -SANY finished. -@!@!@ENDMSG 2219 @!@!@ -@!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 15:46:33) -@!@!@ENDMSG 2185 @!@!@ -@!@!@STARTMSG 2189:0 @!@!@ -Computing initial states... -@!@!@ENDMSG 2189 @!@!@ -@!@!@STARTMSG 2190:0 @!@!@ -Finished computing initial states: 1 distinct state generated at 2025-01-19 15:46:35. -@!@!@ENDMSG 2190 @!@!@ -@!@!@STARTMSG 2200:0 @!@!@ -Progress(10) at 2025-01-19 15:46:38: 41.300 states generated (41.300 s/min), 3.445 distinct states found (3.445 ds/min), 2.202 states left on queue. -@!@!@ENDMSG 2200 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737297999722/fullmesh.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737297999722/fullmesh.tla deleted file mode 100644 index b752cd48e2..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737297999722/fullmesh.tla +++ /dev/null @@ -1,97 +0,0 @@ ----- MODULE fullmesh ---- - -EXTENDS Integers - -VARIABLES broker_state, safekeeper_state, pageserver_state - - -CONSTANT - brokers, - safekeepers, - pageservers, - azs, - az_mapping - -CONSTANT - NULL - -CONSTANT - max_commit_lsn - -StateConstraint == - /\ \A s \in safekeepers: - /\ safekeeper_state[s].commit_lsn <= max_commit_lsn - /\ \A b \in brokers: - /\ \A s \in DOMAIN broker_state[b].sk: - /\ broker_state[b].sk[s].commit_lsn <= max_commit_lsn - - -InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0] -InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] -InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] - -Init == - /\ broker_state = [b \in brokers |-> InitBroker] - /\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper] - /\ pageserver_state = [p \in pageservers |-> InitPageserver] - -SkCommit(s1, s2) == - /\ safekeeper_state[s1].commit_lsn = safekeeper_state[s2].commit_lsn - /\ LET - new_commit_lsn == safekeeper_state[s1].commit_lsn + 1 - IN - safekeeper_state' = [safekeeper_state EXCEPT - ![s1].commit_lsn = new_commit_lsn, - ![s2].commit_lsn = new_commit_lsn] - /\ UNCHANGED <> - -SkPushToBroker(s,b) == - /\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn - THEN - LET - bsk == broker_state[b].sk - updbsk == [bsk EXCEPT ![s].commit_lsn = safekeeper_state[s].commit_lsn] - IN - [broker_state EXCEPT ![b].sk = updbsk] - ELSE broker_state - /\ UNCHANGED <> - -PsRecvBroker(b,p,s) == - /\ LET - bsk == broker_state[b].sk[s] - psk == pageserver_state[p].sk[s] - updpsk == [psk EXCEPT !["commit_lsn"] = bsk.commit_lsn] - IN - pageserver_state' = IF bsk.commit_lsn > psk.commit_lsn - THEN [pageserver_state EXCEPT ![p].sk[s] = updpsk] - ELSE pageserver_state - /\ UNCHANGED <> - - -SksWithNewerWal(p) == - LET - ps == pageserver_state[p] - IN - {s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn} - -PsChooseSk(p) == - /\ SksWithNewerWal(p) # {} - /\ pageserver_state' = [pageserver_state EXCEPT![p].preferred_sk = CHOOSE s \in SksWithNewerWal(p): TRUE] - /\ UNCHANGED <> - - -Next == - \/ \E s1 \in safekeepers: \E s2 \in safekeepers: SkCommit(s1, s2) - \/ \E s \in safekeepers: \E b \in brokers: SkPushToBroker(s, b) - \/ \E s \in safekeepers: \E b \in brokers: \E p \in pageservers: PsRecvBroker(b,p,s) - \/ \E p \in pageservers: PsChooseSk(p) - - -Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state >> - - -\* invariants - - - -==== \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299352762/fullmesh.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299352762/fullmesh.tla deleted file mode 100644 index a6c5e2ea3f..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299352762/fullmesh.tla +++ /dev/null @@ -1,115 +0,0 @@ ----- MODULE fullmesh ---- - -EXTENDS Integers - -VARIABLES broker_state, safekeeper_state, pageserver_state - - -CONSTANT - brokers, - safekeepers, - pageservers, - azs, - az_mapping - -CONSTANT - NULL - -CONSTANT - max_commit_lsn - -StateConstraint == - /\ \A s \in safekeepers: - /\ safekeeper_state[s].commit_lsn <= max_commit_lsn - /\ \A b \in brokers: - /\ \A s \in DOMAIN broker_state[b].sk: - /\ broker_state[b].sk[s].commit_lsn <= max_commit_lsn - - -InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0] -InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] -InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] - -Init == - /\ broker_state = [b \in brokers |-> InitBroker] - /\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper] - /\ pageserver_state = [p \in pageservers |-> InitPageserver] - - -SkCommit(s1, s2) == - /\ safekeeper_state[s1].commit_lsn = safekeeper_state[s2].commit_lsn - /\ LET - new_commit_lsn == safekeeper_state[s1].commit_lsn + 1 - IN - safekeeper_state' = [safekeeper_state EXCEPT - ![s1].commit_lsn = new_commit_lsn, - ![s2].commit_lsn = new_commit_lsn] - /\ UNCHANGED <> - -SkPeerRecovery(s1,s2) == - /\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn - /\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn] - -SkPushToBroker(s,b) == - /\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn - THEN - LET - bsk == broker_state[b].sk - updbsk == [bsk EXCEPT ![s].commit_lsn = safekeeper_state[s].commit_lsn] - IN - [broker_state EXCEPT ![b].sk = updbsk] - ELSE broker_state - /\ UNCHANGED <> - -PsRecvBroker(b,p,s) == - /\ LET - bsk == broker_state[b].sk[s] - psk == pageserver_state[p].sk[s] - updpsk == [psk EXCEPT !["commit_lsn"] = bsk.commit_lsn] - IN - pageserver_state' = IF bsk.commit_lsn > psk.commit_lsn - THEN [pageserver_state EXCEPT ![p].sk[s] = updpsk] - ELSE pageserver_state - /\ UNCHANGED <> - - -SksWithNewerWal(p) == - LET - ps == pageserver_state[p] - IN - {s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn} - -PsChooseSk(p) == - /\ SksWithNewerWal(p) # {} - /\ pageserver_state' = [pageserver_state EXCEPT![p].preferred_sk = CHOOSE s \in SksWithNewerWal(p): TRUE] - /\ UNCHANGED <> - - -Next == - - \/ \E s1 \in safekeepers: \E s2 \in safekeepers: - \/ SkCommit(s1, s2) - \/ SkPeerRecovery(s1, s2) - \/ \E s \in safekeepers: \E b \in brokers: SkPushToBroker(s, b) - \/ \E s \in safekeepers: \E b \in brokers: \E p \in pageservers: PsRecvBroker(b,p,s) - \/ \E p \in pageservers: PsChooseSk(p) - - -Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state >> - - -\* invariants - -EventuallyLaggingSkIsNotPreferredSk == <>( - LET - sks == safekeeper_state - lagging_sks == { s \in safekeepers: \A s2 \in safekeepers: sks[s].commit_lsn <= sks[s2].commit_lsn } - preferred_sks == {pageserver_state[p].preferred_sk: p \in pageservers} - IN - preferred_sks \cap lagging_sks = {} - - ) - - - -==== \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299381423/MC.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299381423/MC.tla deleted file mode 100644 index 9df26a2fc9..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299381423/MC.tla +++ /dev/null @@ -1,65 +0,0 @@ ----- MODULE MC ---- -EXTENDS fullmesh, TLC - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -b1, b2, b3 ----- - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -s1, s2, s3 ----- - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -p1, p2 ----- - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -az1, az2, az3 ----- - -\* MV CONSTANT definitions brokers -const_1737299377376212000 == -{b1, b2, b3} ----- - -\* MV CONSTANT definitions safekeepers -const_1737299377376213000 == -{s1, s2, s3} ----- - -\* MV CONSTANT definitions pageservers -const_1737299377376214000 == -{p1, p2} ----- - -\* MV CONSTANT definitions azs -const_1737299377376215000 == -{az1, az2, az3} ----- - -\* SYMMETRY definition -symm_1737299377376216000 == -Permutations(const_1737299377376212000) \union Permutations(const_1737299377376213000) \union Permutations(const_1737299377376214000) \union Permutations(const_1737299377376215000) ----- - -\* CONSTANT definitions @modelParameterConstants:4max_commit_lsn -const_1737299377376217000 == -2 ----- - -\* CONSTANT definitions @modelParameterConstants:5az_mapping -const_1737299377376218000 == -[ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2,p2} , az3 |-> {b3,s3}] ----- - -\* CONSTRAINT definition @modelParameterContraint:0 -constr_1737299377376219000 == -StateConstraint ----- -============================================================================= -\* Modification History -\* Created Sun Jan 19 16:09:37 CET 2025 by cs diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299381423/fullmesh.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299381423/fullmesh.tla deleted file mode 100644 index a6c5e2ea3f..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299381423/fullmesh.tla +++ /dev/null @@ -1,115 +0,0 @@ ----- MODULE fullmesh ---- - -EXTENDS Integers - -VARIABLES broker_state, safekeeper_state, pageserver_state - - -CONSTANT - brokers, - safekeepers, - pageservers, - azs, - az_mapping - -CONSTANT - NULL - -CONSTANT - max_commit_lsn - -StateConstraint == - /\ \A s \in safekeepers: - /\ safekeeper_state[s].commit_lsn <= max_commit_lsn - /\ \A b \in brokers: - /\ \A s \in DOMAIN broker_state[b].sk: - /\ broker_state[b].sk[s].commit_lsn <= max_commit_lsn - - -InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0] -InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] -InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] - -Init == - /\ broker_state = [b \in brokers |-> InitBroker] - /\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper] - /\ pageserver_state = [p \in pageservers |-> InitPageserver] - - -SkCommit(s1, s2) == - /\ safekeeper_state[s1].commit_lsn = safekeeper_state[s2].commit_lsn - /\ LET - new_commit_lsn == safekeeper_state[s1].commit_lsn + 1 - IN - safekeeper_state' = [safekeeper_state EXCEPT - ![s1].commit_lsn = new_commit_lsn, - ![s2].commit_lsn = new_commit_lsn] - /\ UNCHANGED <> - -SkPeerRecovery(s1,s2) == - /\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn - /\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn] - -SkPushToBroker(s,b) == - /\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn - THEN - LET - bsk == broker_state[b].sk - updbsk == [bsk EXCEPT ![s].commit_lsn = safekeeper_state[s].commit_lsn] - IN - [broker_state EXCEPT ![b].sk = updbsk] - ELSE broker_state - /\ UNCHANGED <> - -PsRecvBroker(b,p,s) == - /\ LET - bsk == broker_state[b].sk[s] - psk == pageserver_state[p].sk[s] - updpsk == [psk EXCEPT !["commit_lsn"] = bsk.commit_lsn] - IN - pageserver_state' = IF bsk.commit_lsn > psk.commit_lsn - THEN [pageserver_state EXCEPT ![p].sk[s] = updpsk] - ELSE pageserver_state - /\ UNCHANGED <> - - -SksWithNewerWal(p) == - LET - ps == pageserver_state[p] - IN - {s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn} - -PsChooseSk(p) == - /\ SksWithNewerWal(p) # {} - /\ pageserver_state' = [pageserver_state EXCEPT![p].preferred_sk = CHOOSE s \in SksWithNewerWal(p): TRUE] - /\ UNCHANGED <> - - -Next == - - \/ \E s1 \in safekeepers: \E s2 \in safekeepers: - \/ SkCommit(s1, s2) - \/ SkPeerRecovery(s1, s2) - \/ \E s \in safekeepers: \E b \in brokers: SkPushToBroker(s, b) - \/ \E s \in safekeepers: \E b \in brokers: \E p \in pageservers: PsRecvBroker(b,p,s) - \/ \E p \in pageservers: PsChooseSk(p) - - -Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state >> - - -\* invariants - -EventuallyLaggingSkIsNotPreferredSk == <>( - LET - sks == safekeeper_state - lagging_sks == { s \in safekeepers: \A s2 \in safekeepers: sks[s].commit_lsn <= sks[s2].commit_lsn } - preferred_sks == {pageserver_state[p].preferred_sk: p \in pageservers} - IN - preferred_sks \cap lagging_sks = {} - - ) - - - -==== \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299469039/MC.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299469039/MC.out deleted file mode 100644 index 3299ac8cfa..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299469039/MC.out +++ /dev/null @@ -1,202 +0,0 @@ -@!@!@STARTMSG 2262:0 @!@!@ -TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) -@!@!@ENDMSG 2262 @!@!@ -@!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 105 and seed 4277674636266930199 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 7749] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). -@!@!@ENDMSG 2187 @!@!@ -@!@!@STARTMSG 2220:0 @!@!@ -Starting SANY... -@!@!@ENDMSG 2220 @!@!@ -Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/MC.tla -Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/fullmesh.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla -Semantic processing of module Naturals -Semantic processing of module Integers -Semantic processing of module fullmesh -Semantic processing of module Sequences -Semantic processing of module FiniteSets -Semantic processing of module TLC -Semantic processing of module MC -@!@!@STARTMSG 2219:0 @!@!@ -SANY finished. -@!@!@ENDMSG 2219 @!@!@ -@!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 16:11:06) -@!@!@ENDMSG 2185 @!@!@ -@!@!@STARTMSG 2279:3 @!@!@ -Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. -@!@!@ENDMSG 2279 @!@!@ -@!@!@STARTMSG 2284:3 @!@!@ -Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. -@!@!@ENDMSG 2284 @!@!@ -@!@!@STARTMSG 2212:0 @!@!@ -Implied-temporal checking--satisfiability problem has 1 branches. -@!@!@ENDMSG 2212 @!@!@ -@!@!@STARTMSG 2189:0 @!@!@ -Computing initial states... -@!@!@ENDMSG 2189 @!@!@ -@!@!@STARTMSG 2190:0 @!@!@ -Finished computing initial states: 1 distinct state generated at 2025-01-19 16:11:07. -@!@!@ENDMSG 2190 @!@!@ -@!@!@STARTMSG 2109:1 @!@!@ -Successor state is not completely specified by action SkPeerRecovery of the next-state relation. The following variables are not assigned: broker_state, pageserver_state. - -@!@!@ENDMSG 2109 @!@!@ -@!@!@STARTMSG 2121:1 @!@!@ -The behavior up to this point is: -@!@!@ENDMSG 2121 @!@!@ -@!@!@STARTMSG 2217:4 @!@!@ -1: -/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) -/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])]) -/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0]) - -@!@!@ENDMSG 2217 @!@!@ -@!@!@STARTMSG 2217:4 @!@!@ -2: -/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) -/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])]) -/\ safekeeper_state = (s1 :> [commit_lsn |-> 1, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 1, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0]) - -@!@!@ENDMSG 2217 @!@!@ -@!@!@STARTMSG 2217:4 @!@!@ -3: -/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) -/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])]) -/\ safekeeper_state = (s1 :> [commit_lsn |-> 2, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 2, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0]) - -@!@!@ENDMSG 2217 @!@!@ -@!@!@STARTMSG 2217:4 @!@!@ -4: -/\ pageserver_state = null -/\ broker_state = null -/\ safekeeper_state = (s1 :> [commit_lsn |-> 2, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 2, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 2, pruned_lsn |-> 0]) - -@!@!@ENDMSG 2217 @!@!@ -@!@!@STARTMSG 2201:0 @!@!@ -The coverage statistics at 2025-01-19 16:11:07 -@!@!@ENDMSG 2201 @!@!@ -@!@!@STARTMSG 2773:0 @!@!@ -: 2:2 -@!@!@ENDMSG 2773 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 34, col 5 to line 36, col 64 of module fullmesh: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 2:14 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 40, col 8 to line 40, col 14 of module fullmesh: 48 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 40, col 8 to line 40, col 9 of module fullmesh: 34 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 40, col 13 to line 40, col 14 of module fullmesh: 34 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 41, col 8 to line 41, col 72 of module fullmesh: 37 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 41, col 8 to line 41, col 38 of module fullmesh: 23 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 41, col 42 to line 41, col 72 of module fullmesh: 23 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 45, col 13 to line 47, col 50 of module fullmesh: 14 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 48, col 8 to line 48, col 51 of module fullmesh: 14 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:3 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 51, col 8 to line 51, col 72 of module fullmesh: 1 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 51, col 8 to line 51, col 38 of module fullmesh: 32 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 51, col 42 to line 51, col 72 of module fullmesh: 32 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 52, col 8 to line 52, col 102 of module fullmesh: 1 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 52, col 28 to line 52, col 102 of module fullmesh: 3 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:9 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 55, col 8 to line 62, col 29 of module fullmesh: 9 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 63, col 8 to line 63, col 55 of module fullmesh: 9 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:18 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 71, col 13 to line 73, col 37 of module fullmesh: 18 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 74, col 8 to line 74, col 51 of module fullmesh: 18 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:0 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 84, col 8 to line 84, col 30 of module fullmesh: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 84, col 8 to line 84, col 25 of module fullmesh: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 79, col 15 to line 79, col 33 of module fullmesh: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 81, col 5 to line 81, col 66 of module fullmesh: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 81, col 26 to line 81, col 65 of module fullmesh: 6 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 81, col 12 to line 81, col 23 of module fullmesh: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 84, col 24 to line 84, col 24 of module fullmesh: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 84, col 29 to line 84, col 30 of module fullmesh: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 85, col 8 to line 85, col 109 of module fullmesh: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 86, col 8 to line 86, col 51 of module fullmesh: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2202:0 @!@!@ -End of statistics. -@!@!@ENDMSG 2202 @!@!@ -@!@!@STARTMSG 2200:0 @!@!@ -Progress(3) at 2025-01-19 16:11:07: 40 states generated (992 s/min), 3 distinct states found (74 ds/min), 0 states left on queue. -@!@!@ENDMSG 2200 @!@!@ -@!@!@STARTMSG 2199:0 @!@!@ -40 states generated, 3 distinct states found, 0 states left on queue. -@!@!@ENDMSG 2199 @!@!@ -@!@!@STARTMSG 2194:0 @!@!@ -The depth of the complete state graph search is 3. -@!@!@ENDMSG 2194 @!@!@ -@!@!@STARTMSG 2268:0 @!@!@ -The average outdegree of the complete state graph is 1 (minimum is 1, the maximum 1 and the 95th percentile is 1). -@!@!@ENDMSG 2268 @!@!@ -@!@!@STARTMSG 2186:0 @!@!@ -Finished in 2440ms at (2025-01-19 16:11:07) -@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299469039/MC.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299469039/MC.tla deleted file mode 100644 index eceb21dd0b..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299469039/MC.tla +++ /dev/null @@ -1,65 +0,0 @@ ----- MODULE MC ---- -EXTENDS fullmesh, TLC - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -b1, b2, b3 ----- - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -s1, s2, s3 ----- - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -p1, p2 ----- - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -az1, az2, az3 ----- - -\* MV CONSTANT definitions brokers -const_1737299464992221000 == -{b1, b2, b3} ----- - -\* MV CONSTANT definitions safekeepers -const_1737299464992222000 == -{s1, s2, s3} ----- - -\* MV CONSTANT definitions pageservers -const_1737299464992223000 == -{p1, p2} ----- - -\* MV CONSTANT definitions azs -const_1737299464992224000 == -{az1, az2, az3} ----- - -\* SYMMETRY definition -symm_1737299464992225000 == -Permutations(const_1737299464992221000) \union Permutations(const_1737299464992222000) \union Permutations(const_1737299464992223000) \union Permutations(const_1737299464992224000) ----- - -\* CONSTANT definitions @modelParameterConstants:4max_commit_lsn -const_1737299464992226000 == -2 ----- - -\* CONSTANT definitions @modelParameterConstants:5az_mapping -const_1737299464992227000 == -[ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2,p2} , az3 |-> {b3,s3}] ----- - -\* CONSTRAINT definition @modelParameterContraint:0 -constr_1737299464992228000 == -StateConstraint ----- -============================================================================= -\* Modification History -\* Created Sun Jan 19 16:11:04 CET 2025 by cs diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299469039/MC_TE.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299469039/MC_TE.out deleted file mode 100644 index 3299ac8cfa..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299469039/MC_TE.out +++ /dev/null @@ -1,202 +0,0 @@ -@!@!@STARTMSG 2262:0 @!@!@ -TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) -@!@!@ENDMSG 2262 @!@!@ -@!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 105 and seed 4277674636266930199 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 7749] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). -@!@!@ENDMSG 2187 @!@!@ -@!@!@STARTMSG 2220:0 @!@!@ -Starting SANY... -@!@!@ENDMSG 2220 @!@!@ -Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/MC.tla -Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/fullmesh.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla -Semantic processing of module Naturals -Semantic processing of module Integers -Semantic processing of module fullmesh -Semantic processing of module Sequences -Semantic processing of module FiniteSets -Semantic processing of module TLC -Semantic processing of module MC -@!@!@STARTMSG 2219:0 @!@!@ -SANY finished. -@!@!@ENDMSG 2219 @!@!@ -@!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 16:11:06) -@!@!@ENDMSG 2185 @!@!@ -@!@!@STARTMSG 2279:3 @!@!@ -Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. -@!@!@ENDMSG 2279 @!@!@ -@!@!@STARTMSG 2284:3 @!@!@ -Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. -@!@!@ENDMSG 2284 @!@!@ -@!@!@STARTMSG 2212:0 @!@!@ -Implied-temporal checking--satisfiability problem has 1 branches. -@!@!@ENDMSG 2212 @!@!@ -@!@!@STARTMSG 2189:0 @!@!@ -Computing initial states... -@!@!@ENDMSG 2189 @!@!@ -@!@!@STARTMSG 2190:0 @!@!@ -Finished computing initial states: 1 distinct state generated at 2025-01-19 16:11:07. -@!@!@ENDMSG 2190 @!@!@ -@!@!@STARTMSG 2109:1 @!@!@ -Successor state is not completely specified by action SkPeerRecovery of the next-state relation. The following variables are not assigned: broker_state, pageserver_state. - -@!@!@ENDMSG 2109 @!@!@ -@!@!@STARTMSG 2121:1 @!@!@ -The behavior up to this point is: -@!@!@ENDMSG 2121 @!@!@ -@!@!@STARTMSG 2217:4 @!@!@ -1: -/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) -/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])]) -/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0]) - -@!@!@ENDMSG 2217 @!@!@ -@!@!@STARTMSG 2217:4 @!@!@ -2: -/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) -/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])]) -/\ safekeeper_state = (s1 :> [commit_lsn |-> 1, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 1, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0]) - -@!@!@ENDMSG 2217 @!@!@ -@!@!@STARTMSG 2217:4 @!@!@ -3: -/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) -/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])]) -/\ safekeeper_state = (s1 :> [commit_lsn |-> 2, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 2, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0]) - -@!@!@ENDMSG 2217 @!@!@ -@!@!@STARTMSG 2217:4 @!@!@ -4: -/\ pageserver_state = null -/\ broker_state = null -/\ safekeeper_state = (s1 :> [commit_lsn |-> 2, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 2, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 2, pruned_lsn |-> 0]) - -@!@!@ENDMSG 2217 @!@!@ -@!@!@STARTMSG 2201:0 @!@!@ -The coverage statistics at 2025-01-19 16:11:07 -@!@!@ENDMSG 2201 @!@!@ -@!@!@STARTMSG 2773:0 @!@!@ -: 2:2 -@!@!@ENDMSG 2773 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 34, col 5 to line 36, col 64 of module fullmesh: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 2:14 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 40, col 8 to line 40, col 14 of module fullmesh: 48 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 40, col 8 to line 40, col 9 of module fullmesh: 34 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 40, col 13 to line 40, col 14 of module fullmesh: 34 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 41, col 8 to line 41, col 72 of module fullmesh: 37 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 41, col 8 to line 41, col 38 of module fullmesh: 23 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 41, col 42 to line 41, col 72 of module fullmesh: 23 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 45, col 13 to line 47, col 50 of module fullmesh: 14 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 48, col 8 to line 48, col 51 of module fullmesh: 14 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:3 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 51, col 8 to line 51, col 72 of module fullmesh: 1 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 51, col 8 to line 51, col 38 of module fullmesh: 32 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 51, col 42 to line 51, col 72 of module fullmesh: 32 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 52, col 8 to line 52, col 102 of module fullmesh: 1 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 52, col 28 to line 52, col 102 of module fullmesh: 3 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:9 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 55, col 8 to line 62, col 29 of module fullmesh: 9 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 63, col 8 to line 63, col 55 of module fullmesh: 9 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:18 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 71, col 13 to line 73, col 37 of module fullmesh: 18 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 74, col 8 to line 74, col 51 of module fullmesh: 18 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:0 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 84, col 8 to line 84, col 30 of module fullmesh: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 84, col 8 to line 84, col 25 of module fullmesh: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 79, col 15 to line 79, col 33 of module fullmesh: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 81, col 5 to line 81, col 66 of module fullmesh: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 81, col 26 to line 81, col 65 of module fullmesh: 6 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 81, col 12 to line 81, col 23 of module fullmesh: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 84, col 24 to line 84, col 24 of module fullmesh: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 84, col 29 to line 84, col 30 of module fullmesh: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 85, col 8 to line 85, col 109 of module fullmesh: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 86, col 8 to line 86, col 51 of module fullmesh: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2202:0 @!@!@ -End of statistics. -@!@!@ENDMSG 2202 @!@!@ -@!@!@STARTMSG 2200:0 @!@!@ -Progress(3) at 2025-01-19 16:11:07: 40 states generated (992 s/min), 3 distinct states found (74 ds/min), 0 states left on queue. -@!@!@ENDMSG 2200 @!@!@ -@!@!@STARTMSG 2199:0 @!@!@ -40 states generated, 3 distinct states found, 0 states left on queue. -@!@!@ENDMSG 2199 @!@!@ -@!@!@STARTMSG 2194:0 @!@!@ -The depth of the complete state graph search is 3. -@!@!@ENDMSG 2194 @!@!@ -@!@!@STARTMSG 2268:0 @!@!@ -The average outdegree of the complete state graph is 1 (minimum is 1, the maximum 1 and the 95th percentile is 1). -@!@!@ENDMSG 2268 @!@!@ -@!@!@STARTMSG 2186:0 @!@!@ -Finished in 2440ms at (2025-01-19 16:11:07) -@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299542008/MC.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299542008/MC.out deleted file mode 100644 index 50c1506166..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299542008/MC.out +++ /dev/null @@ -1,57 +0,0 @@ -@!@!@STARTMSG 2262:0 @!@!@ -TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) -@!@!@ENDMSG 2262 @!@!@ -@!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 90 and seed -131482239732531000 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 7787] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). -@!@!@ENDMSG 2187 @!@!@ -@!@!@STARTMSG 2220:0 @!@!@ -Starting SANY... -@!@!@ENDMSG 2220 @!@!@ -Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/MC.tla -Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/fullmesh.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla -Semantic processing of module Naturals -Semantic processing of module Integers -Semantic processing of module fullmesh -Semantic processing of module Sequences -Semantic processing of module FiniteSets -Semantic processing of module TLC -Semantic processing of module MC -@!@!@STARTMSG 2219:0 @!@!@ -SANY finished. -@!@!@ENDMSG 2219 @!@!@ -@!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 16:12:09) -@!@!@ENDMSG 2185 @!@!@ -@!@!@STARTMSG 2279:3 @!@!@ -Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. -@!@!@ENDMSG 2279 @!@!@ -@!@!@STARTMSG 2284:3 @!@!@ -Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. -@!@!@ENDMSG 2284 @!@!@ -@!@!@STARTMSG 2212:0 @!@!@ -Implied-temporal checking--satisfiability problem has 1 branches. -@!@!@ENDMSG 2212 @!@!@ -@!@!@STARTMSG 2189:0 @!@!@ -Computing initial states... -@!@!@ENDMSG 2189 @!@!@ -@!@!@STARTMSG 2190:0 @!@!@ -Finished computing initial states: 1 distinct state generated at 2025-01-19 16:12:10. -@!@!@ENDMSG 2190 @!@!@ -@!@!@STARTMSG 2143:3 @!@!@ -The variable safekeeper_state was changed while it is specified as UNCHANGED at -line 53, col 34 to line 53, col 49 of module fullmesh -@!@!@ENDMSG 2143 @!@!@ -@!@!@STARTMSG 2192:0 @!@!@ -Checking temporal properties for the current state space with 1454 total distinct states at (2025-01-19 16:12:13) -@!@!@ENDMSG 2192 @!@!@ -@!@!@STARTMSG 2267:0 @!@!@ -Finished checking temporal properties in 00s at 2025-01-19 16:12:13 -@!@!@ENDMSG 2267 @!@!@ -@!@!@STARTMSG 2200:0 @!@!@ -Progress(11) at 2025-01-19 16:12:13: 44.264 states generated (44.264 s/min), 2.994 distinct states found (2.994 ds/min), 1.536 states left on queue. -@!@!@ENDMSG 2200 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299542008/MC.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299542008/MC.tla deleted file mode 100644 index c9a0a6f895..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299542008/MC.tla +++ /dev/null @@ -1,65 +0,0 @@ ----- MODULE MC ---- -EXTENDS fullmesh, TLC - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -b1, b2, b3 ----- - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -s1, s2, s3 ----- - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -p1, p2 ----- - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -az1, az2, az3 ----- - -\* MV CONSTANT definitions brokers -const_1737299528165230000 == -{b1, b2, b3} ----- - -\* MV CONSTANT definitions safekeepers -const_1737299528166231000 == -{s1, s2, s3} ----- - -\* MV CONSTANT definitions pageservers -const_1737299528166232000 == -{p1, p2} ----- - -\* MV CONSTANT definitions azs -const_1737299528166233000 == -{az1, az2, az3} ----- - -\* SYMMETRY definition -symm_1737299528166234000 == -Permutations(const_1737299528165230000) \union Permutations(const_1737299528166231000) \union Permutations(const_1737299528166232000) \union Permutations(const_1737299528166233000) ----- - -\* CONSTANT definitions @modelParameterConstants:4max_commit_lsn -const_1737299528166235000 == -2 ----- - -\* CONSTANT definitions @modelParameterConstants:5az_mapping -const_1737299528166236000 == -[ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2,p2} , az3 |-> {b3,s3}] ----- - -\* CONSTRAINT definition @modelParameterContraint:0 -constr_1737299528166237000 == -StateConstraint ----- -============================================================================= -\* Modification History -\* Created Sun Jan 19 16:12:08 CET 2025 by cs diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299542008/MC_TE.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299542008/MC_TE.out deleted file mode 100644 index 50c1506166..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299542008/MC_TE.out +++ /dev/null @@ -1,57 +0,0 @@ -@!@!@STARTMSG 2262:0 @!@!@ -TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) -@!@!@ENDMSG 2262 @!@!@ -@!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 90 and seed -131482239732531000 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 7787] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). -@!@!@ENDMSG 2187 @!@!@ -@!@!@STARTMSG 2220:0 @!@!@ -Starting SANY... -@!@!@ENDMSG 2220 @!@!@ -Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/MC.tla -Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/fullmesh.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla -Semantic processing of module Naturals -Semantic processing of module Integers -Semantic processing of module fullmesh -Semantic processing of module Sequences -Semantic processing of module FiniteSets -Semantic processing of module TLC -Semantic processing of module MC -@!@!@STARTMSG 2219:0 @!@!@ -SANY finished. -@!@!@ENDMSG 2219 @!@!@ -@!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 16:12:09) -@!@!@ENDMSG 2185 @!@!@ -@!@!@STARTMSG 2279:3 @!@!@ -Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. -@!@!@ENDMSG 2279 @!@!@ -@!@!@STARTMSG 2284:3 @!@!@ -Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. -@!@!@ENDMSG 2284 @!@!@ -@!@!@STARTMSG 2212:0 @!@!@ -Implied-temporal checking--satisfiability problem has 1 branches. -@!@!@ENDMSG 2212 @!@!@ -@!@!@STARTMSG 2189:0 @!@!@ -Computing initial states... -@!@!@ENDMSG 2189 @!@!@ -@!@!@STARTMSG 2190:0 @!@!@ -Finished computing initial states: 1 distinct state generated at 2025-01-19 16:12:10. -@!@!@ENDMSG 2190 @!@!@ -@!@!@STARTMSG 2143:3 @!@!@ -The variable safekeeper_state was changed while it is specified as UNCHANGED at -line 53, col 34 to line 53, col 49 of module fullmesh -@!@!@ENDMSG 2143 @!@!@ -@!@!@STARTMSG 2192:0 @!@!@ -Checking temporal properties for the current state space with 1454 total distinct states at (2025-01-19 16:12:13) -@!@!@ENDMSG 2192 @!@!@ -@!@!@STARTMSG 2267:0 @!@!@ -Finished checking temporal properties in 00s at 2025-01-19 16:12:13 -@!@!@ENDMSG 2267 @!@!@ -@!@!@STARTMSG 2200:0 @!@!@ -Progress(11) at 2025-01-19 16:12:13: 44.264 states generated (44.264 s/min), 2.994 distinct states found (2.994 ds/min), 1.536 states left on queue. -@!@!@ENDMSG 2200 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299744229/MC.cfg b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299744229/MC.cfg deleted file mode 100644 index a8b002b0f3..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299744229/MC.cfg +++ /dev/null @@ -1,51 +0,0 @@ -\* MV CONSTANT declarations -CONSTANTS -b1 = b1 -b2 = b2 -b3 = b3 -\* MV CONSTANT declarations -CONSTANTS -s1 = s1 -s2 = s2 -s3 = s3 -\* MV CONSTANT declarations -CONSTANTS -p1 = p1 -p2 = p2 -\* MV CONSTANT declarations -CONSTANTS -az1 = az1 -az2 = az2 -az3 = az3 -\* MV CONSTANT definitions -CONSTANT -brokers <- const_1737299548592239000 -\* CONSTANT declarations -CONSTANT NULL = NULL -\* MV CONSTANT definitions -CONSTANT -safekeepers <- const_1737299548592240000 -\* MV CONSTANT definitions -CONSTANT -pageservers <- const_1737299548592241000 -\* MV CONSTANT definitions -CONSTANT -azs <- const_1737299548592242000 -\* SYMMETRY definition -SYMMETRY symm_1737299548592243000 -\* CONSTANT definitions -CONSTANT -max_commit_lsn <- const_1737299548592244000 -\* CONSTANT definitions -CONSTANT -az_mapping <- const_1737299548592245000 -\* CONSTRAINT definition -CONSTRAINT -constr_1737299548592246000 -\* SPECIFICATION definition -SPECIFICATION -Spec -\* PROPERTY definition -PROPERTY -EventuallyLaggingSkIsNotPreferredSk -\* Generated on Sun Jan 19 16:12:28 CET 2025 \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299744229/MC.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299744229/MC.out deleted file mode 100644 index 071b6e732d..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299744229/MC.out +++ /dev/null @@ -1,323 +0,0 @@ -@!@!@STARTMSG 2262:0 @!@!@ -TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) -@!@!@ENDMSG 2262 @!@!@ -@!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 7 and seed 1961239747497010948 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 7839] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). -@!@!@ENDMSG 2187 @!@!@ -@!@!@STARTMSG 2220:0 @!@!@ -Starting SANY... -@!@!@ENDMSG 2220 @!@!@ -Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/MC.tla -Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/fullmesh.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla -Semantic processing of module Naturals -Semantic processing of module Integers -Semantic processing of module fullmesh -Semantic processing of module Sequences -Semantic processing of module FiniteSets -Semantic processing of module TLC -Semantic processing of module MC -@!@!@STARTMSG 2219:0 @!@!@ -SANY finished. -@!@!@ENDMSG 2219 @!@!@ -@!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 16:12:29) -@!@!@ENDMSG 2185 @!@!@ -@!@!@STARTMSG 2279:3 @!@!@ -Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. -@!@!@ENDMSG 2279 @!@!@ -@!@!@STARTMSG 2284:3 @!@!@ -Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. -@!@!@ENDMSG 2284 @!@!@ -@!@!@STARTMSG 2212:0 @!@!@ -Implied-temporal checking--satisfiability problem has 1 branches. -@!@!@ENDMSG 2212 @!@!@ -@!@!@STARTMSG 2189:0 @!@!@ -Computing initial states... -@!@!@ENDMSG 2189 @!@!@ -@!@!@STARTMSG 2190:0 @!@!@ -Finished computing initial states: 1 distinct state generated at 2025-01-19 16:12:31. -@!@!@ENDMSG 2190 @!@!@ -@!@!@STARTMSG 2192:0 @!@!@ -Checking temporal properties for the current state space with 1175 total distinct states at (2025-01-19 16:12:34) -@!@!@ENDMSG 2192 @!@!@ -@!@!@STARTMSG 2267:0 @!@!@ -Finished checking temporal properties in 00s at 2025-01-19 16:12:34 -@!@!@ENDMSG 2267 @!@!@ -@!@!@STARTMSG 2200:0 @!@!@ -Progress(11) at 2025-01-19 16:12:34: 38.396 states generated (38.396 s/min), 3.250 distinct states found (3.250 ds/min), 2.071 states left on queue. -@!@!@ENDMSG 2200 @!@!@ -@!@!@STARTMSG 2192:0 @!@!@ -Checking temporal properties for the current state space with 45381 total distinct states at (2025-01-19 16:13:34) -@!@!@ENDMSG 2192 @!@!@ -@!@!@STARTMSG 2267:0 @!@!@ -Finished checking temporal properties in 00s at 2025-01-19 16:13:34 -@!@!@ENDMSG 2267 @!@!@ -@!@!@STARTMSG 2200:0 @!@!@ -Progress(15) at 2025-01-19 16:13:34: 1.510.623 states generated (1.472.227 s/min), 97.716 distinct states found (94.466 ds/min), 52.332 states left on queue. -@!@!@ENDMSG 2200 @!@!@ -@!@!@STARTMSG 2192:0 @!@!@ -Checking temporal properties for the current state space with 92513 total distinct states at (2025-01-19 16:14:34) -@!@!@ENDMSG 2192 @!@!@ -@!@!@STARTMSG 2267:0 @!@!@ -Finished checking temporal properties in 00s at 2025-01-19 16:14:34 -@!@!@ENDMSG 2267 @!@!@ -@!@!@STARTMSG 2200:0 @!@!@ -Progress(16) at 2025-01-19 16:14:34: 3.093.230 states generated (1.582.607 s/min), 182.372 distinct states found (84.656 ds/min), 89.855 states left on queue. -@!@!@ENDMSG 2200 @!@!@ -@!@!@STARTMSG 2192:0 @!@!@ -Checking temporal properties for the current state space with 140861 total distinct states at (2025-01-19 16:15:34) -@!@!@ENDMSG 2192 @!@!@ -@!@!@STARTMSG 2267:0 @!@!@ -Finished checking temporal properties in 00s at 2025-01-19 16:15:34 -@!@!@ENDMSG 2267 @!@!@ -@!@!@STARTMSG 2200:0 @!@!@ -Progress(17) at 2025-01-19 16:15:34: 4.742.508 states generated (1.649.278 s/min), 257.179 distinct states found (74.807 ds/min), 116.314 states left on queue. -@!@!@ENDMSG 2200 @!@!@ -@!@!@STARTMSG 2201:0 @!@!@ -The coverage statistics at 2025-01-19 16:15:34 -@!@!@ENDMSG 2201 @!@!@ -@!@!@STARTMSG 2773:0 @!@!@ -: 1:1 -@!@!@ENDMSG 2773 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 34, col 5 to line 36, col 64 of module fullmesh: 1 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 54:531874 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 40, col 8 to line 40, col 14 of module fullmesh: 1799789 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 40, col 8 to line 40, col 9 of module fullmesh: 1267920 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 40, col 13 to line 40, col 14 of module fullmesh: 1267920 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 41, col 8 to line 41, col 72 of module fullmesh: 1377160 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 41, col 8 to line 41, col 38 of module fullmesh: 845280 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 41, col 8 to line 41, col 27 of module fullmesh: 845280 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 41, col 8 to line 41, col 23 of module fullmesh: 845280 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 41, col 25 to line 41, col 26 of module fullmesh: 845280 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 41, col 42 to line 41, col 72 of module fullmesh: 845280 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 45, col 13 to line 47, col 50 of module fullmesh: 531880 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 48, col 8 to line 48, col 51 of module fullmesh: 531878 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 148:156702 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 51, col 8 to line 51, col 72 of module fullmesh: 156716 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 51, col 8 to line 51, col 38 of module fullmesh: 1267992 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 51, col 8 to line 51, col 27 of module fullmesh: 1267999 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 51, col 8 to line 51, col 23 of module fullmesh: 1268010 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 51, col 25 to line 51, col 26 of module fullmesh: 1268010 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 51, col 42 to line 51, col 72 of module fullmesh: 1268010 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 52, col 8 to line 52, col 102 of module fullmesh: 156720 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 53, col 8 to line 53, col 51 of module fullmesh: 156716 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 13409:1268009 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 56, col 8 to line 63, col 29 of module fullmesh: 1268023 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 56, col 24 to line 63, col 29 of module fullmesh: 1268028 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 56, col 27 to line 56, col 91 of module fullmesh: 1268028 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 56, col 27 to line 56, col 58 of module fullmesh: 1268028 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||||line 56, col 27 to line 56, col 47 of module fullmesh: 1268028 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||||line 56, col 27 to line 56, col 44 of module fullmesh: 1268028 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||||||line 56, col 27 to line 56, col 41 of module fullmesh: 1268028 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||||||line 56, col 27 to line 56, col 38 of module fullmesh: 1268028 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||||||line 56, col 40 to line 56, col 40 of module fullmesh: 1268028 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||||line 56, col 46 to line 56, col 46 of module fullmesh: 1268028 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 56, col 62 to line 56, col 91 of module fullmesh: 1268028 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 59, col 28 to line 59, col 45 of module fullmesh: 793908 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 59, col 28 to line 59, col 42 of module fullmesh: 793908 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 60, col 31 to line 60, col 91 of module fullmesh: 793908 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 60, col 32 to line 60, col 34 of module fullmesh: 793908 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 60, col 43 to line 60, col 90 of module fullmesh: 793906 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 62, col 17 to line 62, col 54 of module fullmesh: 793908 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 63, col 18 to line 63, col 29 of module fullmesh: 474120 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 64, col 8 to line 64, col 55 of module fullmesh: 1268023 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 130578:2536105 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 72, col 13 to line 74, col 37 of module fullmesh: 2536113 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 72, col 33 to line 74, col 37 of module fullmesh: 2536117 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 72, col 36 to line 72, col 66 of module fullmesh: 2536118 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 72, col 36 to line 72, col 49 of module fullmesh: 2536119 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 72, col 53 to line 72, col 66 of module fullmesh: 2536121 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||||line 72, col 53 to line 72, col 55 of module fullmesh: 2536122 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||||line 69, col 20 to line 69, col 44 of module fullmesh: 2536123 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||||||line 69, col 20 to line 69, col 41 of module fullmesh: 2536124 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||||||line 69, col 20 to line 69, col 38 of module fullmesh: 2536125 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||||||line 69, col 43 to line 69, col 43 of module fullmesh: 2536126 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 73, col 22 to line 73, col 66 of module fullmesh: 818090 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 74, col 22 to line 74, col 37 of module fullmesh: 1718038 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 75, col 8 to line 75, col 51 of module fullmesh: 2536113 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 113018:250807 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 85, col 8 to line 85, col 30 of module fullmesh: 532607 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 85, col 8 to line 85, col 25 of module fullmesh: 281798 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 80, col 15 to line 80, col 33 of module fullmesh: 281798 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 82, col 5 to line 82, col 66 of module fullmesh: 281798 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 82, col 26 to line 82, col 65 of module fullmesh: 845394 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 82, col 12 to line 82, col 23 of module fullmesh: 281798 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 85, col 24 to line 85, col 24 of module fullmesh: 281798 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 85, col 29 to line 85, col 30 of module fullmesh: 281800 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 86, col 8 to line 86, col 109 of module fullmesh: 250813 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 86, col 28 to line 86, col 109 of module fullmesh: 250815 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 86, col 29 to line 86, col 44 of module fullmesh: 250815 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 86, col 52 to line 86, col 108 of module fullmesh: 250807 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 86, col 72 to line 86, col 108 of module fullmesh: 250815 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 86, col 105 to line 86, col 108 of module fullmesh: 250814 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 86, col 85 to line 86, col 102 of module fullmesh: 250815 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||||line 80, col 15 to line 80, col 33 of module fullmesh: 250814 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2775:0 @!@!@ - ||||line 82, col 5 to line 82, col 66 of module fullmesh: 250814:250814 -@!@!@ENDMSG 2775 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||||line 82, col 26 to line 82, col 65 of module fullmesh: 752442 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||||line 82, col 12 to line 82, col 23 of module fullmesh: 250814 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||||line 86, col 101 to line 86, col 101 of module fullmesh: 250814 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 87, col 8 to line 87, col 51 of module fullmesh: 250807 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2202:0 @!@!@ -End of statistics. -@!@!@ENDMSG 2202 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299744229/MC.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299744229/MC.tla deleted file mode 100644 index fc42ac157a..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299744229/MC.tla +++ /dev/null @@ -1,65 +0,0 @@ ----- MODULE MC ---- -EXTENDS fullmesh, TLC - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -b1, b2, b3 ----- - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -s1, s2, s3 ----- - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -p1, p2 ----- - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -az1, az2, az3 ----- - -\* MV CONSTANT definitions brokers -const_1737299548592239000 == -{b1, b2, b3} ----- - -\* MV CONSTANT definitions safekeepers -const_1737299548592240000 == -{s1, s2, s3} ----- - -\* MV CONSTANT definitions pageservers -const_1737299548592241000 == -{p1, p2} ----- - -\* MV CONSTANT definitions azs -const_1737299548592242000 == -{az1, az2, az3} ----- - -\* SYMMETRY definition -symm_1737299548592243000 == -Permutations(const_1737299548592239000) \union Permutations(const_1737299548592240000) \union Permutations(const_1737299548592241000) \union Permutations(const_1737299548592242000) ----- - -\* CONSTANT definitions @modelParameterConstants:4max_commit_lsn -const_1737299548592244000 == -2 ----- - -\* CONSTANT definitions @modelParameterConstants:5az_mapping -const_1737299548592245000 == -[ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2,p2} , az3 |-> {b3,s3}] ----- - -\* CONSTRAINT definition @modelParameterContraint:0 -constr_1737299548592246000 == -StateConstraint ----- -============================================================================= -\* Modification History -\* Created Sun Jan 19 16:12:28 CET 2025 by cs diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299744229/MC_TE.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299744229/MC_TE.out deleted file mode 100644 index 071b6e732d..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299744229/MC_TE.out +++ /dev/null @@ -1,323 +0,0 @@ -@!@!@STARTMSG 2262:0 @!@!@ -TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) -@!@!@ENDMSG 2262 @!@!@ -@!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 7 and seed 1961239747497010948 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 7839] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). -@!@!@ENDMSG 2187 @!@!@ -@!@!@STARTMSG 2220:0 @!@!@ -Starting SANY... -@!@!@ENDMSG 2220 @!@!@ -Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/MC.tla -Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/fullmesh.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla -Semantic processing of module Naturals -Semantic processing of module Integers -Semantic processing of module fullmesh -Semantic processing of module Sequences -Semantic processing of module FiniteSets -Semantic processing of module TLC -Semantic processing of module MC -@!@!@STARTMSG 2219:0 @!@!@ -SANY finished. -@!@!@ENDMSG 2219 @!@!@ -@!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 16:12:29) -@!@!@ENDMSG 2185 @!@!@ -@!@!@STARTMSG 2279:3 @!@!@ -Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. -@!@!@ENDMSG 2279 @!@!@ -@!@!@STARTMSG 2284:3 @!@!@ -Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. -@!@!@ENDMSG 2284 @!@!@ -@!@!@STARTMSG 2212:0 @!@!@ -Implied-temporal checking--satisfiability problem has 1 branches. -@!@!@ENDMSG 2212 @!@!@ -@!@!@STARTMSG 2189:0 @!@!@ -Computing initial states... -@!@!@ENDMSG 2189 @!@!@ -@!@!@STARTMSG 2190:0 @!@!@ -Finished computing initial states: 1 distinct state generated at 2025-01-19 16:12:31. -@!@!@ENDMSG 2190 @!@!@ -@!@!@STARTMSG 2192:0 @!@!@ -Checking temporal properties for the current state space with 1175 total distinct states at (2025-01-19 16:12:34) -@!@!@ENDMSG 2192 @!@!@ -@!@!@STARTMSG 2267:0 @!@!@ -Finished checking temporal properties in 00s at 2025-01-19 16:12:34 -@!@!@ENDMSG 2267 @!@!@ -@!@!@STARTMSG 2200:0 @!@!@ -Progress(11) at 2025-01-19 16:12:34: 38.396 states generated (38.396 s/min), 3.250 distinct states found (3.250 ds/min), 2.071 states left on queue. -@!@!@ENDMSG 2200 @!@!@ -@!@!@STARTMSG 2192:0 @!@!@ -Checking temporal properties for the current state space with 45381 total distinct states at (2025-01-19 16:13:34) -@!@!@ENDMSG 2192 @!@!@ -@!@!@STARTMSG 2267:0 @!@!@ -Finished checking temporal properties in 00s at 2025-01-19 16:13:34 -@!@!@ENDMSG 2267 @!@!@ -@!@!@STARTMSG 2200:0 @!@!@ -Progress(15) at 2025-01-19 16:13:34: 1.510.623 states generated (1.472.227 s/min), 97.716 distinct states found (94.466 ds/min), 52.332 states left on queue. -@!@!@ENDMSG 2200 @!@!@ -@!@!@STARTMSG 2192:0 @!@!@ -Checking temporal properties for the current state space with 92513 total distinct states at (2025-01-19 16:14:34) -@!@!@ENDMSG 2192 @!@!@ -@!@!@STARTMSG 2267:0 @!@!@ -Finished checking temporal properties in 00s at 2025-01-19 16:14:34 -@!@!@ENDMSG 2267 @!@!@ -@!@!@STARTMSG 2200:0 @!@!@ -Progress(16) at 2025-01-19 16:14:34: 3.093.230 states generated (1.582.607 s/min), 182.372 distinct states found (84.656 ds/min), 89.855 states left on queue. -@!@!@ENDMSG 2200 @!@!@ -@!@!@STARTMSG 2192:0 @!@!@ -Checking temporal properties for the current state space with 140861 total distinct states at (2025-01-19 16:15:34) -@!@!@ENDMSG 2192 @!@!@ -@!@!@STARTMSG 2267:0 @!@!@ -Finished checking temporal properties in 00s at 2025-01-19 16:15:34 -@!@!@ENDMSG 2267 @!@!@ -@!@!@STARTMSG 2200:0 @!@!@ -Progress(17) at 2025-01-19 16:15:34: 4.742.508 states generated (1.649.278 s/min), 257.179 distinct states found (74.807 ds/min), 116.314 states left on queue. -@!@!@ENDMSG 2200 @!@!@ -@!@!@STARTMSG 2201:0 @!@!@ -The coverage statistics at 2025-01-19 16:15:34 -@!@!@ENDMSG 2201 @!@!@ -@!@!@STARTMSG 2773:0 @!@!@ -: 1:1 -@!@!@ENDMSG 2773 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 34, col 5 to line 36, col 64 of module fullmesh: 1 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 54:531874 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 40, col 8 to line 40, col 14 of module fullmesh: 1799789 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 40, col 8 to line 40, col 9 of module fullmesh: 1267920 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 40, col 13 to line 40, col 14 of module fullmesh: 1267920 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 41, col 8 to line 41, col 72 of module fullmesh: 1377160 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 41, col 8 to line 41, col 38 of module fullmesh: 845280 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 41, col 8 to line 41, col 27 of module fullmesh: 845280 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 41, col 8 to line 41, col 23 of module fullmesh: 845280 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 41, col 25 to line 41, col 26 of module fullmesh: 845280 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 41, col 42 to line 41, col 72 of module fullmesh: 845280 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 45, col 13 to line 47, col 50 of module fullmesh: 531880 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 48, col 8 to line 48, col 51 of module fullmesh: 531878 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 148:156702 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 51, col 8 to line 51, col 72 of module fullmesh: 156716 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 51, col 8 to line 51, col 38 of module fullmesh: 1267992 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 51, col 8 to line 51, col 27 of module fullmesh: 1267999 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 51, col 8 to line 51, col 23 of module fullmesh: 1268010 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 51, col 25 to line 51, col 26 of module fullmesh: 1268010 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 51, col 42 to line 51, col 72 of module fullmesh: 1268010 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 52, col 8 to line 52, col 102 of module fullmesh: 156720 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 53, col 8 to line 53, col 51 of module fullmesh: 156716 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 13409:1268009 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 56, col 8 to line 63, col 29 of module fullmesh: 1268023 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 56, col 24 to line 63, col 29 of module fullmesh: 1268028 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 56, col 27 to line 56, col 91 of module fullmesh: 1268028 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 56, col 27 to line 56, col 58 of module fullmesh: 1268028 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||||line 56, col 27 to line 56, col 47 of module fullmesh: 1268028 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||||line 56, col 27 to line 56, col 44 of module fullmesh: 1268028 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||||||line 56, col 27 to line 56, col 41 of module fullmesh: 1268028 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||||||line 56, col 27 to line 56, col 38 of module fullmesh: 1268028 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||||||line 56, col 40 to line 56, col 40 of module fullmesh: 1268028 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||||line 56, col 46 to line 56, col 46 of module fullmesh: 1268028 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 56, col 62 to line 56, col 91 of module fullmesh: 1268028 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 59, col 28 to line 59, col 45 of module fullmesh: 793908 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 59, col 28 to line 59, col 42 of module fullmesh: 793908 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 60, col 31 to line 60, col 91 of module fullmesh: 793908 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 60, col 32 to line 60, col 34 of module fullmesh: 793908 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 60, col 43 to line 60, col 90 of module fullmesh: 793906 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 62, col 17 to line 62, col 54 of module fullmesh: 793908 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 63, col 18 to line 63, col 29 of module fullmesh: 474120 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 64, col 8 to line 64, col 55 of module fullmesh: 1268023 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 130578:2536105 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 72, col 13 to line 74, col 37 of module fullmesh: 2536113 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 72, col 33 to line 74, col 37 of module fullmesh: 2536117 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 72, col 36 to line 72, col 66 of module fullmesh: 2536118 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 72, col 36 to line 72, col 49 of module fullmesh: 2536119 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 72, col 53 to line 72, col 66 of module fullmesh: 2536121 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||||line 72, col 53 to line 72, col 55 of module fullmesh: 2536122 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||||line 69, col 20 to line 69, col 44 of module fullmesh: 2536123 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||||||line 69, col 20 to line 69, col 41 of module fullmesh: 2536124 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||||||line 69, col 20 to line 69, col 38 of module fullmesh: 2536125 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||||||line 69, col 43 to line 69, col 43 of module fullmesh: 2536126 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 73, col 22 to line 73, col 66 of module fullmesh: 818090 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 74, col 22 to line 74, col 37 of module fullmesh: 1718038 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 75, col 8 to line 75, col 51 of module fullmesh: 2536113 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 113018:250807 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 85, col 8 to line 85, col 30 of module fullmesh: 532607 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 85, col 8 to line 85, col 25 of module fullmesh: 281798 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 80, col 15 to line 80, col 33 of module fullmesh: 281798 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 82, col 5 to line 82, col 66 of module fullmesh: 281798 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 82, col 26 to line 82, col 65 of module fullmesh: 845394 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 82, col 12 to line 82, col 23 of module fullmesh: 281798 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 85, col 24 to line 85, col 24 of module fullmesh: 281798 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 85, col 29 to line 85, col 30 of module fullmesh: 281800 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 86, col 8 to line 86, col 109 of module fullmesh: 250813 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 86, col 28 to line 86, col 109 of module fullmesh: 250815 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 86, col 29 to line 86, col 44 of module fullmesh: 250815 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 86, col 52 to line 86, col 108 of module fullmesh: 250807 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 86, col 72 to line 86, col 108 of module fullmesh: 250815 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 86, col 105 to line 86, col 108 of module fullmesh: 250814 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 86, col 85 to line 86, col 102 of module fullmesh: 250815 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||||line 80, col 15 to line 80, col 33 of module fullmesh: 250814 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2775:0 @!@!@ - ||||line 82, col 5 to line 82, col 66 of module fullmesh: 250814:250814 -@!@!@ENDMSG 2775 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||||line 82, col 26 to line 82, col 65 of module fullmesh: 752442 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||||line 82, col 12 to line 82, col 23 of module fullmesh: 250814 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||||line 86, col 101 to line 86, col 101 of module fullmesh: 250814 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 87, col 8 to line 87, col 51 of module fullmesh: 250807 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2202:0 @!@!@ -End of statistics. -@!@!@ENDMSG 2202 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737301172627/MC.cfg b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307595008/MC.cfg similarity index 67% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737301172627/MC.cfg rename to storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307595008/MC.cfg index 4963984e72..d030d28ac1 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737301172627/MC.cfg +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307595008/MC.cfg @@ -19,33 +19,33 @@ az2 = az2 az3 = az3 \* MV CONSTANT definitions CONSTANT -brokers <- const_17373011685892000 +brokers <- const_17373075907692000 \* CONSTANT declarations CONSTANT NULL = NULL \* MV CONSTANT definitions CONSTANT -safekeepers <- const_17373011685893000 +safekeepers <- const_17373075907703000 \* MV CONSTANT definitions CONSTANT -pageservers <- const_17373011685894000 +pageservers <- const_17373075907704000 \* MV CONSTANT definitions CONSTANT -azs <- const_17373011685895000 +azs <- const_17373075907705000 \* SYMMETRY definition -SYMMETRY symm_17373011685896000 +SYMMETRY symm_17373075907706000 \* CONSTANT definitions CONSTANT -max_commit_lsn <- const_17373011685897000 +max_commit_lsn <- const_17373075907707000 \* CONSTANT definitions CONSTANT -az_mapping <- const_17373011685898000 +az_mapping <- const_17373075907708000 \* CONSTRAINT definition CONSTRAINT -constr_17373011685899000 +constr_17373075907709000 \* SPECIFICATION definition SPECIFICATION Spec \* PROPERTY definition PROPERTY EventuallyLaggingSkIsNotPreferredSk -\* Generated on Sun Jan 19 16:39:28 CET 2025 \ No newline at end of file +\* Generated on Sun Jan 19 18:26:30 CET 2025 \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307595008/MC.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307595008/MC.out new file mode 100644 index 0000000000..cfe6177fe8 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307595008/MC.out @@ -0,0 +1,164 @@ +@!@!@STARTMSG 2262:0 @!@!@ +TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) +@!@!@ENDMSG 2262 @!@!@ +@!@!@STARTMSG 2187:0 @!@!@ +Running breadth-first search Model-Checking with fp 44 and seed -6447714091281296951 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11418] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +@!@!@ENDMSG 2187 @!@!@ +@!@!@STARTMSG 2220:0 @!@!@ +Starting SANY... +@!@!@ENDMSG 2220 @!@!@ +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla +Semantic processing of module Naturals +Semantic processing of module Integers +Semantic processing of module Sequences +Semantic processing of module FiniteSets +Semantic processing of module replicated +Semantic processing of module TLC +Semantic processing of module MC +@!@!@STARTMSG 2219:0 @!@!@ +SANY finished. +@!@!@ENDMSG 2219 @!@!@ +@!@!@STARTMSG 2185:0 @!@!@ +Starting... (2025-01-19 18:26:32) +@!@!@ENDMSG 2185 @!@!@ +@!@!@STARTMSG 2140:3 @!@!@ +The subscript of the next-state relation specified by the specification +does not seem to contain the state variable online +@!@!@ENDMSG 2140 @!@!@ +@!@!@STARTMSG 2279:3 @!@!@ +Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. +@!@!@ENDMSG 2279 @!@!@ +@!@!@STARTMSG 2284:3 @!@!@ +Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. +@!@!@ENDMSG 2284 @!@!@ +@!@!@STARTMSG 2212:0 @!@!@ +Implied-temporal checking--satisfiability problem has 1 branches. +@!@!@ENDMSG 2212 @!@!@ +@!@!@STARTMSG 2189:0 @!@!@ +Computing initial states... +@!@!@ENDMSG 2189 @!@!@ +@!@!@STARTMSG 2190:0 @!@!@ +Finished computing initial states: 1 distinct state generated at 2025-01-19 18:26:33. +@!@!@ENDMSG 2190 @!@!@ +@!@!@STARTMSG 2109:1 @!@!@ +Successor state is not completely specified by action NodeOnlineOffline of the next-state relation. The following variables are not assigned: broker_state, pageserver_state, safekeeper_state. + +@!@!@ENDMSG 2109 @!@!@ +@!@!@STARTMSG 2121:1 @!@!@ +The behavior up to this point is: +@!@!@ENDMSG 2121 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +1: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])]) +/\ online = {b1, b2, b3, s1, s2, s3, p1, p2} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +2: +/\ pageserver_state = null +/\ broker_state = null +/\ online = {b1, b2, s1, s2, p1, p2} +/\ safekeeper_state = null + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2201:0 @!@!@ +The coverage statistics at 2025-01-19 18:26:33 +@!@!@ENDMSG 2201 @!@!@ +@!@!@STARTMSG 2773:0 @!@!@ +: 1:1 +@!@!@ENDMSG 2773 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 35, col 5 to line 38, col 26 of module replicated: 1 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:2 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 40, col 22 to line 43, col 44 of module replicated: 1 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 40, col 32 to line 43, col 44 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 41, col 9 to line 43, col 44 of module replicated: 464 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 41, col 12 to line 41, col 48 of module replicated: 464 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 42, col 12 to line 42, col 44 of module replicated: 208 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 43, col 12 to line 43, col 44 of module replicated: 86 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 40, col 46 to line 40, col 62 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 52, col 13 to line 54, col 50 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 55, col 8 to line 55, col 51 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 60, col 8 to line 60, col 102 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 61, col 8 to line 61, col 51 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 65, col 8 to line 72, col 29 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 73, col 8 to line 73, col 55 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 82, col 13 to line 84, col 37 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 85, col 8 to line 85, col 51 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 98, col 8 to line 98, col 109 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 99, col 8 to line 99, col 51 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2202:0 @!@!@ +End of statistics. +@!@!@ENDMSG 2202 @!@!@ +@!@!@STARTMSG 2200:0 @!@!@ +Progress(1) at 2025-01-19 18:26:33: 2 states generated (45 s/min), 1 distinct states found (22 ds/min), 0 states left on queue. +@!@!@ENDMSG 2200 @!@!@ +@!@!@STARTMSG 2199:0 @!@!@ +2 states generated, 1 distinct states found, 0 states left on queue. +@!@!@ENDMSG 2199 @!@!@ +@!@!@STARTMSG 2194:0 @!@!@ +The depth of the complete state graph search is 1. +@!@!@ENDMSG 2194 @!@!@ +@!@!@STARTMSG 2186:0 @!@!@ +Finished in 2685ms at (2025-01-19 18:26:33) +@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737301172627/MC.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307595008/MC.tla similarity index 69% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737301172627/MC.tla rename to storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307595008/MC.tla index a2397f5d47..be5c82d29b 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737301172627/MC.tla +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307595008/MC.tla @@ -22,44 +22,44 @@ az1, az2, az3 ---- \* MV CONSTANT definitions brokers -const_17373011685892000 == +const_17373075907692000 == {b1, b2, b3} ---- \* MV CONSTANT definitions safekeepers -const_17373011685893000 == +const_17373075907703000 == {s1, s2, s3} ---- \* MV CONSTANT definitions pageservers -const_17373011685894000 == +const_17373075907704000 == {p1, p2} ---- \* MV CONSTANT definitions azs -const_17373011685895000 == +const_17373075907705000 == {az1, az2, az3} ---- \* SYMMETRY definition -symm_17373011685896000 == -Permutations(const_17373011685892000) \union Permutations(const_17373011685893000) \union Permutations(const_17373011685894000) \union Permutations(const_17373011685895000) +symm_17373075907706000 == +Permutations(const_17373075907692000) \union Permutations(const_17373075907703000) \union Permutations(const_17373075907704000) \union Permutations(const_17373075907705000) ---- \* CONSTANT definitions @modelParameterConstants:4max_commit_lsn -const_17373011685897000 == +const_17373075907707000 == 2 ---- \* CONSTANT definitions @modelParameterConstants:5az_mapping -const_17373011685898000 == +const_17373075907708000 == [ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2,p2} , az3 |-> {b3,s3}] ---- \* CONSTRAINT definition @modelParameterContraint:0 -constr_17373011685899000 == +constr_17373075907709000 == StateConstraint ---- ============================================================================= \* Modification History -\* Created Sun Jan 19 16:39:28 CET 2025 by cs +\* Created Sun Jan 19 18:26:30 CET 2025 by cs diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307595008/MC_TE.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307595008/MC_TE.out new file mode 100644 index 0000000000..cfe6177fe8 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307595008/MC_TE.out @@ -0,0 +1,164 @@ +@!@!@STARTMSG 2262:0 @!@!@ +TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) +@!@!@ENDMSG 2262 @!@!@ +@!@!@STARTMSG 2187:0 @!@!@ +Running breadth-first search Model-Checking with fp 44 and seed -6447714091281296951 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11418] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +@!@!@ENDMSG 2187 @!@!@ +@!@!@STARTMSG 2220:0 @!@!@ +Starting SANY... +@!@!@ENDMSG 2220 @!@!@ +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla +Semantic processing of module Naturals +Semantic processing of module Integers +Semantic processing of module Sequences +Semantic processing of module FiniteSets +Semantic processing of module replicated +Semantic processing of module TLC +Semantic processing of module MC +@!@!@STARTMSG 2219:0 @!@!@ +SANY finished. +@!@!@ENDMSG 2219 @!@!@ +@!@!@STARTMSG 2185:0 @!@!@ +Starting... (2025-01-19 18:26:32) +@!@!@ENDMSG 2185 @!@!@ +@!@!@STARTMSG 2140:3 @!@!@ +The subscript of the next-state relation specified by the specification +does not seem to contain the state variable online +@!@!@ENDMSG 2140 @!@!@ +@!@!@STARTMSG 2279:3 @!@!@ +Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. +@!@!@ENDMSG 2279 @!@!@ +@!@!@STARTMSG 2284:3 @!@!@ +Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. +@!@!@ENDMSG 2284 @!@!@ +@!@!@STARTMSG 2212:0 @!@!@ +Implied-temporal checking--satisfiability problem has 1 branches. +@!@!@ENDMSG 2212 @!@!@ +@!@!@STARTMSG 2189:0 @!@!@ +Computing initial states... +@!@!@ENDMSG 2189 @!@!@ +@!@!@STARTMSG 2190:0 @!@!@ +Finished computing initial states: 1 distinct state generated at 2025-01-19 18:26:33. +@!@!@ENDMSG 2190 @!@!@ +@!@!@STARTMSG 2109:1 @!@!@ +Successor state is not completely specified by action NodeOnlineOffline of the next-state relation. The following variables are not assigned: broker_state, pageserver_state, safekeeper_state. + +@!@!@ENDMSG 2109 @!@!@ +@!@!@STARTMSG 2121:1 @!@!@ +The behavior up to this point is: +@!@!@ENDMSG 2121 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +1: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])]) +/\ online = {b1, b2, b3, s1, s2, s3, p1, p2} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +2: +/\ pageserver_state = null +/\ broker_state = null +/\ online = {b1, b2, s1, s2, p1, p2} +/\ safekeeper_state = null + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2201:0 @!@!@ +The coverage statistics at 2025-01-19 18:26:33 +@!@!@ENDMSG 2201 @!@!@ +@!@!@STARTMSG 2773:0 @!@!@ +: 1:1 +@!@!@ENDMSG 2773 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 35, col 5 to line 38, col 26 of module replicated: 1 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:2 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 40, col 22 to line 43, col 44 of module replicated: 1 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 40, col 32 to line 43, col 44 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 41, col 9 to line 43, col 44 of module replicated: 464 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 41, col 12 to line 41, col 48 of module replicated: 464 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 42, col 12 to line 42, col 44 of module replicated: 208 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 43, col 12 to line 43, col 44 of module replicated: 86 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 40, col 46 to line 40, col 62 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 52, col 13 to line 54, col 50 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 55, col 8 to line 55, col 51 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 60, col 8 to line 60, col 102 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 61, col 8 to line 61, col 51 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 65, col 8 to line 72, col 29 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 73, col 8 to line 73, col 55 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 82, col 13 to line 84, col 37 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 85, col 8 to line 85, col 51 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 98, col 8 to line 98, col 109 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 99, col 8 to line 99, col 51 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2202:0 @!@!@ +End of statistics. +@!@!@ENDMSG 2202 @!@!@ +@!@!@STARTMSG 2200:0 @!@!@ +Progress(1) at 2025-01-19 18:26:33: 2 states generated (45 s/min), 1 distinct states found (22 ds/min), 0 states left on queue. +@!@!@ENDMSG 2200 @!@!@ +@!@!@STARTMSG 2199:0 @!@!@ +2 states generated, 1 distinct states found, 0 states left on queue. +@!@!@ENDMSG 2199 @!@!@ +@!@!@STARTMSG 2194:0 @!@!@ +The depth of the complete state graph search is 1. +@!@!@ENDMSG 2194 @!@!@ +@!@!@STARTMSG 2186:0 @!@!@ +Finished in 2685ms at (2025-01-19 18:26:33) +@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737301223409/replicated.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307595008/replicated.tla similarity index 82% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737301223409/replicated.tla rename to storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307595008/replicated.tla index 14910364fe..0bd0ed6d91 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737301223409/replicated.tla +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307595008/replicated.tla @@ -1,8 +1,8 @@ ---- MODULE replicated ---- -EXTENDS Integers +EXTENDS Integers, FiniteSets -VARIABLES broker_state, safekeeper_state, pageserver_state +VARIABLES broker_state, safekeeper_state, pageserver_state, online CONSTANT @@ -29,14 +29,21 @@ StateConstraint == InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0] InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] +InitOnline == safekeepers \cup brokers \cup pageservers Init == /\ broker_state = [b \in brokers |-> InitBroker] /\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper] /\ pageserver_state = [p \in pageservers |-> InitPageserver] + /\ online = InitOnline +NodeOnlineOffline == online' = CHOOSE ss \in SUBSET InitOnline: + /\ Cardinality(ss \cap safekeepers) >= 2 + /\ Cardinality(ss \cap brokers) >= 2 + /\ ss \cap pageservers = pageservers \* assume no PS failures for now SkCommit(s1, s2) == + /\ {s1, s2} \subseteq online /\ s1 # s2 /\ safekeeper_state[s1].commit_lsn = safekeeper_state[s2].commit_lsn /\ LET @@ -48,11 +55,13 @@ SkCommit(s1, s2) == /\ UNCHANGED <> SkPeerRecovery(s1,s2) == + /\ {s1, s2} \subseteq online /\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn /\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn] /\ UNCHANGED <> SkPushToBroker(s,b) == + /\ {s, b} \subseteq online /\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn THEN LET @@ -64,6 +73,7 @@ SkPushToBroker(s,b) == /\ UNCHANGED <> PsRecvBroker(b,p,s) == + /\ {b,p,s} \subseteq online /\ LET bsk == broker_state[b].sk[s] psk == pageserver_state[p].sk[s] @@ -76,10 +86,12 @@ PsRecvBroker(b,p,s) == SksWithNewerWal(p) == - LET - ps == pageserver_state[p] - IN - {s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn} + /\ {p} \subseteq online + /\ + LET + ps == pageserver_state[p] + IN + {s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn} PsChooseSk(p) == /\ SksWithNewerWal(p) # {} @@ -88,7 +100,7 @@ PsChooseSk(p) == Next == - + \/ NodeOnlineOffline \/ \E s1 \in safekeepers: \E s2 \in safekeepers: \/ SkCommit(s1, s2) \/ SkPeerRecovery(s1, s2) diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737301223409/MC.cfg b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307621596/MC.cfg similarity index 66% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737301223409/MC.cfg rename to storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307621596/MC.cfg index 1dcac21267..c3df677c50 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737301223409/MC.cfg +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307621596/MC.cfg @@ -19,33 +19,33 @@ az2 = az2 az3 = az3 \* MV CONSTANT definitions CONSTANT -brokers <- const_17373012151752000 +brokers <- const_173730761739711000 \* CONSTANT declarations CONSTANT NULL = NULL \* MV CONSTANT definitions CONSTANT -safekeepers <- const_17373012151763000 +safekeepers <- const_173730761739712000 \* MV CONSTANT definitions CONSTANT -pageservers <- const_17373012151764000 +pageservers <- const_173730761739713000 \* MV CONSTANT definitions CONSTANT -azs <- const_17373012151765000 +azs <- const_173730761739714000 \* SYMMETRY definition -SYMMETRY symm_17373012151766000 +SYMMETRY symm_173730761739715000 \* CONSTANT definitions CONSTANT -max_commit_lsn <- const_17373012151767000 +max_commit_lsn <- const_173730761739716000 \* CONSTANT definitions CONSTANT -az_mapping <- const_17373012151768000 +az_mapping <- const_173730761739717000 \* CONSTRAINT definition CONSTRAINT -constr_17373012151769000 +constr_173730761739718000 \* SPECIFICATION definition SPECIFICATION Spec \* PROPERTY definition PROPERTY EventuallyLaggingSkIsNotPreferredSk -\* Generated on Sun Jan 19 16:40:15 CET 2025 \ No newline at end of file +\* Generated on Sun Jan 19 18:26:57 CET 2025 \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307621596/MC.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307621596/MC.out new file mode 100644 index 0000000000..a6e6eeecc3 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307621596/MC.out @@ -0,0 +1,174 @@ +@!@!@STARTMSG 2262:0 @!@!@ +TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) +@!@!@ENDMSG 2262 @!@!@ +@!@!@STARTMSG 2187:0 @!@!@ +Running breadth-first search Model-Checking with fp 92 and seed -7531418498003009516 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11444] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +@!@!@ENDMSG 2187 @!@!@ +@!@!@STARTMSG 2220:0 @!@!@ +Starting SANY... +@!@!@ENDMSG 2220 @!@!@ +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla +Semantic processing of module Naturals +Semantic processing of module Integers +Semantic processing of module Sequences +Semantic processing of module FiniteSets +Semantic processing of module replicated +Semantic processing of module TLC +Semantic processing of module MC +@!@!@STARTMSG 2219:0 @!@!@ +SANY finished. +@!@!@ENDMSG 2219 @!@!@ +@!@!@STARTMSG 2185:0 @!@!@ +Starting... (2025-01-19 18:26:58) +@!@!@ENDMSG 2185 @!@!@ +@!@!@STARTMSG 2140:3 @!@!@ +The subscript of the next-state relation specified by the specification +does not seem to contain the state variable online +@!@!@ENDMSG 2140 @!@!@ +@!@!@STARTMSG 2279:3 @!@!@ +Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. +@!@!@ENDMSG 2279 @!@!@ +@!@!@STARTMSG 2284:3 @!@!@ +Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. +@!@!@ENDMSG 2284 @!@!@ +@!@!@STARTMSG 2212:0 @!@!@ +Implied-temporal checking--satisfiability problem has 1 branches. +@!@!@ENDMSG 2212 @!@!@ +@!@!@STARTMSG 2189:0 @!@!@ +Computing initial states... +@!@!@ENDMSG 2189 @!@!@ +@!@!@STARTMSG 2190:0 @!@!@ +Finished computing initial states: 1 distinct state generated at 2025-01-19 18:27:00. +@!@!@ENDMSG 2190 @!@!@ +@!@!@STARTMSG 1000:1 @!@!@ +TLC threw an unexpected exception. +This was probably caused by an error in the spec or model. +See the User Output or TLC Console for clues to what happened. +The exception was a java.lang.RuntimeException +: @!@!@STARTMSG 2280:0 @!@!@ +In evaluation, the identifier safekeeper_state is either undefined or not an operator. +line 44, col 24 to line 44, col 39 of module replicated +@!@!@ENDMSG 2280 @!@!@ +@!@!@ENDMSG 1000 @!@!@ +@!@!@STARTMSG 2121:1 @!@!@ +The behavior up to this point is: +@!@!@ENDMSG 2121 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +1: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])]) +/\ online = {b1, b2, b3, s1, s2, s3, p1, p2} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2103:1 @!@!@ +The error occurred when TLC was evaluating the nested +expressions at the following positions: +0. Line 40, column 22 to line 44, column 71 in replicated +1. Line 40, column 32 to line 44, column 71 in replicated +2. Line 41, column 9 to line 44, column 71 in replicated +3. Line 44, column 12 to line 44, column 71 in replicated +4. Line 44, column 22 to line 44, column 71 in replicated +5. Line 44, column 24 to line 44, column 39 in replicated + + +@!@!@ENDMSG 2103 @!@!@ +@!@!@STARTMSG 2201:0 @!@!@ +The coverage statistics at 2025-01-19 18:27:00 +@!@!@ENDMSG 2201 @!@!@ +@!@!@STARTMSG 2773:0 @!@!@ +: 1:1 +@!@!@ENDMSG 2773 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 35, col 5 to line 38, col 26 of module replicated: 1 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 40, col 22 to line 44, col 71 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 40, col 32 to line 44, col 71 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 41, col 9 to line 44, col 71 of module replicated: 464 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 41, col 12 to line 41, col 48 of module replicated: 464 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 42, col 12 to line 42, col 44 of module replicated: 208 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 43, col 12 to line 43, col 44 of module replicated: 86 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 44, col 12 to line 44, col 71 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 40, col 46 to line 40, col 62 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 53, col 13 to line 55, col 50 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 56, col 8 to line 56, col 51 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 61, col 8 to line 61, col 102 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 62, col 8 to line 62, col 51 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 66, col 8 to line 73, col 29 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 74, col 8 to line 74, col 55 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 83, col 13 to line 85, col 37 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 86, col 8 to line 86, col 51 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 99, col 8 to line 99, col 109 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 100, col 8 to line 100, col 51 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2202:0 @!@!@ +End of statistics. +@!@!@ENDMSG 2202 @!@!@ +@!@!@STARTMSG 2200:0 @!@!@ +Progress(1) at 2025-01-19 18:27:00: 1 states generated (24 s/min), 1 distinct states found (24 ds/min), 0 states left on queue. +@!@!@ENDMSG 2200 @!@!@ +@!@!@STARTMSG 2199:0 @!@!@ +1 states generated, 1 distinct states found, 0 states left on queue. +@!@!@ENDMSG 2199 @!@!@ +@!@!@STARTMSG 2186:0 @!@!@ +Finished in 2483ms at (2025-01-19 18:27:00) +@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737301223409/MC.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307621596/MC.tla similarity index 68% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737301223409/MC.tla rename to storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307621596/MC.tla index 316c6f4df7..2e29df8219 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737301223409/MC.tla +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307621596/MC.tla @@ -22,44 +22,44 @@ az1, az2, az3 ---- \* MV CONSTANT definitions brokers -const_17373012151752000 == +const_173730761739711000 == {b1, b2, b3} ---- \* MV CONSTANT definitions safekeepers -const_17373012151763000 == +const_173730761739712000 == {s1, s2, s3} ---- \* MV CONSTANT definitions pageservers -const_17373012151764000 == +const_173730761739713000 == {p1, p2} ---- \* MV CONSTANT definitions azs -const_17373012151765000 == +const_173730761739714000 == {az1, az2, az3} ---- \* SYMMETRY definition -symm_17373012151766000 == -Permutations(const_17373012151752000) \union Permutations(const_17373012151763000) \union Permutations(const_17373012151764000) \union Permutations(const_17373012151765000) +symm_173730761739715000 == +Permutations(const_173730761739711000) \union Permutations(const_173730761739712000) \union Permutations(const_173730761739713000) \union Permutations(const_173730761739714000) ---- \* CONSTANT definitions @modelParameterConstants:4max_commit_lsn -const_17373012151767000 == +const_173730761739716000 == 2 ---- \* CONSTANT definitions @modelParameterConstants:5az_mapping -const_17373012151768000 == +const_173730761739717000 == [ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2,p2} , az3 |-> {b3,s3}] ---- \* CONSTRAINT definition @modelParameterContraint:0 -constr_17373012151769000 == +constr_173730761739718000 == StateConstraint ---- ============================================================================= \* Modification History -\* Created Sun Jan 19 16:40:15 CET 2025 by cs +\* Created Sun Jan 19 18:26:57 CET 2025 by cs diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307621596/MC_TE.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307621596/MC_TE.out new file mode 100644 index 0000000000..a6e6eeecc3 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307621596/MC_TE.out @@ -0,0 +1,174 @@ +@!@!@STARTMSG 2262:0 @!@!@ +TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) +@!@!@ENDMSG 2262 @!@!@ +@!@!@STARTMSG 2187:0 @!@!@ +Running breadth-first search Model-Checking with fp 92 and seed -7531418498003009516 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11444] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +@!@!@ENDMSG 2187 @!@!@ +@!@!@STARTMSG 2220:0 @!@!@ +Starting SANY... +@!@!@ENDMSG 2220 @!@!@ +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla +Semantic processing of module Naturals +Semantic processing of module Integers +Semantic processing of module Sequences +Semantic processing of module FiniteSets +Semantic processing of module replicated +Semantic processing of module TLC +Semantic processing of module MC +@!@!@STARTMSG 2219:0 @!@!@ +SANY finished. +@!@!@ENDMSG 2219 @!@!@ +@!@!@STARTMSG 2185:0 @!@!@ +Starting... (2025-01-19 18:26:58) +@!@!@ENDMSG 2185 @!@!@ +@!@!@STARTMSG 2140:3 @!@!@ +The subscript of the next-state relation specified by the specification +does not seem to contain the state variable online +@!@!@ENDMSG 2140 @!@!@ +@!@!@STARTMSG 2279:3 @!@!@ +Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. +@!@!@ENDMSG 2279 @!@!@ +@!@!@STARTMSG 2284:3 @!@!@ +Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. +@!@!@ENDMSG 2284 @!@!@ +@!@!@STARTMSG 2212:0 @!@!@ +Implied-temporal checking--satisfiability problem has 1 branches. +@!@!@ENDMSG 2212 @!@!@ +@!@!@STARTMSG 2189:0 @!@!@ +Computing initial states... +@!@!@ENDMSG 2189 @!@!@ +@!@!@STARTMSG 2190:0 @!@!@ +Finished computing initial states: 1 distinct state generated at 2025-01-19 18:27:00. +@!@!@ENDMSG 2190 @!@!@ +@!@!@STARTMSG 1000:1 @!@!@ +TLC threw an unexpected exception. +This was probably caused by an error in the spec or model. +See the User Output or TLC Console for clues to what happened. +The exception was a java.lang.RuntimeException +: @!@!@STARTMSG 2280:0 @!@!@ +In evaluation, the identifier safekeeper_state is either undefined or not an operator. +line 44, col 24 to line 44, col 39 of module replicated +@!@!@ENDMSG 2280 @!@!@ +@!@!@ENDMSG 1000 @!@!@ +@!@!@STARTMSG 2121:1 @!@!@ +The behavior up to this point is: +@!@!@ENDMSG 2121 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +1: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])]) +/\ online = {b1, b2, b3, s1, s2, s3, p1, p2} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2103:1 @!@!@ +The error occurred when TLC was evaluating the nested +expressions at the following positions: +0. Line 40, column 22 to line 44, column 71 in replicated +1. Line 40, column 32 to line 44, column 71 in replicated +2. Line 41, column 9 to line 44, column 71 in replicated +3. Line 44, column 12 to line 44, column 71 in replicated +4. Line 44, column 22 to line 44, column 71 in replicated +5. Line 44, column 24 to line 44, column 39 in replicated + + +@!@!@ENDMSG 2103 @!@!@ +@!@!@STARTMSG 2201:0 @!@!@ +The coverage statistics at 2025-01-19 18:27:00 +@!@!@ENDMSG 2201 @!@!@ +@!@!@STARTMSG 2773:0 @!@!@ +: 1:1 +@!@!@ENDMSG 2773 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 35, col 5 to line 38, col 26 of module replicated: 1 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 40, col 22 to line 44, col 71 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 40, col 32 to line 44, col 71 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 41, col 9 to line 44, col 71 of module replicated: 464 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 41, col 12 to line 41, col 48 of module replicated: 464 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 42, col 12 to line 42, col 44 of module replicated: 208 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 43, col 12 to line 43, col 44 of module replicated: 86 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 44, col 12 to line 44, col 71 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 40, col 46 to line 40, col 62 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 53, col 13 to line 55, col 50 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 56, col 8 to line 56, col 51 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 61, col 8 to line 61, col 102 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 62, col 8 to line 62, col 51 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 66, col 8 to line 73, col 29 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 74, col 8 to line 74, col 55 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 83, col 13 to line 85, col 37 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 86, col 8 to line 86, col 51 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 99, col 8 to line 99, col 109 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 100, col 8 to line 100, col 51 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2202:0 @!@!@ +End of statistics. +@!@!@ENDMSG 2202 @!@!@ +@!@!@STARTMSG 2200:0 @!@!@ +Progress(1) at 2025-01-19 18:27:00: 1 states generated (24 s/min), 1 distinct states found (24 ds/min), 0 states left on queue. +@!@!@ENDMSG 2200 @!@!@ +@!@!@STARTMSG 2199:0 @!@!@ +1 states generated, 1 distinct states found, 0 states left on queue. +@!@!@ENDMSG 2199 @!@!@ +@!@!@STARTMSG 2186:0 @!@!@ +Finished in 2483ms at (2025-01-19 18:27:00) +@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737301172627/replicated.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307621596/replicated.tla similarity index 81% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737301172627/replicated.tla rename to storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307621596/replicated.tla index 14910364fe..2b7501f8a1 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737301172627/replicated.tla +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307621596/replicated.tla @@ -1,8 +1,8 @@ ---- MODULE replicated ---- -EXTENDS Integers +EXTENDS Integers, FiniteSets -VARIABLES broker_state, safekeeper_state, pageserver_state +VARIABLES broker_state, safekeeper_state, pageserver_state, online CONSTANT @@ -29,14 +29,22 @@ StateConstraint == InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0] InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] +InitOnline == safekeepers \cup brokers \cup pageservers Init == /\ broker_state = [b \in brokers |-> InitBroker] /\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper] /\ pageserver_state = [p \in pageservers |-> InitPageserver] + /\ online = InitOnline +NodeOnlineOffline == online' = CHOOSE ss \in SUBSET InitOnline: + /\ Cardinality(ss \cap safekeepers) >= 2 + /\ Cardinality(ss \cap brokers) >= 2 + /\ ss \cap pageservers = pageservers \* assume no PS failures for now + /\ UNCHANGED <> SkCommit(s1, s2) == + /\ {s1, s2} \subseteq online /\ s1 # s2 /\ safekeeper_state[s1].commit_lsn = safekeeper_state[s2].commit_lsn /\ LET @@ -48,11 +56,13 @@ SkCommit(s1, s2) == /\ UNCHANGED <> SkPeerRecovery(s1,s2) == + /\ {s1, s2} \subseteq online /\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn /\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn] /\ UNCHANGED <> SkPushToBroker(s,b) == + /\ {s, b} \subseteq online /\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn THEN LET @@ -64,6 +74,7 @@ SkPushToBroker(s,b) == /\ UNCHANGED <> PsRecvBroker(b,p,s) == + /\ {b,p,s} \subseteq online /\ LET bsk == broker_state[b].sk[s] psk == pageserver_state[p].sk[s] @@ -76,10 +87,12 @@ PsRecvBroker(b,p,s) == SksWithNewerWal(p) == - LET - ps == pageserver_state[p] - IN - {s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn} + /\ {p} \subseteq online + /\ + LET + ps == pageserver_state[p] + IN + {s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn} PsChooseSk(p) == /\ SksWithNewerWal(p) # {} @@ -88,7 +101,7 @@ PsChooseSk(p) == Next == - + \/ NodeOnlineOffline \/ \E s1 \in safekeepers: \E s2 \in safekeepers: \/ SkCommit(s1, s2) \/ SkPeerRecovery(s1, s2) diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299469039/MC.cfg b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307660221/MC.cfg similarity index 66% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299469039/MC.cfg rename to storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307660221/MC.cfg index 3de9dad2e7..d73d7b9017 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299469039/MC.cfg +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307660221/MC.cfg @@ -19,33 +19,33 @@ az2 = az2 az3 = az3 \* MV CONSTANT definitions CONSTANT -brokers <- const_1737299464992221000 +brokers <- const_173730765610820000 \* CONSTANT declarations CONSTANT NULL = NULL \* MV CONSTANT definitions CONSTANT -safekeepers <- const_1737299464992222000 +safekeepers <- const_173730765610821000 \* MV CONSTANT definitions CONSTANT -pageservers <- const_1737299464992223000 +pageservers <- const_173730765610822000 \* MV CONSTANT definitions CONSTANT -azs <- const_1737299464992224000 +azs <- const_173730765610823000 \* SYMMETRY definition -SYMMETRY symm_1737299464992225000 +SYMMETRY symm_173730765610824000 \* CONSTANT definitions CONSTANT -max_commit_lsn <- const_1737299464992226000 +max_commit_lsn <- const_173730765610825000 \* CONSTANT definitions CONSTANT -az_mapping <- const_1737299464992227000 +az_mapping <- const_173730765610826000 \* CONSTRAINT definition CONSTRAINT -constr_1737299464992228000 +constr_173730765610827000 \* SPECIFICATION definition SPECIFICATION Spec \* PROPERTY definition PROPERTY EventuallyLaggingSkIsNotPreferredSk -\* Generated on Sun Jan 19 16:11:04 CET 2025 \ No newline at end of file +\* Generated on Sun Jan 19 18:27:36 CET 2025 \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299381423/MC.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307660221/MC.out similarity index 58% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299381423/MC.out rename to storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307660221/MC.out index 7760635dfb..43fc616158 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299381423/MC.out +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307660221/MC.out @@ -2,31 +2,35 @@ TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) @!@!@ENDMSG 2262 @!@!@ @!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 3 and seed -7432767478319300652 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 7681] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +Running breadth-first search Model-Checking with fp 70 and seed -383534902230932382 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11483] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). @!@!@ENDMSG 2187 @!@!@ @!@!@STARTMSG 2220:0 @!@!@ Starting SANY... @!@!@ENDMSG 2220 @!@!@ -Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/MC.tla -Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/fullmesh.tla +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla Semantic processing of module Naturals Semantic processing of module Integers -Semantic processing of module fullmesh Semantic processing of module Sequences Semantic processing of module FiniteSets +Semantic processing of module replicated Semantic processing of module TLC Semantic processing of module MC @!@!@STARTMSG 2219:0 @!@!@ SANY finished. @!@!@ENDMSG 2219 @!@!@ @!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 16:09:38) +Starting... (2025-01-19 18:27:37) @!@!@ENDMSG 2185 @!@!@ +@!@!@STARTMSG 2140:3 @!@!@ +The subscript of the next-state relation specified by the specification +does not seem to contain the state variable online +@!@!@ENDMSG 2140 @!@!@ @!@!@STARTMSG 2279:3 @!@!@ Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. @!@!@ENDMSG 2279 @!@!@ @@ -40,10 +44,10 @@ Implied-temporal checking--satisfiability problem has 1 branches. Computing initial states... @!@!@ENDMSG 2189 @!@!@ @!@!@STARTMSG 2190:0 @!@!@ -Finished computing initial states: 1 distinct state generated at 2025-01-19 16:09:40. +Finished computing initial states: 1 distinct state generated at 2025-01-19 18:27:38. @!@!@ENDMSG 2190 @!@!@ @!@!@STARTMSG 2109:1 @!@!@ -Successor state is not completely specified by action SkPeerRecovery of the next-state relation. The following variables are not assigned: broker_state, pageserver_state. +Successor state is not completely specified by action SkCommit of the next-state relation. The following variable is not assigned: online. @!@!@ENDMSG 2109 @!@!@ @!@!@STARTMSG 2121:1 @!@!@ @@ -53,134 +57,147 @@ The behavior up to this point is: 1: /\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) /\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])]) +/\ online = {b1, b2, b3, s1, s2, s3, p1, p2} /\ safekeeper_state = (s1 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0]) @!@!@ENDMSG 2217 @!@!@ @!@!@STARTMSG 2217:4 @!@!@ -2: +2: /\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) /\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])]) -/\ safekeeper_state = (s1 :> [commit_lsn |-> 1, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0]) - -@!@!@ENDMSG 2217 @!@!@ -@!@!@STARTMSG 2217:4 @!@!@ -3: -/\ pageserver_state = null -/\ broker_state = null +/\ online = null /\ safekeeper_state = (s1 :> [commit_lsn |-> 1, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 1, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0]) @!@!@ENDMSG 2217 @!@!@ @!@!@STARTMSG 2201:0 @!@!@ -The coverage statistics at 2025-01-19 16:09:40 +The coverage statistics at 2025-01-19 18:27:38 @!@!@ENDMSG 2201 @!@!@ @!@!@STARTMSG 2773:0 @!@!@ -: 2:2 +: 1:1 @!@!@ENDMSG 2773 @!@!@ @!@!@STARTMSG 2221:0 @!@!@ - line 34, col 5 to line 36, col 64 of module fullmesh: 2 + line 35, col 5 to line 38, col 26 of module replicated: 1 @!@!@ENDMSG 2221 @!@!@ @!@!@STARTMSG 2772:0 @!@!@ -: 5:17 +: 1:3 @!@!@ENDMSG 2772 @!@!@ @!@!@STARTMSG 2221:0 @!@!@ - line 40, col 8 to line 40, col 72 of module fullmesh: 46 + line 41, col 8 to line 44, col 44 of module replicated: 3 @!@!@ENDMSG 2221 @!@!@ @!@!@STARTMSG 2221:0 @!@!@ - |line 40, col 8 to line 40, col 38 of module fullmesh: 29 + |line 41, col 18 to line 44, col 44 of module replicated: 3 @!@!@ENDMSG 2221 @!@!@ @!@!@STARTMSG 2221:0 @!@!@ - |line 40, col 42 to line 40, col 72 of module fullmesh: 29 + ||line 42, col 9 to line 44, col 44 of module replicated: 696 @!@!@ENDMSG 2221 @!@!@ @!@!@STARTMSG 2221:0 @!@!@ - line 44, col 13 to line 46, col 50 of module fullmesh: 17 + |||line 42, col 12 to line 42, col 48 of module replicated: 696 @!@!@ENDMSG 2221 @!@!@ @!@!@STARTMSG 2221:0 @!@!@ - line 47, col 8 to line 47, col 51 of module fullmesh: 17 + |||line 43, col 12 to line 43, col 44 of module replicated: 312 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 44, col 12 to line 44, col 44 of module replicated: 129 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 41, col 32 to line 41, col 48 of module replicated: 3 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 45, col 8 to line 45, col 67 of module replicated: 3 @!@!@ENDMSG 2221 @!@!@ @!@!@STARTMSG 2772:0 @!@!@ -: 0:4 +: 0:3 @!@!@ENDMSG 2772 @!@!@ @!@!@STARTMSG 2221:0 @!@!@ - line 50, col 8 to line 50, col 72 of module fullmesh: 1 + line 48, col 8 to line 48, col 32 of module replicated: 7 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 48, col 8 to line 48, col 15 of module replicated: 6:15 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 48, col 27 to line 48, col 32 of module replicated: 6 @!@!@ENDMSG 2221 @!@!@ @!@!@STARTMSG 2221:0 @!@!@ - |line 50, col 8 to line 50, col 38 of module fullmesh: 28 + line 49, col 8 to line 49, col 14 of module replicated: 7 @!@!@ENDMSG 2221 @!@!@ @!@!@STARTMSG 2221:0 @!@!@ - |line 50, col 42 to line 50, col 72 of module fullmesh: 28 + |line 49, col 8 to line 49, col 9 of module replicated: 6 @!@!@ENDMSG 2221 @!@!@ @!@!@STARTMSG 2221:0 @!@!@ - line 51, col 8 to line 51, col 102 of module fullmesh: 1 + |line 49, col 13 to line 49, col 14 of module replicated: 6 @!@!@ENDMSG 2221 @!@!@ @!@!@STARTMSG 2221:0 @!@!@ - |line 51, col 28 to line 51, col 102 of module fullmesh: 4 + line 50, col 8 to line 50, col 72 of module replicated: 4 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 50, col 8 to line 50, col 38 of module replicated: 3 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 50, col 42 to line 50, col 72 of module replicated: 3 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 54, col 13 to line 56, col 50 of module replicated: 1 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 54, col 33 to line 56, col 50 of module replicated: 3 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 57, col 8 to line 57, col 51 of module replicated: 1 @!@!@ENDMSG 2221 @!@!@ @!@!@STARTMSG 2772:0 @!@!@ -: 0:9 +: 0:0 @!@!@ENDMSG 2772 @!@!@ @!@!@STARTMSG 2221:0 @!@!@ - line 54, col 8 to line 61, col 29 of module fullmesh: 9 + line 60, col 8 to line 60, col 32 of module replicated: 3 @!@!@ENDMSG 2221 @!@!@ @!@!@STARTMSG 2221:0 @!@!@ - line 62, col 8 to line 62, col 55 of module fullmesh: 9 + line 61, col 8 to line 61, col 72 of module replicated: 3 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 62, col 8 to line 62, col 102 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 63, col 8 to line 63, col 51 of module replicated: 0 @!@!@ENDMSG 2221 @!@!@ @!@!@STARTMSG 2772:0 @!@!@ -: 0:18 +: 0:0 @!@!@ENDMSG 2772 @!@!@ @!@!@STARTMSG 2221:0 @!@!@ - line 70, col 13 to line 72, col 37 of module fullmesh: 18 + line 67, col 8 to line 74, col 29 of module replicated: 0 @!@!@ENDMSG 2221 @!@!@ @!@!@STARTMSG 2221:0 @!@!@ - line 73, col 8 to line 73, col 51 of module fullmesh: 18 + line 75, col 8 to line 75, col 55 of module replicated: 0 @!@!@ENDMSG 2221 @!@!@ @!@!@STARTMSG 2772:0 @!@!@ -: 0:0 +: 0:0 @!@!@ENDMSG 2772 @!@!@ @!@!@STARTMSG 2221:0 @!@!@ - line 83, col 8 to line 83, col 30 of module fullmesh: 2 + line 84, col 13 to line 86, col 37 of module replicated: 0 @!@!@ENDMSG 2221 @!@!@ @!@!@STARTMSG 2221:0 @!@!@ - |line 83, col 8 to line 83, col 25 of module fullmesh: 2 + line 87, col 8 to line 87, col 51 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 100, col 8 to line 100, col 109 of module replicated: 0 @!@!@ENDMSG 2221 @!@!@ @!@!@STARTMSG 2221:0 @!@!@ - ||line 78, col 15 to line 78, col 33 of module fullmesh: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 80, col 5 to line 80, col 66 of module fullmesh: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 80, col 26 to line 80, col 65 of module fullmesh: 6 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 80, col 12 to line 80, col 23 of module fullmesh: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 83, col 24 to line 83, col 24 of module fullmesh: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 83, col 29 to line 83, col 30 of module fullmesh: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 84, col 8 to line 84, col 109 of module fullmesh: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 85, col 8 to line 85, col 51 of module fullmesh: 0 + line 101, col 8 to line 101, col 51 of module replicated: 0 @!@!@ENDMSG 2221 @!@!@ @!@!@STARTMSG 2202:0 @!@!@ End of statistics. @!@!@ENDMSG 2202 @!@!@ @!@!@STARTMSG 2200:0 @!@!@ -Progress(3) at 2025-01-19 16:09:40: 46 states generated (1.044 s/min), 6 distinct states found (136 ds/min), 2 states left on queue. +Progress(2) at 2025-01-19 18:27:38: 5 states generated (121 s/min), 2 distinct states found (48 ds/min), 0 states left on queue. @!@!@ENDMSG 2200 @!@!@ @!@!@STARTMSG 2199:0 @!@!@ -46 states generated, 6 distinct states found, 2 states left on queue. +5 states generated, 2 distinct states found, 0 states left on queue. @!@!@ENDMSG 2199 @!@!@ @!@!@STARTMSG 2194:0 @!@!@ -The depth of the complete state graph search is 3. +The depth of the complete state graph search is 2. @!@!@ENDMSG 2194 @!@!@ -@!@!@STARTMSG 2268:0 @!@!@ -The average outdegree of the complete state graph is 2 (minimum is 2, the maximum 2 and the 95th percentile is 2). -@!@!@ENDMSG 2268 @!@!@ @!@!@STARTMSG 2186:0 @!@!@ -Finished in 2658ms at (2025-01-19 16:09:40) +Finished in 2493ms at (2025-01-19 18:27:38) @!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737297534393/MC.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307660221/MC.tla similarity index 66% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737297534393/MC.tla rename to storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307660221/MC.tla index ec7157637f..c30666e0ea 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737297534393/MC.tla +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307660221/MC.tla @@ -1,5 +1,5 @@ ---- MODULE MC ---- -EXTENDS fullmesh, TLC +EXTENDS replicated, TLC \* MV CONSTANT declarations@modelParameterConstants CONSTANTS @@ -22,44 +22,44 @@ az1, az2, az3 ---- \* MV CONSTANT definitions brokers -const_1737297530693169000 == +const_173730765610820000 == {b1, b2, b3} ---- \* MV CONSTANT definitions safekeepers -const_1737297530694170000 == +const_173730765610821000 == {s1, s2, s3} ---- \* MV CONSTANT definitions pageservers -const_1737297530694171000 == +const_173730765610822000 == {p1, p2} ---- \* MV CONSTANT definitions azs -const_1737297530694172000 == +const_173730765610823000 == {az1, az2, az3} ---- \* SYMMETRY definition -symm_1737297530694173000 == -Permutations(const_1737297530693169000) \union Permutations(const_1737297530694170000) \union Permutations(const_1737297530694171000) \union Permutations(const_1737297530694172000) +symm_173730765610824000 == +Permutations(const_173730765610820000) \union Permutations(const_173730765610821000) \union Permutations(const_173730765610822000) \union Permutations(const_173730765610823000) ---- \* CONSTANT definitions @modelParameterConstants:4max_commit_lsn -const_1737297530694174000 == +const_173730765610825000 == 2 ---- \* CONSTANT definitions @modelParameterConstants:5az_mapping -const_1737297530694175000 == +const_173730765610826000 == [ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2,p2} , az3 |-> {b3,s3}] ---- \* CONSTRAINT definition @modelParameterContraint:0 -constr_1737297530694176000 == +constr_173730765610827000 == StateConstraint ---- ============================================================================= \* Modification History -\* Created Sun Jan 19 15:38:50 CET 2025 by cs +\* Created Sun Jan 19 18:27:36 CET 2025 by cs diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299381423/MC_TE.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307660221/MC_TE.out similarity index 58% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299381423/MC_TE.out rename to storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307660221/MC_TE.out index 7760635dfb..43fc616158 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299381423/MC_TE.out +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307660221/MC_TE.out @@ -2,31 +2,35 @@ TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) @!@!@ENDMSG 2262 @!@!@ @!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 3 and seed -7432767478319300652 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 7681] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +Running breadth-first search Model-Checking with fp 70 and seed -383534902230932382 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11483] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). @!@!@ENDMSG 2187 @!@!@ @!@!@STARTMSG 2220:0 @!@!@ Starting SANY... @!@!@ENDMSG 2220 @!@!@ -Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/MC.tla -Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/fullmesh.tla +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla Semantic processing of module Naturals Semantic processing of module Integers -Semantic processing of module fullmesh Semantic processing of module Sequences Semantic processing of module FiniteSets +Semantic processing of module replicated Semantic processing of module TLC Semantic processing of module MC @!@!@STARTMSG 2219:0 @!@!@ SANY finished. @!@!@ENDMSG 2219 @!@!@ @!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 16:09:38) +Starting... (2025-01-19 18:27:37) @!@!@ENDMSG 2185 @!@!@ +@!@!@STARTMSG 2140:3 @!@!@ +The subscript of the next-state relation specified by the specification +does not seem to contain the state variable online +@!@!@ENDMSG 2140 @!@!@ @!@!@STARTMSG 2279:3 @!@!@ Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. @!@!@ENDMSG 2279 @!@!@ @@ -40,10 +44,10 @@ Implied-temporal checking--satisfiability problem has 1 branches. Computing initial states... @!@!@ENDMSG 2189 @!@!@ @!@!@STARTMSG 2190:0 @!@!@ -Finished computing initial states: 1 distinct state generated at 2025-01-19 16:09:40. +Finished computing initial states: 1 distinct state generated at 2025-01-19 18:27:38. @!@!@ENDMSG 2190 @!@!@ @!@!@STARTMSG 2109:1 @!@!@ -Successor state is not completely specified by action SkPeerRecovery of the next-state relation. The following variables are not assigned: broker_state, pageserver_state. +Successor state is not completely specified by action SkCommit of the next-state relation. The following variable is not assigned: online. @!@!@ENDMSG 2109 @!@!@ @!@!@STARTMSG 2121:1 @!@!@ @@ -53,134 +57,147 @@ The behavior up to this point is: 1: /\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) /\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])]) +/\ online = {b1, b2, b3, s1, s2, s3, p1, p2} /\ safekeeper_state = (s1 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0]) @!@!@ENDMSG 2217 @!@!@ @!@!@STARTMSG 2217:4 @!@!@ -2: +2: /\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) /\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])]) -/\ safekeeper_state = (s1 :> [commit_lsn |-> 1, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0]) - -@!@!@ENDMSG 2217 @!@!@ -@!@!@STARTMSG 2217:4 @!@!@ -3: -/\ pageserver_state = null -/\ broker_state = null +/\ online = null /\ safekeeper_state = (s1 :> [commit_lsn |-> 1, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 1, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0]) @!@!@ENDMSG 2217 @!@!@ @!@!@STARTMSG 2201:0 @!@!@ -The coverage statistics at 2025-01-19 16:09:40 +The coverage statistics at 2025-01-19 18:27:38 @!@!@ENDMSG 2201 @!@!@ @!@!@STARTMSG 2773:0 @!@!@ -: 2:2 +: 1:1 @!@!@ENDMSG 2773 @!@!@ @!@!@STARTMSG 2221:0 @!@!@ - line 34, col 5 to line 36, col 64 of module fullmesh: 2 + line 35, col 5 to line 38, col 26 of module replicated: 1 @!@!@ENDMSG 2221 @!@!@ @!@!@STARTMSG 2772:0 @!@!@ -: 5:17 +: 1:3 @!@!@ENDMSG 2772 @!@!@ @!@!@STARTMSG 2221:0 @!@!@ - line 40, col 8 to line 40, col 72 of module fullmesh: 46 + line 41, col 8 to line 44, col 44 of module replicated: 3 @!@!@ENDMSG 2221 @!@!@ @!@!@STARTMSG 2221:0 @!@!@ - |line 40, col 8 to line 40, col 38 of module fullmesh: 29 + |line 41, col 18 to line 44, col 44 of module replicated: 3 @!@!@ENDMSG 2221 @!@!@ @!@!@STARTMSG 2221:0 @!@!@ - |line 40, col 42 to line 40, col 72 of module fullmesh: 29 + ||line 42, col 9 to line 44, col 44 of module replicated: 696 @!@!@ENDMSG 2221 @!@!@ @!@!@STARTMSG 2221:0 @!@!@ - line 44, col 13 to line 46, col 50 of module fullmesh: 17 + |||line 42, col 12 to line 42, col 48 of module replicated: 696 @!@!@ENDMSG 2221 @!@!@ @!@!@STARTMSG 2221:0 @!@!@ - line 47, col 8 to line 47, col 51 of module fullmesh: 17 + |||line 43, col 12 to line 43, col 44 of module replicated: 312 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 44, col 12 to line 44, col 44 of module replicated: 129 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 41, col 32 to line 41, col 48 of module replicated: 3 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 45, col 8 to line 45, col 67 of module replicated: 3 @!@!@ENDMSG 2221 @!@!@ @!@!@STARTMSG 2772:0 @!@!@ -: 0:4 +: 0:3 @!@!@ENDMSG 2772 @!@!@ @!@!@STARTMSG 2221:0 @!@!@ - line 50, col 8 to line 50, col 72 of module fullmesh: 1 + line 48, col 8 to line 48, col 32 of module replicated: 7 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 48, col 8 to line 48, col 15 of module replicated: 6:15 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 48, col 27 to line 48, col 32 of module replicated: 6 @!@!@ENDMSG 2221 @!@!@ @!@!@STARTMSG 2221:0 @!@!@ - |line 50, col 8 to line 50, col 38 of module fullmesh: 28 + line 49, col 8 to line 49, col 14 of module replicated: 7 @!@!@ENDMSG 2221 @!@!@ @!@!@STARTMSG 2221:0 @!@!@ - |line 50, col 42 to line 50, col 72 of module fullmesh: 28 + |line 49, col 8 to line 49, col 9 of module replicated: 6 @!@!@ENDMSG 2221 @!@!@ @!@!@STARTMSG 2221:0 @!@!@ - line 51, col 8 to line 51, col 102 of module fullmesh: 1 + |line 49, col 13 to line 49, col 14 of module replicated: 6 @!@!@ENDMSG 2221 @!@!@ @!@!@STARTMSG 2221:0 @!@!@ - |line 51, col 28 to line 51, col 102 of module fullmesh: 4 + line 50, col 8 to line 50, col 72 of module replicated: 4 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 50, col 8 to line 50, col 38 of module replicated: 3 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 50, col 42 to line 50, col 72 of module replicated: 3 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 54, col 13 to line 56, col 50 of module replicated: 1 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 54, col 33 to line 56, col 50 of module replicated: 3 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 57, col 8 to line 57, col 51 of module replicated: 1 @!@!@ENDMSG 2221 @!@!@ @!@!@STARTMSG 2772:0 @!@!@ -: 0:9 +: 0:0 @!@!@ENDMSG 2772 @!@!@ @!@!@STARTMSG 2221:0 @!@!@ - line 54, col 8 to line 61, col 29 of module fullmesh: 9 + line 60, col 8 to line 60, col 32 of module replicated: 3 @!@!@ENDMSG 2221 @!@!@ @!@!@STARTMSG 2221:0 @!@!@ - line 62, col 8 to line 62, col 55 of module fullmesh: 9 + line 61, col 8 to line 61, col 72 of module replicated: 3 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 62, col 8 to line 62, col 102 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 63, col 8 to line 63, col 51 of module replicated: 0 @!@!@ENDMSG 2221 @!@!@ @!@!@STARTMSG 2772:0 @!@!@ -: 0:18 +: 0:0 @!@!@ENDMSG 2772 @!@!@ @!@!@STARTMSG 2221:0 @!@!@ - line 70, col 13 to line 72, col 37 of module fullmesh: 18 + line 67, col 8 to line 74, col 29 of module replicated: 0 @!@!@ENDMSG 2221 @!@!@ @!@!@STARTMSG 2221:0 @!@!@ - line 73, col 8 to line 73, col 51 of module fullmesh: 18 + line 75, col 8 to line 75, col 55 of module replicated: 0 @!@!@ENDMSG 2221 @!@!@ @!@!@STARTMSG 2772:0 @!@!@ -: 0:0 +: 0:0 @!@!@ENDMSG 2772 @!@!@ @!@!@STARTMSG 2221:0 @!@!@ - line 83, col 8 to line 83, col 30 of module fullmesh: 2 + line 84, col 13 to line 86, col 37 of module replicated: 0 @!@!@ENDMSG 2221 @!@!@ @!@!@STARTMSG 2221:0 @!@!@ - |line 83, col 8 to line 83, col 25 of module fullmesh: 2 + line 87, col 8 to line 87, col 51 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 100, col 8 to line 100, col 109 of module replicated: 0 @!@!@ENDMSG 2221 @!@!@ @!@!@STARTMSG 2221:0 @!@!@ - ||line 78, col 15 to line 78, col 33 of module fullmesh: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 80, col 5 to line 80, col 66 of module fullmesh: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 80, col 26 to line 80, col 65 of module fullmesh: 6 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 80, col 12 to line 80, col 23 of module fullmesh: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 83, col 24 to line 83, col 24 of module fullmesh: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 83, col 29 to line 83, col 30 of module fullmesh: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 84, col 8 to line 84, col 109 of module fullmesh: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 85, col 8 to line 85, col 51 of module fullmesh: 0 + line 101, col 8 to line 101, col 51 of module replicated: 0 @!@!@ENDMSG 2221 @!@!@ @!@!@STARTMSG 2202:0 @!@!@ End of statistics. @!@!@ENDMSG 2202 @!@!@ @!@!@STARTMSG 2200:0 @!@!@ -Progress(3) at 2025-01-19 16:09:40: 46 states generated (1.044 s/min), 6 distinct states found (136 ds/min), 2 states left on queue. +Progress(2) at 2025-01-19 18:27:38: 5 states generated (121 s/min), 2 distinct states found (48 ds/min), 0 states left on queue. @!@!@ENDMSG 2200 @!@!@ @!@!@STARTMSG 2199:0 @!@!@ -46 states generated, 6 distinct states found, 2 states left on queue. +5 states generated, 2 distinct states found, 0 states left on queue. @!@!@ENDMSG 2199 @!@!@ @!@!@STARTMSG 2194:0 @!@!@ -The depth of the complete state graph search is 3. +The depth of the complete state graph search is 2. @!@!@ENDMSG 2194 @!@!@ -@!@!@STARTMSG 2268:0 @!@!@ -The average outdegree of the complete state graph is 2 (minimum is 2, the maximum 2 and the 95th percentile is 2). -@!@!@ENDMSG 2268 @!@!@ @!@!@STARTMSG 2186:0 @!@!@ -Finished in 2658ms at (2025-01-19 16:09:40) +Finished in 2493ms at (2025-01-19 18:27:38) @!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299744229/fullmesh.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307660221/replicated.tla similarity index 80% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299744229/fullmesh.tla rename to storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307660221/replicated.tla index b010e35f80..861110267e 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299744229/fullmesh.tla +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307660221/replicated.tla @@ -1,8 +1,8 @@ ----- MODULE fullmesh ---- +---- MODULE replicated ---- -EXTENDS Integers +EXTENDS Integers, FiniteSets -VARIABLES broker_state, safekeeper_state, pageserver_state +VARIABLES broker_state, safekeeper_state, pageserver_state, online CONSTANT @@ -29,14 +29,23 @@ StateConstraint == InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0] InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] +InitOnline == safekeepers \cup brokers \cup pageservers Init == /\ broker_state = [b \in brokers |-> InitBroker] /\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper] /\ pageserver_state = [p \in pageservers |-> InitPageserver] + /\ online = InitOnline +NodeOnlineOffline == + /\ online' = CHOOSE ss \in SUBSET InitOnline: + /\ Cardinality(ss \cap safekeepers) >= 2 + /\ Cardinality(ss \cap brokers) >= 2 + /\ ss \cap pageservers = pageservers \* assume no PS failures for now + /\ UNCHANGED <> SkCommit(s1, s2) == + /\ {s1, s2} \subseteq online /\ s1 # s2 /\ safekeeper_state[s1].commit_lsn = safekeeper_state[s2].commit_lsn /\ LET @@ -48,11 +57,13 @@ SkCommit(s1, s2) == /\ UNCHANGED <> SkPeerRecovery(s1,s2) == + /\ {s1, s2} \subseteq online /\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn /\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn] /\ UNCHANGED <> SkPushToBroker(s,b) == + /\ {s, b} \subseteq online /\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn THEN LET @@ -64,6 +75,7 @@ SkPushToBroker(s,b) == /\ UNCHANGED <> PsRecvBroker(b,p,s) == + /\ {b,p,s} \subseteq online /\ LET bsk == broker_state[b].sk[s] psk == pageserver_state[p].sk[s] @@ -76,10 +88,12 @@ PsRecvBroker(b,p,s) == SksWithNewerWal(p) == - LET - ps == pageserver_state[p] - IN - {s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn} + /\ {p} \subseteq online + /\ + LET + ps == pageserver_state[p] + IN + {s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn} PsChooseSk(p) == /\ SksWithNewerWal(p) # {} @@ -88,7 +102,7 @@ PsChooseSk(p) == Next == - + \/ NodeOnlineOffline \/ \E s1 \in safekeepers: \E s2 \in safekeepers: \/ SkCommit(s1, s2) \/ SkPeerRecovery(s1, s2) diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299542008/MC.cfg b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307704621/MC.cfg similarity index 66% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299542008/MC.cfg rename to storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307704621/MC.cfg index 85f59f2a5a..17ae6b83c8 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299542008/MC.cfg +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307704621/MC.cfg @@ -19,33 +19,33 @@ az2 = az2 az3 = az3 \* MV CONSTANT definitions CONSTANT -brokers <- const_1737299528165230000 +brokers <- const_173730770045629000 \* CONSTANT declarations CONSTANT NULL = NULL \* MV CONSTANT definitions CONSTANT -safekeepers <- const_1737299528166231000 +safekeepers <- const_173730770045630000 \* MV CONSTANT definitions CONSTANT -pageservers <- const_1737299528166232000 +pageservers <- const_173730770045731000 \* MV CONSTANT definitions CONSTANT -azs <- const_1737299528166233000 +azs <- const_173730770045732000 \* SYMMETRY definition -SYMMETRY symm_1737299528166234000 +SYMMETRY symm_173730770045733000 \* CONSTANT definitions CONSTANT -max_commit_lsn <- const_1737299528166235000 +max_commit_lsn <- const_173730770045734000 \* CONSTANT definitions CONSTANT -az_mapping <- const_1737299528166236000 +az_mapping <- const_173730770045735000 \* CONSTRAINT definition CONSTRAINT -constr_1737299528166237000 +constr_173730770045736000 \* SPECIFICATION definition SPECIFICATION Spec \* PROPERTY definition PROPERTY EventuallyLaggingSkIsNotPreferredSk -\* Generated on Sun Jan 19 16:12:08 CET 2025 \ No newline at end of file +\* Generated on Sun Jan 19 18:28:20 CET 2025 \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307704621/MC.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307704621/MC.out new file mode 100644 index 0000000000..2e22ced64d --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307704621/MC.out @@ -0,0 +1,282 @@ +@!@!@STARTMSG 2262:0 @!@!@ +TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) +@!@!@ENDMSG 2262 @!@!@ +@!@!@STARTMSG 2187:0 @!@!@ +Running breadth-first search Model-Checking with fp 128 and seed -4991617861993001241 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11510] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +@!@!@ENDMSG 2187 @!@!@ +@!@!@STARTMSG 2220:0 @!@!@ +Starting SANY... +@!@!@ENDMSG 2220 @!@!@ +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla +Semantic processing of module Naturals +Semantic processing of module Integers +Semantic processing of module Sequences +Semantic processing of module FiniteSets +Semantic processing of module replicated +Semantic processing of module TLC +Semantic processing of module MC +@!@!@STARTMSG 2219:0 @!@!@ +SANY finished. +@!@!@ENDMSG 2219 @!@!@ +@!@!@STARTMSG 2185:0 @!@!@ +Starting... (2025-01-19 18:28:21) +@!@!@ENDMSG 2185 @!@!@ +@!@!@STARTMSG 2279:3 @!@!@ +Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. +@!@!@ENDMSG 2279 @!@!@ +@!@!@STARTMSG 2284:3 @!@!@ +Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. +@!@!@ENDMSG 2284 @!@!@ +@!@!@STARTMSG 2212:0 @!@!@ +Implied-temporal checking--satisfiability problem has 1 branches. +@!@!@ENDMSG 2212 @!@!@ +@!@!@STARTMSG 2189:0 @!@!@ +Computing initial states... +@!@!@ENDMSG 2189 @!@!@ +@!@!@STARTMSG 2190:0 @!@!@ +Finished computing initial states: 1 distinct state generated at 2025-01-19 18:28:23. +@!@!@ENDMSG 2190 @!@!@ +@!@!@STARTMSG 1000:1 @!@!@ +TLC threw an unexpected exception. +This was probably caused by an error in the spec or model. +See the User Output or TLC Console for clues to what happened. +The exception was a java.lang.RuntimeException +: A non-boolean expression (a set of the form {e1, ... ,eN}) was used as a formula in a conjunction. +line 93, col 9 to line 96, col 70 of module replicated +@!@!@ENDMSG 1000 @!@!@ +@!@!@STARTMSG 2121:1 @!@!@ +The behavior up to this point is: +@!@!@ENDMSG 2121 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +1: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])]) +/\ online = {b1, b2, b3, s1, s2, s3, p1, p2} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +2: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])]) +/\ online = {b1, b2, s1, s2, p1, p2} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2103:1 @!@!@ +The error occurred when TLC was evaluating the nested +expressions at the following positions: +0. Line 99, column 5 to line 101, column 58 in replicated +1. Line 99, column 8 to line 99, column 30 in replicated +2. Line 99, column 8 to line 99, column 25 in replicated +3. Line 91, column 5 to line 96, column 70 in replicated + + +@!@!@ENDMSG 2103 @!@!@ +@!@!@STARTMSG 2201:0 @!@!@ +The coverage statistics at 2025-01-19 18:28:23 +@!@!@ENDMSG 2201 @!@!@ +@!@!@STARTMSG 2773:0 @!@!@ +: 2:2 +@!@!@ENDMSG 2773 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 35, col 5 to line 38, col 26 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 1:6 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 41, col 8 to line 44, col 44 of module replicated: 6 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 41, col 18 to line 44, col 44 of module replicated: 6 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 42, col 9 to line 44, col 44 of module replicated: 1392 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 42, col 12 to line 42, col 48 of module replicated: 1392 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 43, col 12 to line 43, col 44 of module replicated: 624 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 44, col 12 to line 44, col 44 of module replicated: 258 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 41, col 32 to line 41, col 48 of module replicated: 6 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 45, col 8 to line 45, col 67 of module replicated: 6 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 4:14 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 48, col 8 to line 48, col 32 of module replicated: 59 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 48, col 8 to line 48, col 15 of module replicated: 45:105 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 48, col 27 to line 48, col 32 of module replicated: 45 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 49, col 8 to line 49, col 14 of module replicated: 44 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 49, col 8 to line 49, col 9 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 49, col 13 to line 49, col 14 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 50, col 8 to line 50, col 72 of module replicated: 32 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 50, col 8 to line 50, col 38 of module replicated: 18 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 50, col 42 to line 50, col 72 of module replicated: 18 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 54, col 13 to line 56, col 50 of module replicated: 14 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 57, col 8 to line 57, col 58 of module replicated: 14 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 1:2 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 60, col 8 to line 60, col 32 of module replicated: 47 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 60, col 8 to line 60, col 15 of module replicated: 45:105 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 60, col 27 to line 60, col 32 of module replicated: 45 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 61, col 8 to line 61, col 72 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 61, col 8 to line 61, col 38 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 61, col 42 to line 61, col 72 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 62, col 8 to line 62, col 102 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 63, col 8 to line 63, col 58 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 2:30 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 66, col 8 to line 66, col 30 of module replicated: 75 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 66, col 8 to line 66, col 13 of module replicated: 45:111 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 66, col 25 to line 66, col 30 of module replicated: 45 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 67, col 8 to line 74, col 29 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 67, col 24 to line 74, col 29 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 67, col 27 to line 67, col 91 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 70, col 28 to line 70, col 45 of module replicated: 10 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 71, col 31 to line 71, col 91 of module replicated: 10 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 73, col 17 to line 73, col 54 of module replicated: 10 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 74, col 18 to line 74, col 29 of module replicated: 20 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 75, col 8 to line 75, col 62 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:60 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 78, col 8 to line 78, col 31 of module replicated: 150 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 78, col 8 to line 78, col 14 of module replicated: 90:282 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 78, col 26 to line 78, col 31 of module replicated: 90 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 84, col 13 to line 86, col 37 of module replicated: 60 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 87, col 8 to line 87, col 58 of module replicated: 60 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 99, col 8 to line 99, col 30 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 99, col 8 to line 99, col 25 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 91, col 5 to line 96, col 70 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 91, col 8 to line 91, col 27 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 94, col 19 to line 94, col 37 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 96, col 9 to line 96, col 70 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 96, col 30 to line 96, col 69 of module replicated: 15 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 96, col 16 to line 96, col 27 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 99, col 24 to line 99, col 24 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 100, col 8 to line 100, col 109 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 101, col 8 to line 101, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2202:0 @!@!@ +End of statistics. +@!@!@ENDMSG 2202 @!@!@ +@!@!@STARTMSG 2200:0 @!@!@ +Progress(4) at 2025-01-19 18:28:23: 97 states generated (2.165 s/min), 9 distinct states found (200 ds/min), 5 states left on queue. +@!@!@ENDMSG 2200 @!@!@ +@!@!@STARTMSG 2199:0 @!@!@ +97 states generated, 9 distinct states found, 5 states left on queue. +@!@!@ENDMSG 2199 @!@!@ +@!@!@STARTMSG 2186:0 @!@!@ +Finished in 2701ms at (2025-01-19 18:28:23) +@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299352762/MC.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307704621/MC.tla similarity index 66% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299352762/MC.tla rename to storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307704621/MC.tla index 1dd82bc923..683a638594 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299352762/MC.tla +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307704621/MC.tla @@ -1,5 +1,5 @@ ---- MODULE MC ---- -EXTENDS fullmesh, TLC +EXTENDS replicated, TLC \* MV CONSTANT declarations@modelParameterConstants CONSTANTS @@ -22,44 +22,44 @@ az1, az2, az3 ---- \* MV CONSTANT definitions brokers -const_1737299350679194000 == +const_173730770045629000 == {b1, b2, b3} ---- \* MV CONSTANT definitions safekeepers -const_1737299350679195000 == +const_173730770045630000 == {s1, s2, s3} ---- \* MV CONSTANT definitions pageservers -const_1737299350679196000 == +const_173730770045731000 == {p1, p2} ---- \* MV CONSTANT definitions azs -const_1737299350679197000 == +const_173730770045732000 == {az1, az2, az3} ---- \* SYMMETRY definition -symm_1737299350679198000 == -Permutations(const_1737299350679194000) \union Permutations(const_1737299350679195000) \union Permutations(const_1737299350679196000) \union Permutations(const_1737299350679197000) +symm_173730770045733000 == +Permutations(const_173730770045629000) \union Permutations(const_173730770045630000) \union Permutations(const_173730770045731000) \union Permutations(const_173730770045732000) ---- \* CONSTANT definitions @modelParameterConstants:4max_commit_lsn -const_1737299350679199000 == +const_173730770045734000 == 2 ---- \* CONSTANT definitions @modelParameterConstants:5az_mapping -const_1737299350679200000 == +const_173730770045735000 == [ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2,p2} , az3 |-> {b3,s3}] ---- \* CONSTRAINT definition @modelParameterContraint:0 -constr_1737299350680201000 == +constr_173730770045736000 == StateConstraint ---- ============================================================================= \* Modification History -\* Created Sun Jan 19 16:09:10 CET 2025 by cs +\* Created Sun Jan 19 18:28:20 CET 2025 by cs diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307704621/MC_TE.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307704621/MC_TE.out new file mode 100644 index 0000000000..2e22ced64d --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307704621/MC_TE.out @@ -0,0 +1,282 @@ +@!@!@STARTMSG 2262:0 @!@!@ +TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) +@!@!@ENDMSG 2262 @!@!@ +@!@!@STARTMSG 2187:0 @!@!@ +Running breadth-first search Model-Checking with fp 128 and seed -4991617861993001241 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11510] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +@!@!@ENDMSG 2187 @!@!@ +@!@!@STARTMSG 2220:0 @!@!@ +Starting SANY... +@!@!@ENDMSG 2220 @!@!@ +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla +Semantic processing of module Naturals +Semantic processing of module Integers +Semantic processing of module Sequences +Semantic processing of module FiniteSets +Semantic processing of module replicated +Semantic processing of module TLC +Semantic processing of module MC +@!@!@STARTMSG 2219:0 @!@!@ +SANY finished. +@!@!@ENDMSG 2219 @!@!@ +@!@!@STARTMSG 2185:0 @!@!@ +Starting... (2025-01-19 18:28:21) +@!@!@ENDMSG 2185 @!@!@ +@!@!@STARTMSG 2279:3 @!@!@ +Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. +@!@!@ENDMSG 2279 @!@!@ +@!@!@STARTMSG 2284:3 @!@!@ +Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. +@!@!@ENDMSG 2284 @!@!@ +@!@!@STARTMSG 2212:0 @!@!@ +Implied-temporal checking--satisfiability problem has 1 branches. +@!@!@ENDMSG 2212 @!@!@ +@!@!@STARTMSG 2189:0 @!@!@ +Computing initial states... +@!@!@ENDMSG 2189 @!@!@ +@!@!@STARTMSG 2190:0 @!@!@ +Finished computing initial states: 1 distinct state generated at 2025-01-19 18:28:23. +@!@!@ENDMSG 2190 @!@!@ +@!@!@STARTMSG 1000:1 @!@!@ +TLC threw an unexpected exception. +This was probably caused by an error in the spec or model. +See the User Output or TLC Console for clues to what happened. +The exception was a java.lang.RuntimeException +: A non-boolean expression (a set of the form {e1, ... ,eN}) was used as a formula in a conjunction. +line 93, col 9 to line 96, col 70 of module replicated +@!@!@ENDMSG 1000 @!@!@ +@!@!@STARTMSG 2121:1 @!@!@ +The behavior up to this point is: +@!@!@ENDMSG 2121 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +1: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])]) +/\ online = {b1, b2, b3, s1, s2, s3, p1, p2} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +2: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])]) +/\ online = {b1, b2, s1, s2, p1, p2} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2103:1 @!@!@ +The error occurred when TLC was evaluating the nested +expressions at the following positions: +0. Line 99, column 5 to line 101, column 58 in replicated +1. Line 99, column 8 to line 99, column 30 in replicated +2. Line 99, column 8 to line 99, column 25 in replicated +3. Line 91, column 5 to line 96, column 70 in replicated + + +@!@!@ENDMSG 2103 @!@!@ +@!@!@STARTMSG 2201:0 @!@!@ +The coverage statistics at 2025-01-19 18:28:23 +@!@!@ENDMSG 2201 @!@!@ +@!@!@STARTMSG 2773:0 @!@!@ +: 2:2 +@!@!@ENDMSG 2773 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 35, col 5 to line 38, col 26 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 1:6 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 41, col 8 to line 44, col 44 of module replicated: 6 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 41, col 18 to line 44, col 44 of module replicated: 6 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 42, col 9 to line 44, col 44 of module replicated: 1392 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 42, col 12 to line 42, col 48 of module replicated: 1392 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 43, col 12 to line 43, col 44 of module replicated: 624 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 44, col 12 to line 44, col 44 of module replicated: 258 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 41, col 32 to line 41, col 48 of module replicated: 6 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 45, col 8 to line 45, col 67 of module replicated: 6 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 4:14 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 48, col 8 to line 48, col 32 of module replicated: 59 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 48, col 8 to line 48, col 15 of module replicated: 45:105 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 48, col 27 to line 48, col 32 of module replicated: 45 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 49, col 8 to line 49, col 14 of module replicated: 44 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 49, col 8 to line 49, col 9 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 49, col 13 to line 49, col 14 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 50, col 8 to line 50, col 72 of module replicated: 32 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 50, col 8 to line 50, col 38 of module replicated: 18 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 50, col 42 to line 50, col 72 of module replicated: 18 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 54, col 13 to line 56, col 50 of module replicated: 14 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 57, col 8 to line 57, col 58 of module replicated: 14 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 1:2 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 60, col 8 to line 60, col 32 of module replicated: 47 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 60, col 8 to line 60, col 15 of module replicated: 45:105 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 60, col 27 to line 60, col 32 of module replicated: 45 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 61, col 8 to line 61, col 72 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 61, col 8 to line 61, col 38 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 61, col 42 to line 61, col 72 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 62, col 8 to line 62, col 102 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 63, col 8 to line 63, col 58 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 2:30 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 66, col 8 to line 66, col 30 of module replicated: 75 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 66, col 8 to line 66, col 13 of module replicated: 45:111 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 66, col 25 to line 66, col 30 of module replicated: 45 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 67, col 8 to line 74, col 29 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 67, col 24 to line 74, col 29 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 67, col 27 to line 67, col 91 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 70, col 28 to line 70, col 45 of module replicated: 10 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 71, col 31 to line 71, col 91 of module replicated: 10 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 73, col 17 to line 73, col 54 of module replicated: 10 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 74, col 18 to line 74, col 29 of module replicated: 20 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 75, col 8 to line 75, col 62 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:60 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 78, col 8 to line 78, col 31 of module replicated: 150 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 78, col 8 to line 78, col 14 of module replicated: 90:282 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 78, col 26 to line 78, col 31 of module replicated: 90 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 84, col 13 to line 86, col 37 of module replicated: 60 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 87, col 8 to line 87, col 58 of module replicated: 60 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 99, col 8 to line 99, col 30 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 99, col 8 to line 99, col 25 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 91, col 5 to line 96, col 70 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 91, col 8 to line 91, col 27 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 94, col 19 to line 94, col 37 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 96, col 9 to line 96, col 70 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 96, col 30 to line 96, col 69 of module replicated: 15 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 96, col 16 to line 96, col 27 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 99, col 24 to line 99, col 24 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 100, col 8 to line 100, col 109 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 101, col 8 to line 101, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2202:0 @!@!@ +End of statistics. +@!@!@ENDMSG 2202 @!@!@ +@!@!@STARTMSG 2200:0 @!@!@ +Progress(4) at 2025-01-19 18:28:23: 97 states generated (2.165 s/min), 9 distinct states found (200 ds/min), 5 states left on queue. +@!@!@ENDMSG 2200 @!@!@ +@!@!@STARTMSG 2199:0 @!@!@ +97 states generated, 9 distinct states found, 5 states left on queue. +@!@!@ENDMSG 2199 @!@!@ +@!@!@STARTMSG 2186:0 @!@!@ +Finished in 2701ms at (2025-01-19 18:28:23) +@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307704621/replicated.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307704621/replicated.tla new file mode 100644 index 0000000000..a9b14acae2 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307704621/replicated.tla @@ -0,0 +1,131 @@ +---- MODULE replicated ---- + +EXTENDS Integers, FiniteSets + +VARIABLES broker_state, safekeeper_state, pageserver_state, online + + +CONSTANT + brokers, + safekeepers, + pageservers, + azs, + az_mapping + +CONSTANT + NULL + +CONSTANT + max_commit_lsn + +StateConstraint == + /\ \A s \in safekeepers: + /\ safekeeper_state[s].commit_lsn <= max_commit_lsn + /\ \A b \in brokers: + /\ \A s \in DOMAIN broker_state[b].sk: + /\ broker_state[b].sk[s].commit_lsn <= max_commit_lsn + + +InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0] +InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] +InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] +InitOnline == safekeepers \cup brokers \cup pageservers + +Init == + /\ broker_state = [b \in brokers |-> InitBroker] + /\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper] + /\ pageserver_state = [p \in pageservers |-> InitPageserver] + /\ online = InitOnline + +NodeOnlineOffline == + /\ online' = CHOOSE ss \in SUBSET InitOnline: + /\ Cardinality(ss \cap safekeepers) >= 2 + /\ Cardinality(ss \cap brokers) >= 2 + /\ ss \cap pageservers = pageservers \* assume no PS failures for now + /\ UNCHANGED <> + +SkCommit(s1, s2) == + /\ {s1, s2} \subseteq online + /\ s1 # s2 + /\ safekeeper_state[s1].commit_lsn = safekeeper_state[s2].commit_lsn + /\ LET + new_commit_lsn == safekeeper_state[s1].commit_lsn + 1 + IN + safekeeper_state' = [safekeeper_state EXCEPT + ![s1].commit_lsn = new_commit_lsn, + ![s2].commit_lsn = new_commit_lsn] + /\ UNCHANGED <> + +SkPeerRecovery(s1,s2) == + /\ {s1, s2} \subseteq online + /\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn + /\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn] + /\ UNCHANGED <> + +SkPushToBroker(s,b) == + /\ {s, b} \subseteq online + /\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn + THEN + LET + bsk == broker_state[b].sk + updbsk == [bsk EXCEPT ![s].commit_lsn = safekeeper_state[s].commit_lsn] + IN + [broker_state EXCEPT ![b].sk = updbsk] + ELSE broker_state + /\ UNCHANGED <> + +PsRecvBroker(b,p,s) == + /\ {b,p,s} \subseteq online + /\ LET + bsk == broker_state[b].sk[s] + psk == pageserver_state[p].sk[s] + updpsk == [psk EXCEPT !["commit_lsn"] = bsk.commit_lsn] + IN + pageserver_state' = IF bsk.commit_lsn > psk.commit_lsn + THEN [pageserver_state EXCEPT ![p].sk[s] = updpsk] + ELSE pageserver_state + /\ UNCHANGED <> + + +SksWithNewerWal(p) == + /\ {p} \subseteq online + /\ + LET + ps == pageserver_state[p] + IN + {s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn} + +PsChooseSk(p) == + /\ SksWithNewerWal(p) # {} + /\ pageserver_state' = [pageserver_state EXCEPT![p].preferred_sk = CHOOSE s \in SksWithNewerWal(p): TRUE] + /\ UNCHANGED <> + + +Next == + \/ NodeOnlineOffline + \/ \E s1 \in safekeepers: \E s2 \in safekeepers: + \/ SkCommit(s1, s2) + \/ SkPeerRecovery(s1, s2) + \/ \E s \in safekeepers: \E b \in brokers: SkPushToBroker(s, b) + \/ \E s \in safekeepers: \E b \in brokers: \E p \in pageservers: PsRecvBroker(b,p,s) + \/ \E p \in pageservers: PsChooseSk(p) + + +Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state,online>> + + +\* invariants + +EventuallyLaggingSkIsNotPreferredSk == <>( + LET + sks == safekeeper_state + lagging_sks == { s \in safekeepers: \A s2 \in safekeepers: sks[s].commit_lsn <= sks[s2].commit_lsn } + preferred_sks == {pageserver_state[p].preferred_sk: p \in pageservers} + IN + preferred_sks \cap lagging_sks = {} + + ) + + + +==== \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307769810/MC.cfg b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307769810/MC.cfg new file mode 100644 index 0000000000..d1470337f9 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307769810/MC.cfg @@ -0,0 +1,51 @@ +\* MV CONSTANT declarations +CONSTANTS +b1 = b1 +b2 = b2 +b3 = b3 +\* MV CONSTANT declarations +CONSTANTS +s1 = s1 +s2 = s2 +s3 = s3 +\* MV CONSTANT declarations +CONSTANTS +p1 = p1 +p2 = p2 +\* MV CONSTANT declarations +CONSTANTS +az1 = az1 +az2 = az2 +az3 = az3 +\* MV CONSTANT definitions +CONSTANT +brokers <- const_173730775393038000 +\* CONSTANT declarations +CONSTANT NULL = NULL +\* MV CONSTANT definitions +CONSTANT +safekeepers <- const_173730775393039000 +\* MV CONSTANT definitions +CONSTANT +pageservers <- const_173730775393040000 +\* MV CONSTANT definitions +CONSTANT +azs <- const_173730775393041000 +\* SYMMETRY definition +SYMMETRY symm_173730775393042000 +\* CONSTANT definitions +CONSTANT +max_commit_lsn <- const_173730775393043000 +\* CONSTANT definitions +CONSTANT +az_mapping <- const_173730775393044000 +\* CONSTRAINT definition +CONSTRAINT +constr_173730775393045000 +\* SPECIFICATION definition +SPECIFICATION +Spec +\* PROPERTY definition +PROPERTY +EventuallyLaggingSkIsNotPreferredSk +\* Generated on Sun Jan 19 18:29:13 CET 2025 \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737301223409/MC.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307769810/MC.out similarity index 80% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737301223409/MC.out rename to storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307769810/MC.out index ab92cbb3d7..21638f26fe 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737301223409/MC.out +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307769810/MC.out @@ -2,7 +2,7 @@ TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) @!@!@ENDMSG 2262 @!@!@ @!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 20 and seed 6372772458573668883 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 9898] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +Running breadth-first search Model-Checking with fp 19 and seed -4959290627086969114 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11541] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). @!@!@ENDMSG 2187 @!@!@ @!@!@STARTMSG 2220:0 @!@!@ Starting SANY... @@ -11,21 +11,21 @@ Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbo Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla Semantic processing of module Naturals Semantic processing of module Integers -Semantic processing of module replicated Semantic processing of module Sequences Semantic processing of module FiniteSets +Semantic processing of module replicated Semantic processing of module TLC Semantic processing of module MC @!@!@STARTMSG 2219:0 @!@!@ SANY finished. @!@!@ENDMSG 2219 @!@!@ @!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 16:40:16) +Starting... (2025-01-19 18:29:15) @!@!@ENDMSG 2185 @!@!@ @!@!@STARTMSG 2279:3 @!@!@ Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. @@ -40,14 +40,14 @@ Implied-temporal checking--satisfiability problem has 1 branches. Computing initial states... @!@!@ENDMSG 2189 @!@!@ @!@!@STARTMSG 2190:0 @!@!@ -Finished computing initial states: 1 distinct state generated at 2025-01-19 16:40:18. +Finished computing initial states: 1 distinct state generated at 2025-01-19 18:29:16. @!@!@ENDMSG 2190 @!@!@ @!@!@STARTMSG 2192:0 @!@!@ -Checking temporal properties for the current state space with 1217 total distinct states at (2025-01-19 16:40:21) +Checking temporal properties for the current state space with 1431 total distinct states at (2025-01-19 18:29:19) @!@!@ENDMSG 2192 @!@!@ @!@!@STARTMSG 2267:0 @!@!@ -Finished checking temporal properties in 00s at 2025-01-19 16:40:21 +Finished checking temporal properties in 00s at 2025-01-19 18:29:19 @!@!@ENDMSG 2267 @!@!@ @!@!@STARTMSG 2200:0 @!@!@ -Progress(11) at 2025-01-19 16:40:21: 39.816 states generated (39.816 s/min), 3.288 distinct states found (3.288 ds/min), 2.067 states left on queue. +Progress(10) at 2025-01-19 18:29:19: 38.274 states generated (38.274 s/min), 4.060 distinct states found (4.060 ds/min), 2.625 states left on queue. @!@!@ENDMSG 2200 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307769810/MC.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307769810/MC.tla new file mode 100644 index 0000000000..8b1824f370 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307769810/MC.tla @@ -0,0 +1,65 @@ +---- MODULE MC ---- +EXTENDS replicated, TLC + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +b1, b2, b3 +---- + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +s1, s2, s3 +---- + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +p1, p2 +---- + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +az1, az2, az3 +---- + +\* MV CONSTANT definitions brokers +const_173730775393038000 == +{b1, b2, b3} +---- + +\* MV CONSTANT definitions safekeepers +const_173730775393039000 == +{s1, s2, s3} +---- + +\* MV CONSTANT definitions pageservers +const_173730775393040000 == +{p1, p2} +---- + +\* MV CONSTANT definitions azs +const_173730775393041000 == +{az1, az2, az3} +---- + +\* SYMMETRY definition +symm_173730775393042000 == +Permutations(const_173730775393038000) \union Permutations(const_173730775393039000) \union Permutations(const_173730775393040000) \union Permutations(const_173730775393041000) +---- + +\* CONSTANT definitions @modelParameterConstants:4max_commit_lsn +const_173730775393043000 == +2 +---- + +\* CONSTANT definitions @modelParameterConstants:5az_mapping +const_173730775393044000 == +[ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2,p2} , az3 |-> {b3,s3}] +---- + +\* CONSTRAINT definition @modelParameterContraint:0 +constr_173730775393045000 == +StateConstraint +---- +============================================================================= +\* Modification History +\* Created Sun Jan 19 18:29:13 CET 2025 by cs diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737301223409/MC_TE.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307769810/MC_TE.out similarity index 80% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737301223409/MC_TE.out rename to storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307769810/MC_TE.out index ab92cbb3d7..21638f26fe 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737301223409/MC_TE.out +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307769810/MC_TE.out @@ -2,7 +2,7 @@ TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) @!@!@ENDMSG 2262 @!@!@ @!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 20 and seed 6372772458573668883 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 9898] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +Running breadth-first search Model-Checking with fp 19 and seed -4959290627086969114 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11541] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). @!@!@ENDMSG 2187 @!@!@ @!@!@STARTMSG 2220:0 @!@!@ Starting SANY... @@ -11,21 +11,21 @@ Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbo Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla Semantic processing of module Naturals Semantic processing of module Integers -Semantic processing of module replicated Semantic processing of module Sequences Semantic processing of module FiniteSets +Semantic processing of module replicated Semantic processing of module TLC Semantic processing of module MC @!@!@STARTMSG 2219:0 @!@!@ SANY finished. @!@!@ENDMSG 2219 @!@!@ @!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 16:40:16) +Starting... (2025-01-19 18:29:15) @!@!@ENDMSG 2185 @!@!@ @!@!@STARTMSG 2279:3 @!@!@ Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. @@ -40,14 +40,14 @@ Implied-temporal checking--satisfiability problem has 1 branches. Computing initial states... @!@!@ENDMSG 2189 @!@!@ @!@!@STARTMSG 2190:0 @!@!@ -Finished computing initial states: 1 distinct state generated at 2025-01-19 16:40:18. +Finished computing initial states: 1 distinct state generated at 2025-01-19 18:29:16. @!@!@ENDMSG 2190 @!@!@ @!@!@STARTMSG 2192:0 @!@!@ -Checking temporal properties for the current state space with 1217 total distinct states at (2025-01-19 16:40:21) +Checking temporal properties for the current state space with 1431 total distinct states at (2025-01-19 18:29:19) @!@!@ENDMSG 2192 @!@!@ @!@!@STARTMSG 2267:0 @!@!@ -Finished checking temporal properties in 00s at 2025-01-19 16:40:21 +Finished checking temporal properties in 00s at 2025-01-19 18:29:19 @!@!@ENDMSG 2267 @!@!@ @!@!@STARTMSG 2200:0 @!@!@ -Progress(11) at 2025-01-19 16:40:21: 39.816 states generated (39.816 s/min), 3.288 distinct states found (3.288 ds/min), 2.067 states left on queue. +Progress(10) at 2025-01-19 18:29:19: 38.274 states generated (38.274 s/min), 4.060 distinct states found (4.060 ds/min), 2.625 states left on queue. @!@!@ENDMSG 2200 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299469039/fullmesh.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307769810/replicated.tla similarity index 75% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299469039/fullmesh.tla rename to storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307769810/replicated.tla index 047ececfe2..fca339edab 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299469039/fullmesh.tla +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307769810/replicated.tla @@ -1,8 +1,8 @@ ----- MODULE fullmesh ---- +---- MODULE replicated ---- -EXTENDS Integers +EXTENDS Integers, FiniteSets -VARIABLES broker_state, safekeeper_state, pageserver_state +VARIABLES broker_state, safekeeper_state, pageserver_state, online CONSTANT @@ -29,14 +29,23 @@ StateConstraint == InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0] InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] +InitOnline == safekeepers \cup brokers \cup pageservers Init == /\ broker_state = [b \in brokers |-> InitBroker] /\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper] /\ pageserver_state = [p \in pageservers |-> InitPageserver] + /\ online = InitOnline +NodeOnlineOffline == + /\ online' = CHOOSE ss \in SUBSET InitOnline: + /\ Cardinality(ss \cap safekeepers) >= 2 + /\ Cardinality(ss \cap brokers) >= 2 + /\ ss \cap pageservers = pageservers \* assume no PS failures for now + /\ UNCHANGED <> SkCommit(s1, s2) == + /\ {s1, s2} \subseteq online /\ s1 # s2 /\ safekeeper_state[s1].commit_lsn = safekeeper_state[s2].commit_lsn /\ LET @@ -45,13 +54,16 @@ SkCommit(s1, s2) == safekeeper_state' = [safekeeper_state EXCEPT ![s1].commit_lsn = new_commit_lsn, ![s2].commit_lsn = new_commit_lsn] - /\ UNCHANGED <> + /\ UNCHANGED <> SkPeerRecovery(s1,s2) == + /\ {s1, s2} \subseteq online /\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn /\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn] + /\ UNCHANGED <> SkPushToBroker(s,b) == + /\ {s, b} \subseteq online /\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn THEN LET @@ -60,9 +72,10 @@ SkPushToBroker(s,b) == IN [broker_state EXCEPT ![b].sk = updbsk] ELSE broker_state - /\ UNCHANGED <> + /\ UNCHANGED <> PsRecvBroker(b,p,s) == + /\ {b,p,s} \subseteq online /\ LET bsk == broker_state[b].sk[s] psk == pageserver_state[p].sk[s] @@ -71,7 +84,7 @@ PsRecvBroker(b,p,s) == pageserver_state' = IF bsk.commit_lsn > psk.commit_lsn THEN [pageserver_state EXCEPT ![p].sk[s] = updpsk] ELSE pageserver_state - /\ UNCHANGED <> + /\ UNCHANGED <> SksWithNewerWal(p) == @@ -81,13 +94,14 @@ SksWithNewerWal(p) == {s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn} PsChooseSk(p) == + /\ {p} \subseteq online /\ SksWithNewerWal(p) # {} /\ pageserver_state' = [pageserver_state EXCEPT![p].preferred_sk = CHOOSE s \in SksWithNewerWal(p): TRUE] - /\ UNCHANGED <> + /\ UNCHANGED <> Next == - + \/ NodeOnlineOffline \/ \E s1 \in safekeepers: \E s2 \in safekeepers: \/ SkCommit(s1, s2) \/ SkPeerRecovery(s1, s2) @@ -96,7 +110,7 @@ Next == \/ \E p \in pageservers: PsChooseSk(p) -Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state >> +Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state,online>> \* invariants diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307828738/MC.cfg b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307828738/MC.cfg new file mode 100644 index 0000000000..ff576a1795 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307828738/MC.cfg @@ -0,0 +1,50 @@ +\* MV CONSTANT declarations +CONSTANTS +b1 = b1 +b2 = b2 +b3 = b3 +\* MV CONSTANT declarations +CONSTANTS +s1 = s1 +s2 = s2 +s3 = s3 +\* MV CONSTANT declarations +CONSTANTS +p1 = p1 +\* MV CONSTANT declarations +CONSTANTS +az1 = az1 +az2 = az2 +az3 = az3 +\* MV CONSTANT definitions +CONSTANT +brokers <- const_173730781391774000 +\* CONSTANT declarations +CONSTANT NULL = NULL +\* MV CONSTANT definitions +CONSTANT +safekeepers <- const_173730781391775000 +\* MV CONSTANT definitions +CONSTANT +pageservers <- const_173730781391776000 +\* MV CONSTANT definitions +CONSTANT +azs <- const_173730781391777000 +\* SYMMETRY definition +SYMMETRY symm_173730781391778000 +\* CONSTANT definitions +CONSTANT +max_commit_lsn <- const_173730781391779000 +\* CONSTANT definitions +CONSTANT +az_mapping <- const_173730781391780000 +\* CONSTRAINT definition +CONSTRAINT +constr_173730781391781000 +\* SPECIFICATION definition +SPECIFICATION +Spec +\* PROPERTY definition +PROPERTY +EventuallyLaggingSkIsNotPreferredSk +\* Generated on Sun Jan 19 18:30:13 CET 2025 \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737301172627/MC.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307828738/MC.out similarity index 75% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737301172627/MC.out rename to storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307828738/MC.out index 32aec7b880..f1349ccb01 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737301172627/MC.out +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307828738/MC.out @@ -2,7 +2,7 @@ TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) @!@!@ENDMSG 2262 @!@!@ @!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 71 and seed 2330797625274141225 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 9710] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +Running breadth-first search Model-Checking with fp 24 and seed -1042781833563910669 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11591] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). @!@!@ENDMSG 2187 @!@!@ @!@!@STARTMSG 2220:0 @!@!@ Starting SANY... @@ -11,21 +11,21 @@ Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbo Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla Semantic processing of module Naturals Semantic processing of module Integers -Semantic processing of module replicated Semantic processing of module Sequences Semantic processing of module FiniteSets +Semantic processing of module replicated Semantic processing of module TLC Semantic processing of module MC @!@!@STARTMSG 2219:0 @!@!@ SANY finished. @!@!@ENDMSG 2219 @!@!@ @!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 16:39:29) +Starting... (2025-01-19 18:30:15) @!@!@ENDMSG 2185 @!@!@ @!@!@STARTMSG 2279:3 @!@!@ Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. @@ -40,5 +40,14 @@ Implied-temporal checking--satisfiability problem has 1 branches. Computing initial states... @!@!@ENDMSG 2189 @!@!@ @!@!@STARTMSG 2190:0 @!@!@ -Finished computing initial states: 1 distinct state generated at 2025-01-19 16:39:31. +Finished computing initial states: 1 distinct state generated at 2025-01-19 18:30:16. @!@!@ENDMSG 2190 @!@!@ +@!@!@STARTMSG 2192:0 @!@!@ +Checking temporal properties for the current state space with 3889 total distinct states at (2025-01-19 18:30:19) +@!@!@ENDMSG 2192 @!@!@ +@!@!@STARTMSG 2267:0 @!@!@ +Finished checking temporal properties in 00s at 2025-01-19 18:30:19 +@!@!@ENDMSG 2267 @!@!@ +@!@!@STARTMSG 2200:0 @!@!@ +Progress(11) at 2025-01-19 18:30:19: 78.397 states generated (78.397 s/min), 8.627 distinct states found (8.627 ds/min), 4.735 states left on queue. +@!@!@ENDMSG 2200 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307828738/MC.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307828738/MC.tla new file mode 100644 index 0000000000..0079b64427 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307828738/MC.tla @@ -0,0 +1,65 @@ +---- MODULE MC ---- +EXTENDS replicated, TLC + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +b1, b2, b3 +---- + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +s1, s2, s3 +---- + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +p1 +---- + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +az1, az2, az3 +---- + +\* MV CONSTANT definitions brokers +const_173730781391774000 == +{b1, b2, b3} +---- + +\* MV CONSTANT definitions safekeepers +const_173730781391775000 == +{s1, s2, s3} +---- + +\* MV CONSTANT definitions pageservers +const_173730781391776000 == +{p1} +---- + +\* MV CONSTANT definitions azs +const_173730781391777000 == +{az1, az2, az3} +---- + +\* SYMMETRY definition +symm_173730781391778000 == +Permutations(const_173730781391774000) \union Permutations(const_173730781391775000) \union Permutations(const_173730781391776000) \union Permutations(const_173730781391777000) +---- + +\* CONSTANT definitions @modelParameterConstants:4max_commit_lsn +const_173730781391779000 == +2 +---- + +\* CONSTANT definitions @modelParameterConstants:5az_mapping +const_173730781391780000 == +[ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2} , az3 |-> {b3,s3}] +---- + +\* CONSTRAINT definition @modelParameterContraint:0 +constr_173730781391781000 == +StateConstraint +---- +============================================================================= +\* Modification History +\* Created Sun Jan 19 18:30:13 CET 2025 by cs diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737301172627/MC_TE.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307828738/MC_TE.out similarity index 75% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737301172627/MC_TE.out rename to storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307828738/MC_TE.out index 32aec7b880..f1349ccb01 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737301172627/MC_TE.out +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307828738/MC_TE.out @@ -2,7 +2,7 @@ TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) @!@!@ENDMSG 2262 @!@!@ @!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 71 and seed 2330797625274141225 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 9710] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +Running breadth-first search Model-Checking with fp 24 and seed -1042781833563910669 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11591] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). @!@!@ENDMSG 2187 @!@!@ @!@!@STARTMSG 2220:0 @!@!@ Starting SANY... @@ -11,21 +11,21 @@ Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbo Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla Semantic processing of module Naturals Semantic processing of module Integers -Semantic processing of module replicated Semantic processing of module Sequences Semantic processing of module FiniteSets +Semantic processing of module replicated Semantic processing of module TLC Semantic processing of module MC @!@!@STARTMSG 2219:0 @!@!@ SANY finished. @!@!@ENDMSG 2219 @!@!@ @!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 16:39:29) +Starting... (2025-01-19 18:30:15) @!@!@ENDMSG 2185 @!@!@ @!@!@STARTMSG 2279:3 @!@!@ Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. @@ -40,5 +40,14 @@ Implied-temporal checking--satisfiability problem has 1 branches. Computing initial states... @!@!@ENDMSG 2189 @!@!@ @!@!@STARTMSG 2190:0 @!@!@ -Finished computing initial states: 1 distinct state generated at 2025-01-19 16:39:31. +Finished computing initial states: 1 distinct state generated at 2025-01-19 18:30:16. @!@!@ENDMSG 2190 @!@!@ +@!@!@STARTMSG 2192:0 @!@!@ +Checking temporal properties for the current state space with 3889 total distinct states at (2025-01-19 18:30:19) +@!@!@ENDMSG 2192 @!@!@ +@!@!@STARTMSG 2267:0 @!@!@ +Finished checking temporal properties in 00s at 2025-01-19 18:30:19 +@!@!@ENDMSG 2267 @!@!@ +@!@!@STARTMSG 2200:0 @!@!@ +Progress(11) at 2025-01-19 18:30:19: 78.397 states generated (78.397 s/min), 8.627 distinct states found (8.627 ds/min), 4.735 states left on queue. +@!@!@ENDMSG 2200 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299542008/fullmesh.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307828738/replicated.tla similarity index 75% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299542008/fullmesh.tla rename to storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307828738/replicated.tla index 06c69da79a..fca339edab 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299542008/fullmesh.tla +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307828738/replicated.tla @@ -1,8 +1,8 @@ ----- MODULE fullmesh ---- +---- MODULE replicated ---- -EXTENDS Integers +EXTENDS Integers, FiniteSets -VARIABLES broker_state, safekeeper_state, pageserver_state +VARIABLES broker_state, safekeeper_state, pageserver_state, online CONSTANT @@ -29,14 +29,23 @@ StateConstraint == InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0] InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] +InitOnline == safekeepers \cup brokers \cup pageservers Init == /\ broker_state = [b \in brokers |-> InitBroker] /\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper] /\ pageserver_state = [p \in pageservers |-> InitPageserver] + /\ online = InitOnline +NodeOnlineOffline == + /\ online' = CHOOSE ss \in SUBSET InitOnline: + /\ Cardinality(ss \cap safekeepers) >= 2 + /\ Cardinality(ss \cap brokers) >= 2 + /\ ss \cap pageservers = pageservers \* assume no PS failures for now + /\ UNCHANGED <> SkCommit(s1, s2) == + /\ {s1, s2} \subseteq online /\ s1 # s2 /\ safekeeper_state[s1].commit_lsn = safekeeper_state[s2].commit_lsn /\ LET @@ -45,14 +54,16 @@ SkCommit(s1, s2) == safekeeper_state' = [safekeeper_state EXCEPT ![s1].commit_lsn = new_commit_lsn, ![s2].commit_lsn = new_commit_lsn] - /\ UNCHANGED <> + /\ UNCHANGED <> SkPeerRecovery(s1,s2) == + /\ {s1, s2} \subseteq online /\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn /\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn] - /\ UNCHANGED <> + /\ UNCHANGED <> SkPushToBroker(s,b) == + /\ {s, b} \subseteq online /\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn THEN LET @@ -61,9 +72,10 @@ SkPushToBroker(s,b) == IN [broker_state EXCEPT ![b].sk = updbsk] ELSE broker_state - /\ UNCHANGED <> + /\ UNCHANGED <> PsRecvBroker(b,p,s) == + /\ {b,p,s} \subseteq online /\ LET bsk == broker_state[b].sk[s] psk == pageserver_state[p].sk[s] @@ -72,7 +84,7 @@ PsRecvBroker(b,p,s) == pageserver_state' = IF bsk.commit_lsn > psk.commit_lsn THEN [pageserver_state EXCEPT ![p].sk[s] = updpsk] ELSE pageserver_state - /\ UNCHANGED <> + /\ UNCHANGED <> SksWithNewerWal(p) == @@ -82,13 +94,14 @@ SksWithNewerWal(p) == {s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn} PsChooseSk(p) == + /\ {p} \subseteq online /\ SksWithNewerWal(p) # {} /\ pageserver_state' = [pageserver_state EXCEPT![p].preferred_sk = CHOOSE s \in SksWithNewerWal(p): TRUE] - /\ UNCHANGED <> + /\ UNCHANGED <> Next == - + \/ NodeOnlineOffline \/ \E s1 \in safekeepers: \E s2 \in safekeepers: \/ SkCommit(s1, s2) \/ SkPeerRecovery(s1, s2) @@ -97,7 +110,7 @@ Next == \/ \E p \in pageservers: PsChooseSk(p) -Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state >> +Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state,online>> \* invariants diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299352762/MC.cfg b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308024914/MC.cfg similarity index 63% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299352762/MC.cfg rename to storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308024914/MC.cfg index fa522b981a..8dd1d266c3 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299352762/MC.cfg +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308024914/MC.cfg @@ -11,7 +11,6 @@ s3 = s3 \* MV CONSTANT declarations CONSTANTS p1 = p1 -p2 = p2 \* MV CONSTANT declarations CONSTANTS az1 = az1 @@ -19,33 +18,36 @@ az2 = az2 az3 = az3 \* MV CONSTANT definitions CONSTANT -brokers <- const_1737299350679194000 +brokers <- const_1737308022622113000 \* CONSTANT declarations CONSTANT NULL = NULL \* MV CONSTANT definitions CONSTANT -safekeepers <- const_1737299350679195000 +safekeepers <- const_1737308022622114000 \* MV CONSTANT definitions CONSTANT -pageservers <- const_1737299350679196000 +pageservers <- const_1737308022622115000 \* MV CONSTANT definitions CONSTANT -azs <- const_1737299350679197000 +azs <- const_1737308022622116000 \* SYMMETRY definition -SYMMETRY symm_1737299350679198000 +SYMMETRY symm_1737308022622117000 \* CONSTANT definitions CONSTANT -max_commit_lsn <- const_1737299350679199000 +max_commit_lsn <- const_1737308022622118000 \* CONSTANT definitions CONSTANT -az_mapping <- const_1737299350679200000 +az_mapping <- const_1737308022622119000 \* CONSTRAINT definition CONSTRAINT -constr_1737299350680201000 +constr_1737308022622120000 \* SPECIFICATION definition SPECIFICATION Spec \* INVARIANT definition INVARIANT +PsLagsSk +\* PROPERTY definition +PROPERTY EventuallyLaggingSkIsNotPreferredSk -\* Generated on Sun Jan 19 16:09:10 CET 2025 \ No newline at end of file +\* Generated on Sun Jan 19 18:33:42 CET 2025 \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299352762/MC.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308024914/MC.out similarity index 67% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299352762/MC.out rename to storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308024914/MC.out index 27a0150e6e..59da3df845 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299352762/MC.out +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308024914/MC.out @@ -2,34 +2,34 @@ TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) @!@!@ENDMSG 2262 @!@!@ @!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 119 and seed -1908114041878732601 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 7665] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +Running breadth-first search Model-Checking with fp 95 and seed 5720921755138129000 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11738] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). @!@!@ENDMSG 2187 @!@!@ @!@!@STARTMSG 2220:0 @!@!@ Starting SANY... @!@!@ENDMSG 2220 @!@!@ -Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/MC.tla -Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/fullmesh.tla +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla Semantic processing of module Naturals Semantic processing of module Integers -Semantic processing of module fullmesh Semantic processing of module Sequences Semantic processing of module FiniteSets +Semantic processing of module replicated Semantic processing of module TLC Semantic processing of module MC @!@!@STARTMSG 2219:0 @!@!@ SANY finished. @!@!@ENDMSG 2219 @!@!@ @!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 16:09:11) +Starting... (2025-01-19 18:33:43) @!@!@ENDMSG 2185 @!@!@ @!@!@STARTMSG 2146:1 @!@!@ -The invariant EventuallyLaggingSkIsNotPreferredSk is not a state predicate (one with no primes or temporal operators). +The invariant PsLagsSk is not a state predicate (one with no primes or temporal operators). @!@!@ENDMSG 2146 @!@!@ @!@!@STARTMSG 2186:0 @!@!@ -Finished in 994ms at (2025-01-19 16:09:11) +Finished in 1009ms at (2025-01-19 18:33:43) @!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308024914/MC.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308024914/MC.tla new file mode 100644 index 0000000000..caea6ac31c --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308024914/MC.tla @@ -0,0 +1,65 @@ +---- MODULE MC ---- +EXTENDS replicated, TLC + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +b1, b2, b3 +---- + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +s1, s2, s3 +---- + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +p1 +---- + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +az1, az2, az3 +---- + +\* MV CONSTANT definitions brokers +const_1737308022622113000 == +{b1, b2, b3} +---- + +\* MV CONSTANT definitions safekeepers +const_1737308022622114000 == +{s1, s2, s3} +---- + +\* MV CONSTANT definitions pageservers +const_1737308022622115000 == +{p1} +---- + +\* MV CONSTANT definitions azs +const_1737308022622116000 == +{az1, az2, az3} +---- + +\* SYMMETRY definition +symm_1737308022622117000 == +Permutations(const_1737308022622113000) \union Permutations(const_1737308022622114000) \union Permutations(const_1737308022622115000) \union Permutations(const_1737308022622116000) +---- + +\* CONSTANT definitions @modelParameterConstants:4max_commit_lsn +const_1737308022622118000 == +2 +---- + +\* CONSTANT definitions @modelParameterConstants:5az_mapping +const_1737308022622119000 == +[ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2} , az3 |-> {b3,s3}] +---- + +\* CONSTRAINT definition @modelParameterContraint:0 +constr_1737308022622120000 == +StateConstraint +---- +============================================================================= +\* Modification History +\* Created Sun Jan 19 18:33:42 CET 2025 by cs diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299352762/MC_TE.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308024914/MC_TE.out similarity index 67% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299352762/MC_TE.out rename to storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308024914/MC_TE.out index 27a0150e6e..59da3df845 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299352762/MC_TE.out +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308024914/MC_TE.out @@ -2,34 +2,34 @@ TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) @!@!@ENDMSG 2262 @!@!@ @!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 119 and seed -1908114041878732601 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 7665] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +Running breadth-first search Model-Checking with fp 95 and seed 5720921755138129000 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11738] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). @!@!@ENDMSG 2187 @!@!@ @!@!@STARTMSG 2220:0 @!@!@ Starting SANY... @!@!@ENDMSG 2220 @!@!@ -Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/MC.tla -Parsing file /Users/cs/Desktop/broker/fullmesh/fullmesh.toolbox/Model_1/fullmesh.tla +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla Semantic processing of module Naturals Semantic processing of module Integers -Semantic processing of module fullmesh Semantic processing of module Sequences Semantic processing of module FiniteSets +Semantic processing of module replicated Semantic processing of module TLC Semantic processing of module MC @!@!@STARTMSG 2219:0 @!@!@ SANY finished. @!@!@ENDMSG 2219 @!@!@ @!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 16:09:11) +Starting... (2025-01-19 18:33:43) @!@!@ENDMSG 2185 @!@!@ @!@!@STARTMSG 2146:1 @!@!@ -The invariant EventuallyLaggingSkIsNotPreferredSk is not a state predicate (one with no primes or temporal operators). +The invariant PsLagsSk is not a state predicate (one with no primes or temporal operators). @!@!@ENDMSG 2146 @!@!@ @!@!@STARTMSG 2186:0 @!@!@ -Finished in 994ms at (2025-01-19 16:09:11) +Finished in 1009ms at (2025-01-19 18:33:43) @!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308024914/replicated.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308024914/replicated.tla new file mode 100644 index 0000000000..36db18ecc3 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308024914/replicated.tla @@ -0,0 +1,135 @@ +---- MODULE replicated ---- + +EXTENDS Integers, FiniteSets + +VARIABLES broker_state, safekeeper_state, pageserver_state, online + + +CONSTANT + brokers, + safekeepers, + pageservers, + azs, + az_mapping + +CONSTANT + NULL + +CONSTANT + max_commit_lsn + +StateConstraint == + /\ \A s \in safekeepers: + /\ safekeeper_state[s].commit_lsn <= max_commit_lsn + /\ \A b \in brokers: + /\ \A s \in DOMAIN broker_state[b].sk: + /\ broker_state[b].sk[s].commit_lsn <= max_commit_lsn + + +InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0] +InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] +InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] +InitOnline == safekeepers \cup brokers \cup pageservers + +Init == + /\ broker_state = [b \in brokers |-> InitBroker] + /\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper] + /\ pageserver_state = [p \in pageservers |-> InitPageserver] + /\ online = InitOnline + +NodeOnlineOffline == + /\ online' = CHOOSE ss \in SUBSET InitOnline: + /\ Cardinality(ss \cap safekeepers) >= 2 + /\ Cardinality(ss \cap brokers) >= 2 + /\ ss \cap pageservers = pageservers \* assume no PS failures for now + /\ UNCHANGED <> + +SkCommit(s1, s2) == + /\ {s1, s2} \subseteq online + /\ s1 # s2 + /\ safekeeper_state[s1].commit_lsn = safekeeper_state[s2].commit_lsn + /\ LET + new_commit_lsn == safekeeper_state[s1].commit_lsn + 1 + IN + safekeeper_state' = [safekeeper_state EXCEPT + ![s1].commit_lsn = new_commit_lsn, + ![s2].commit_lsn = new_commit_lsn] + /\ UNCHANGED <> + +SkPeerRecovery(s1,s2) == + /\ {s1, s2} \subseteq online + /\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn + /\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn] + /\ UNCHANGED <> + +SkPushToBroker(s,b) == + /\ {s, b} \subseteq online + /\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn + THEN + LET + bsk == broker_state[b].sk + updbsk == [bsk EXCEPT ![s].commit_lsn = safekeeper_state[s].commit_lsn] + IN + [broker_state EXCEPT ![b].sk = updbsk] + ELSE broker_state + /\ UNCHANGED <> + +PsRecvBroker(b,p,s) == + /\ {b,p,s} \subseteq online + /\ LET + bsk == broker_state[b].sk[s] + psk == pageserver_state[p].sk[s] + updpsk == [psk EXCEPT !["commit_lsn"] = bsk.commit_lsn] + IN + pageserver_state' = IF bsk.commit_lsn > psk.commit_lsn + THEN [pageserver_state EXCEPT ![p].sk[s] = updpsk] + ELSE pageserver_state + /\ UNCHANGED <> + + +SksWithNewerWal(p) == + LET + ps == pageserver_state[p] + IN + {s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn} + +PsChooseSk(p) == + /\ {p} \subseteq online + /\ SksWithNewerWal(p) # {} + /\ pageserver_state' = [pageserver_state EXCEPT![p].preferred_sk = CHOOSE s \in SksWithNewerWal(p): TRUE] + /\ UNCHANGED <> + + +Next == + \/ NodeOnlineOffline + \/ \E s1 \in safekeepers: \E s2 \in safekeepers: + \/ SkCommit(s1, s2) + \/ SkPeerRecovery(s1, s2) + \/ \E s \in safekeepers: \E b \in brokers: SkPushToBroker(s, b) + \/ \E s \in safekeepers: \E b \in brokers: \E p \in pageservers: PsRecvBroker(b,p,s) + \/ \E p \in pageservers: PsChooseSk(p) + + +Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state,online>> + + +\* invariants + +PsLagsSk == []( + \A p \in pageservers: \A s \in DOMAIN pageserver_state[p].sk: + /\ pageserver_state[p].sk[s].commit_lsn < safekeeper_state[s].commit_lsn + ) + +EventuallyLaggingSkIsNotPreferredSk == <>( + LET + sks == safekeeper_state + lagging_sks == { s \in safekeepers: \A s2 \in safekeepers: sks[s].commit_lsn <= sks[s2].commit_lsn } + preferred_sks == {pageserver_state[p].preferred_sk: p \in pageservers} + IN + preferred_sks \cap lagging_sks = {} + + ) + + + +==== \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299381423/MC.cfg b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308183077/MC.cfg similarity index 63% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299381423/MC.cfg rename to storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308183077/MC.cfg index b9bc8092a2..886ee705a5 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737299381423/MC.cfg +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308183077/MC.cfg @@ -11,7 +11,6 @@ s3 = s3 \* MV CONSTANT declarations CONSTANTS p1 = p1 -p2 = p2 \* MV CONSTANT declarations CONSTANTS az1 = az1 @@ -19,33 +18,36 @@ az2 = az2 az3 = az3 \* MV CONSTANT definitions CONSTANT -brokers <- const_1737299377376212000 +brokers <- const_1737308178999123000 \* CONSTANT declarations CONSTANT NULL = NULL \* MV CONSTANT definitions CONSTANT -safekeepers <- const_1737299377376213000 +safekeepers <- const_1737308178999124000 \* MV CONSTANT definitions CONSTANT -pageservers <- const_1737299377376214000 +pageservers <- const_1737308178999125000 \* MV CONSTANT definitions CONSTANT -azs <- const_1737299377376215000 +azs <- const_1737308178999126000 \* SYMMETRY definition -SYMMETRY symm_1737299377376216000 +SYMMETRY symm_1737308178999127000 \* CONSTANT definitions CONSTANT -max_commit_lsn <- const_1737299377376217000 +max_commit_lsn <- const_1737308178999128000 \* CONSTANT definitions CONSTANT -az_mapping <- const_1737299377376218000 +az_mapping <- const_1737308178999129000 \* CONSTRAINT definition CONSTRAINT -constr_1737299377376219000 +constr_1737308178999130000 \* SPECIFICATION definition SPECIFICATION Spec +\* INVARIANT definition +INVARIANT +PsLagsSk \* PROPERTY definition PROPERTY EventuallyLaggingSkIsNotPreferredSk -\* Generated on Sun Jan 19 16:09:37 CET 2025 \ No newline at end of file +\* Generated on Sun Jan 19 18:36:19 CET 2025 \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308183077/MC.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308183077/MC.out new file mode 100644 index 0000000000..00a833e2f0 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308183077/MC.out @@ -0,0 +1,52 @@ +@!@!@STARTMSG 2262:0 @!@!@ +TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) +@!@!@ENDMSG 2262 @!@!@ +@!@!@STARTMSG 2187:0 @!@!@ +Running breadth-first search Model-Checking with fp 92 and seed -5681728403679829533 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11930] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +@!@!@ENDMSG 2187 @!@!@ +@!@!@STARTMSG 2220:0 @!@!@ +Starting SANY... +@!@!@ENDMSG 2220 @!@!@ +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla +Semantic processing of module Naturals +Semantic processing of module Integers +Semantic processing of module Sequences +Semantic processing of module FiniteSets +Semantic processing of module replicated +Semantic processing of module TLC +Semantic processing of module MC +@!@!@STARTMSG 2219:0 @!@!@ +SANY finished. +@!@!@ENDMSG 2219 @!@!@ +@!@!@STARTMSG 2185:0 @!@!@ +Starting... (2025-01-19 18:36:20) +@!@!@ENDMSG 2185 @!@!@ +@!@!@STARTMSG 2279:3 @!@!@ +Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. +@!@!@ENDMSG 2279 @!@!@ +@!@!@STARTMSG 2284:3 @!@!@ +Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. +@!@!@ENDMSG 2284 @!@!@ +@!@!@STARTMSG 2212:0 @!@!@ +Implied-temporal checking--satisfiability problem has 1 branches. +@!@!@ENDMSG 2212 @!@!@ +@!@!@STARTMSG 2189:0 @!@!@ +Computing initial states... +@!@!@ENDMSG 2189 @!@!@ +@!@!@STARTMSG 2107:1 @!@!@ +Invariant PsLagsSk is violated by the initial state: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])]) +/\ online = {b1, b2, b3, s1, s2, s3, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0]) + +@!@!@ENDMSG 2107 @!@!@ +@!@!@STARTMSG 2186:0 @!@!@ +Finished in 2710ms at (2025-01-19 18:36:21) +@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308183077/MC.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308183077/MC.tla new file mode 100644 index 0000000000..675b27fd4b --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308183077/MC.tla @@ -0,0 +1,65 @@ +---- MODULE MC ---- +EXTENDS replicated, TLC + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +b1, b2, b3 +---- + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +s1, s2, s3 +---- + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +p1 +---- + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +az1, az2, az3 +---- + +\* MV CONSTANT definitions brokers +const_1737308178999123000 == +{b1, b2, b3} +---- + +\* MV CONSTANT definitions safekeepers +const_1737308178999124000 == +{s1, s2, s3} +---- + +\* MV CONSTANT definitions pageservers +const_1737308178999125000 == +{p1} +---- + +\* MV CONSTANT definitions azs +const_1737308178999126000 == +{az1, az2, az3} +---- + +\* SYMMETRY definition +symm_1737308178999127000 == +Permutations(const_1737308178999123000) \union Permutations(const_1737308178999124000) \union Permutations(const_1737308178999125000) \union Permutations(const_1737308178999126000) +---- + +\* CONSTANT definitions @modelParameterConstants:4max_commit_lsn +const_1737308178999128000 == +2 +---- + +\* CONSTANT definitions @modelParameterConstants:5az_mapping +const_1737308178999129000 == +[ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2} , az3 |-> {b3,s3}] +---- + +\* CONSTRAINT definition @modelParameterContraint:0 +constr_1737308178999130000 == +StateConstraint +---- +============================================================================= +\* Modification History +\* Created Sun Jan 19 18:36:19 CET 2025 by cs diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308183077/MC_TE.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308183077/MC_TE.out new file mode 100644 index 0000000000..00a833e2f0 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308183077/MC_TE.out @@ -0,0 +1,52 @@ +@!@!@STARTMSG 2262:0 @!@!@ +TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) +@!@!@ENDMSG 2262 @!@!@ +@!@!@STARTMSG 2187:0 @!@!@ +Running breadth-first search Model-Checking with fp 92 and seed -5681728403679829533 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11930] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +@!@!@ENDMSG 2187 @!@!@ +@!@!@STARTMSG 2220:0 @!@!@ +Starting SANY... +@!@!@ENDMSG 2220 @!@!@ +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla +Semantic processing of module Naturals +Semantic processing of module Integers +Semantic processing of module Sequences +Semantic processing of module FiniteSets +Semantic processing of module replicated +Semantic processing of module TLC +Semantic processing of module MC +@!@!@STARTMSG 2219:0 @!@!@ +SANY finished. +@!@!@ENDMSG 2219 @!@!@ +@!@!@STARTMSG 2185:0 @!@!@ +Starting... (2025-01-19 18:36:20) +@!@!@ENDMSG 2185 @!@!@ +@!@!@STARTMSG 2279:3 @!@!@ +Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. +@!@!@ENDMSG 2279 @!@!@ +@!@!@STARTMSG 2284:3 @!@!@ +Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. +@!@!@ENDMSG 2284 @!@!@ +@!@!@STARTMSG 2212:0 @!@!@ +Implied-temporal checking--satisfiability problem has 1 branches. +@!@!@ENDMSG 2212 @!@!@ +@!@!@STARTMSG 2189:0 @!@!@ +Computing initial states... +@!@!@ENDMSG 2189 @!@!@ +@!@!@STARTMSG 2107:1 @!@!@ +Invariant PsLagsSk is violated by the initial state: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])]) +/\ online = {b1, b2, b3, s1, s2, s3, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0]) + +@!@!@ENDMSG 2107 @!@!@ +@!@!@STARTMSG 2186:0 @!@!@ +Finished in 2710ms at (2025-01-19 18:36:21) +@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308183077/replicated.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308183077/replicated.tla new file mode 100644 index 0000000000..6ec5ff3f0f --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308183077/replicated.tla @@ -0,0 +1,134 @@ +---- MODULE replicated ---- + +EXTENDS Integers, FiniteSets + +VARIABLES broker_state, safekeeper_state, pageserver_state, online + + +CONSTANT + brokers, + safekeepers, + pageservers, + azs, + az_mapping + +CONSTANT + NULL + +CONSTANT + max_commit_lsn + +StateConstraint == + /\ \A s \in safekeepers: + /\ safekeeper_state[s].commit_lsn <= max_commit_lsn + /\ \A b \in brokers: + /\ \A s \in DOMAIN broker_state[b].sk: + /\ broker_state[b].sk[s].commit_lsn <= max_commit_lsn + + +InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0] +InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] +InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] +InitOnline == safekeepers \cup brokers \cup pageservers + +Init == + /\ broker_state = [b \in brokers |-> InitBroker] + /\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper] + /\ pageserver_state = [p \in pageservers |-> InitPageserver] + /\ online = InitOnline + +NodeOnlineOffline == + /\ online' = CHOOSE ss \in SUBSET InitOnline: + /\ Cardinality(ss \cap safekeepers) >= 2 + /\ Cardinality(ss \cap brokers) >= 2 + /\ ss \cap pageservers = pageservers \* assume no PS failures for now + /\ UNCHANGED <> + +SkCommit(s1, s2) == + /\ {s1, s2} \subseteq online + /\ s1 # s2 + /\ safekeeper_state[s1].commit_lsn = safekeeper_state[s2].commit_lsn + /\ LET + new_commit_lsn == safekeeper_state[s1].commit_lsn + 1 + IN + safekeeper_state' = [safekeeper_state EXCEPT + ![s1].commit_lsn = new_commit_lsn, + ![s2].commit_lsn = new_commit_lsn] + /\ UNCHANGED <> + +SkPeerRecovery(s1,s2) == + /\ {s1, s2} \subseteq online + /\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn + /\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn] + /\ UNCHANGED <> + +SkPushToBroker(s,b) == + /\ {s, b} \subseteq online + /\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn + THEN + LET + bsk == broker_state[b].sk + updbsk == [bsk EXCEPT ![s].commit_lsn = safekeeper_state[s].commit_lsn] + IN + [broker_state EXCEPT ![b].sk = updbsk] + ELSE broker_state + /\ UNCHANGED <> + +PsRecvBroker(b,p,s) == + /\ {b,p,s} \subseteq online + /\ LET + bsk == broker_state[b].sk[s] + psk == pageserver_state[p].sk[s] + updpsk == [psk EXCEPT !["commit_lsn"] = bsk.commit_lsn] + IN + pageserver_state' = IF bsk.commit_lsn > psk.commit_lsn + THEN [pageserver_state EXCEPT ![p].sk[s] = updpsk] + ELSE pageserver_state + /\ UNCHANGED <> + + +SksWithNewerWal(p) == + LET + ps == pageserver_state[p] + IN + {s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn} + +PsChooseSk(p) == + /\ {p} \subseteq online + /\ SksWithNewerWal(p) # {} + /\ pageserver_state' = [pageserver_state EXCEPT![p].preferred_sk = CHOOSE s \in SksWithNewerWal(p): TRUE] + /\ UNCHANGED <> + + +Next == + \/ NodeOnlineOffline + \/ \E s1 \in safekeepers: \E s2 \in safekeepers: + \/ SkCommit(s1, s2) + \/ SkPeerRecovery(s1, s2) + \/ \E s \in safekeepers: \E b \in brokers: SkPushToBroker(s, b) + \/ \E s \in safekeepers: \E b \in brokers: \E p \in pageservers: PsRecvBroker(b,p,s) + \/ \E p \in pageservers: PsChooseSk(p) + + +Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state,online>> + + +\* invariants + +PsLagsSk == \A p \in pageservers: \A s \in DOMAIN pageserver_state[p].sk: + /\ pageserver_state[p].sk[s].commit_lsn < safekeeper_state[s].commit_lsn + + +EventuallyLaggingSkIsNotPreferredSk == <>( + LET + sks == safekeeper_state + lagging_sks == { s \in safekeepers: \A s2 \in safekeepers: sks[s].commit_lsn <= sks[s2].commit_lsn } + preferred_sks == {pageserver_state[p].preferred_sk: p \in pageservers} + IN + preferred_sks \cap lagging_sks = {} + + ) + + + +==== \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308216766/MC.cfg b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308216766/MC.cfg new file mode 100644 index 0000000000..a3527c1e04 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308216766/MC.cfg @@ -0,0 +1,53 @@ +\* MV CONSTANT declarations +CONSTANTS +b1 = b1 +b2 = b2 +b3 = b3 +\* MV CONSTANT declarations +CONSTANTS +s1 = s1 +s2 = s2 +s3 = s3 +\* MV CONSTANT declarations +CONSTANTS +p1 = p1 +\* MV CONSTANT declarations +CONSTANTS +az1 = az1 +az2 = az2 +az3 = az3 +\* MV CONSTANT definitions +CONSTANT +brokers <- const_1737308198937133000 +\* CONSTANT declarations +CONSTANT NULL = NULL +\* MV CONSTANT definitions +CONSTANT +safekeepers <- const_1737308198937134000 +\* MV CONSTANT definitions +CONSTANT +pageservers <- const_1737308198937135000 +\* MV CONSTANT definitions +CONSTANT +azs <- const_1737308198937136000 +\* SYMMETRY definition +SYMMETRY symm_1737308198937137000 +\* CONSTANT definitions +CONSTANT +max_commit_lsn <- const_1737308198937138000 +\* CONSTANT definitions +CONSTANT +az_mapping <- const_1737308198937139000 +\* CONSTRAINT definition +CONSTRAINT +constr_1737308198937140000 +\* SPECIFICATION definition +SPECIFICATION +Spec +\* INVARIANT definition +INVARIANT +PsLagsSk +\* PROPERTY definition +PROPERTY +EventuallyLaggingSkIsNotPreferredSk +\* Generated on Sun Jan 19 18:36:38 CET 2025 \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308216766/MC.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308216766/MC.out new file mode 100644 index 0000000000..366883d749 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308216766/MC.out @@ -0,0 +1,53 @@ +@!@!@STARTMSG 2262:0 @!@!@ +TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) +@!@!@ENDMSG 2262 @!@!@ +@!@!@STARTMSG 2187:0 @!@!@ +Running breadth-first search Model-Checking with fp 39 and seed -9180611051874563891 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11941] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +@!@!@ENDMSG 2187 @!@!@ +@!@!@STARTMSG 2220:0 @!@!@ +Starting SANY... +@!@!@ENDMSG 2220 @!@!@ +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla +Semantic processing of module Naturals +Semantic processing of module Integers +Semantic processing of module Sequences +Semantic processing of module FiniteSets +Semantic processing of module replicated +Semantic processing of module TLC +Semantic processing of module MC +@!@!@STARTMSG 2219:0 @!@!@ +SANY finished. +@!@!@ENDMSG 2219 @!@!@ +@!@!@STARTMSG 2185:0 @!@!@ +Starting... (2025-01-19 18:36:40) +@!@!@ENDMSG 2185 @!@!@ +@!@!@STARTMSG 2279:3 @!@!@ +Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. +@!@!@ENDMSG 2279 @!@!@ +@!@!@STARTMSG 2284:3 @!@!@ +Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. +@!@!@ENDMSG 2284 @!@!@ +@!@!@STARTMSG 2212:0 @!@!@ +Implied-temporal checking--satisfiability problem has 1 branches. +@!@!@ENDMSG 2212 @!@!@ +@!@!@STARTMSG 2189:0 @!@!@ +Computing initial states... +@!@!@ENDMSG 2189 @!@!@ +@!@!@STARTMSG 2190:0 @!@!@ +Finished computing initial states: 1 distinct state generated at 2025-01-19 18:36:41. +@!@!@ENDMSG 2190 @!@!@ +@!@!@STARTMSG 2192:0 @!@!@ +Checking temporal properties for the current state space with 3587 total distinct states at (2025-01-19 18:36:44) +@!@!@ENDMSG 2192 @!@!@ +@!@!@STARTMSG 2267:0 @!@!@ +Finished checking temporal properties in 00s at 2025-01-19 18:36:44 +@!@!@ENDMSG 2267 @!@!@ +@!@!@STARTMSG 2200:0 @!@!@ +Progress(11) at 2025-01-19 18:36:44: 73.018 states generated (73.018 s/min), 8.206 distinct states found (8.206 ds/min), 4.615 states left on queue. +@!@!@ENDMSG 2200 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308216766/MC.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308216766/MC.tla new file mode 100644 index 0000000000..060f5935bc --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308216766/MC.tla @@ -0,0 +1,65 @@ +---- MODULE MC ---- +EXTENDS replicated, TLC + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +b1, b2, b3 +---- + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +s1, s2, s3 +---- + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +p1 +---- + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +az1, az2, az3 +---- + +\* MV CONSTANT definitions brokers +const_1737308198937133000 == +{b1, b2, b3} +---- + +\* MV CONSTANT definitions safekeepers +const_1737308198937134000 == +{s1, s2, s3} +---- + +\* MV CONSTANT definitions pageservers +const_1737308198937135000 == +{p1} +---- + +\* MV CONSTANT definitions azs +const_1737308198937136000 == +{az1, az2, az3} +---- + +\* SYMMETRY definition +symm_1737308198937137000 == +Permutations(const_1737308198937133000) \union Permutations(const_1737308198937134000) \union Permutations(const_1737308198937135000) \union Permutations(const_1737308198937136000) +---- + +\* CONSTANT definitions @modelParameterConstants:4max_commit_lsn +const_1737308198937138000 == +2 +---- + +\* CONSTANT definitions @modelParameterConstants:5az_mapping +const_1737308198937139000 == +[ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2} , az3 |-> {b3,s3}] +---- + +\* CONSTRAINT definition @modelParameterContraint:0 +constr_1737308198937140000 == +StateConstraint +---- +============================================================================= +\* Modification History +\* Created Sun Jan 19 18:36:38 CET 2025 by cs diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308216766/MC_TE.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308216766/MC_TE.out new file mode 100644 index 0000000000..366883d749 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308216766/MC_TE.out @@ -0,0 +1,53 @@ +@!@!@STARTMSG 2262:0 @!@!@ +TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) +@!@!@ENDMSG 2262 @!@!@ +@!@!@STARTMSG 2187:0 @!@!@ +Running breadth-first search Model-Checking with fp 39 and seed -9180611051874563891 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11941] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +@!@!@ENDMSG 2187 @!@!@ +@!@!@STARTMSG 2220:0 @!@!@ +Starting SANY... +@!@!@ENDMSG 2220 @!@!@ +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla +Semantic processing of module Naturals +Semantic processing of module Integers +Semantic processing of module Sequences +Semantic processing of module FiniteSets +Semantic processing of module replicated +Semantic processing of module TLC +Semantic processing of module MC +@!@!@STARTMSG 2219:0 @!@!@ +SANY finished. +@!@!@ENDMSG 2219 @!@!@ +@!@!@STARTMSG 2185:0 @!@!@ +Starting... (2025-01-19 18:36:40) +@!@!@ENDMSG 2185 @!@!@ +@!@!@STARTMSG 2279:3 @!@!@ +Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. +@!@!@ENDMSG 2279 @!@!@ +@!@!@STARTMSG 2284:3 @!@!@ +Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. +@!@!@ENDMSG 2284 @!@!@ +@!@!@STARTMSG 2212:0 @!@!@ +Implied-temporal checking--satisfiability problem has 1 branches. +@!@!@ENDMSG 2212 @!@!@ +@!@!@STARTMSG 2189:0 @!@!@ +Computing initial states... +@!@!@ENDMSG 2189 @!@!@ +@!@!@STARTMSG 2190:0 @!@!@ +Finished computing initial states: 1 distinct state generated at 2025-01-19 18:36:41. +@!@!@ENDMSG 2190 @!@!@ +@!@!@STARTMSG 2192:0 @!@!@ +Checking temporal properties for the current state space with 3587 total distinct states at (2025-01-19 18:36:44) +@!@!@ENDMSG 2192 @!@!@ +@!@!@STARTMSG 2267:0 @!@!@ +Finished checking temporal properties in 00s at 2025-01-19 18:36:44 +@!@!@ENDMSG 2267 @!@!@ +@!@!@STARTMSG 2200:0 @!@!@ +Progress(11) at 2025-01-19 18:36:44: 73.018 states generated (73.018 s/min), 8.206 distinct states found (8.206 ds/min), 4.615 states left on queue. +@!@!@ENDMSG 2200 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308216766/replicated.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308216766/replicated.tla new file mode 100644 index 0000000000..33971e3071 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308216766/replicated.tla @@ -0,0 +1,134 @@ +---- MODULE replicated ---- + +EXTENDS Integers, FiniteSets + +VARIABLES broker_state, safekeeper_state, pageserver_state, online + + +CONSTANT + brokers, + safekeepers, + pageservers, + azs, + az_mapping + +CONSTANT + NULL + +CONSTANT + max_commit_lsn + +StateConstraint == + /\ \A s \in safekeepers: + /\ safekeeper_state[s].commit_lsn <= max_commit_lsn + /\ \A b \in brokers: + /\ \A s \in DOMAIN broker_state[b].sk: + /\ broker_state[b].sk[s].commit_lsn <= max_commit_lsn + + +InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0] +InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] +InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] +InitOnline == safekeepers \cup brokers \cup pageservers + +Init == + /\ broker_state = [b \in brokers |-> InitBroker] + /\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper] + /\ pageserver_state = [p \in pageservers |-> InitPageserver] + /\ online = InitOnline + +NodeOnlineOffline == + /\ online' = CHOOSE ss \in SUBSET InitOnline: + /\ Cardinality(ss \cap safekeepers) >= 2 + /\ Cardinality(ss \cap brokers) >= 2 + /\ ss \cap pageservers = pageservers \* assume no PS failures for now + /\ UNCHANGED <> + +SkCommit(s1, s2) == + /\ {s1, s2} \subseteq online + /\ s1 # s2 + /\ safekeeper_state[s1].commit_lsn = safekeeper_state[s2].commit_lsn + /\ LET + new_commit_lsn == safekeeper_state[s1].commit_lsn + 1 + IN + safekeeper_state' = [safekeeper_state EXCEPT + ![s1].commit_lsn = new_commit_lsn, + ![s2].commit_lsn = new_commit_lsn] + /\ UNCHANGED <> + +SkPeerRecovery(s1,s2) == + /\ {s1, s2} \subseteq online + /\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn + /\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn] + /\ UNCHANGED <> + +SkPushToBroker(s,b) == + /\ {s, b} \subseteq online + /\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn + THEN + LET + bsk == broker_state[b].sk + updbsk == [bsk EXCEPT ![s].commit_lsn = safekeeper_state[s].commit_lsn] + IN + [broker_state EXCEPT ![b].sk = updbsk] + ELSE broker_state + /\ UNCHANGED <> + +PsRecvBroker(b,p,s) == + /\ {b,p,s} \subseteq online + /\ LET + bsk == broker_state[b].sk[s] + psk == pageserver_state[p].sk[s] + updpsk == [psk EXCEPT !["commit_lsn"] = bsk.commit_lsn] + IN + pageserver_state' = IF bsk.commit_lsn > psk.commit_lsn + THEN [pageserver_state EXCEPT ![p].sk[s] = updpsk] + ELSE pageserver_state + /\ UNCHANGED <> + + +SksWithNewerWal(p) == + LET + ps == pageserver_state[p] + IN + {s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn} + +PsChooseSk(p) == + /\ {p} \subseteq online + /\ SksWithNewerWal(p) # {} + /\ pageserver_state' = [pageserver_state EXCEPT![p].preferred_sk = CHOOSE s \in SksWithNewerWal(p): TRUE] + /\ UNCHANGED <> + + +Next == + \/ NodeOnlineOffline + \/ \E s1 \in safekeepers: \E s2 \in safekeepers: + \/ SkCommit(s1, s2) + \/ SkPeerRecovery(s1, s2) + \/ \E s \in safekeepers: \E b \in brokers: SkPushToBroker(s, b) + \/ \E s \in safekeepers: \E b \in brokers: \E p \in pageservers: PsRecvBroker(b,p,s) + \/ \E p \in pageservers: PsChooseSk(p) + + +Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state,online>> + + +\* invariants + +PsLagsSk == \A p \in pageservers: \A s \in DOMAIN pageserver_state[p].sk: + /\ pageserver_state[p].sk[s].commit_lsn <= safekeeper_state[s].commit_lsn + + +EventuallyLaggingSkIsNotPreferredSk == <>( + LET + sks == safekeeper_state + lagging_sks == { s \in safekeepers: \A s2 \in safekeepers: sks[s].commit_lsn <= sks[s2].commit_lsn } + preferred_sks == {pageserver_state[p].preferred_sk: p \in pageservers} + IN + preferred_sks \cap lagging_sks = {} + + ) + + + +==== \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308355472/MC.cfg b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308355472/MC.cfg new file mode 100644 index 0000000000..8159238beb --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308355472/MC.cfg @@ -0,0 +1,53 @@ +\* MV CONSTANT declarations +CONSTANTS +b1 = b1 +b2 = b2 +b3 = b3 +\* MV CONSTANT declarations +CONSTANTS +s1 = s1 +s2 = s2 +s3 = s3 +\* MV CONSTANT declarations +CONSTANTS +p1 = p1 +\* MV CONSTANT declarations +CONSTANTS +az1 = az1 +az2 = az2 +az3 = az3 +\* MV CONSTANT definitions +CONSTANT +brokers <- const_1737308284086143000 +\* CONSTANT declarations +CONSTANT NULL = NULL +\* MV CONSTANT definitions +CONSTANT +safekeepers <- const_1737308284086144000 +\* MV CONSTANT definitions +CONSTANT +pageservers <- const_1737308284086145000 +\* MV CONSTANT definitions +CONSTANT +azs <- const_1737308284086146000 +\* SYMMETRY definition +SYMMETRY symm_1737308284086147000 +\* CONSTANT definitions +CONSTANT +max_commit_lsn <- const_1737308284086148000 +\* CONSTANT definitions +CONSTANT +az_mapping <- const_1737308284086149000 +\* CONSTRAINT definition +CONSTRAINT +constr_1737308284086150000 +\* SPECIFICATION definition +SPECIFICATION +Spec +\* INVARIANT definition +INVARIANT +PsLagsSk +\* PROPERTY definition +PROPERTY +EventuallyLaggingSkIsNotPreferredSk +\* Generated on Sun Jan 19 18:38:04 CET 2025 \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308355472/MC.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308355472/MC.out new file mode 100644 index 0000000000..72ebe05b45 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308355472/MC.out @@ -0,0 +1,354 @@ +@!@!@STARTMSG 2262:0 @!@!@ +TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) +@!@!@ENDMSG 2262 @!@!@ +@!@!@STARTMSG 2187:0 @!@!@ +Running breadth-first search Model-Checking with fp 96 and seed 147884281130356166 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 12007] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +@!@!@ENDMSG 2187 @!@!@ +@!@!@STARTMSG 2220:0 @!@!@ +Starting SANY... +@!@!@ENDMSG 2220 @!@!@ +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla +Semantic processing of module Naturals +Semantic processing of module Integers +Semantic processing of module Sequences +Semantic processing of module FiniteSets +Semantic processing of module replicated +Semantic processing of module TLC +Semantic processing of module MC +@!@!@STARTMSG 2219:0 @!@!@ +SANY finished. +@!@!@ENDMSG 2219 @!@!@ +@!@!@STARTMSG 2185:0 @!@!@ +Starting... (2025-01-19 18:38:05) +@!@!@ENDMSG 2185 @!@!@ +@!@!@STARTMSG 2279:3 @!@!@ +Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. +@!@!@ENDMSG 2279 @!@!@ +@!@!@STARTMSG 2284:3 @!@!@ +Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. +@!@!@ENDMSG 2284 @!@!@ +@!@!@STARTMSG 2212:0 @!@!@ +Implied-temporal checking--satisfiability problem has 1 branches. +@!@!@ENDMSG 2212 @!@!@ +@!@!@STARTMSG 2189:0 @!@!@ +Computing initial states... +@!@!@ENDMSG 2189 @!@!@ +@!@!@STARTMSG 2190:0 @!@!@ +Finished computing initial states: 1 distinct state generated at 2025-01-19 18:38:06. +@!@!@ENDMSG 2190 @!@!@ +@!@!@STARTMSG 2192:0 @!@!@ +Checking temporal properties for the current state space with 3861 total distinct states at (2025-01-19 18:38:09) +@!@!@ENDMSG 2192 @!@!@ +@!@!@STARTMSG 2267:0 @!@!@ +Finished checking temporal properties in 00s at 2025-01-19 18:38:09 +@!@!@ENDMSG 2267 @!@!@ +@!@!@STARTMSG 2200:0 @!@!@ +Progress(11) at 2025-01-19 18:38:09: 77.856 states generated (77.856 s/min), 8.653 distinct states found (8.653 ds/min), 4.790 states left on queue. +@!@!@ENDMSG 2200 @!@!@ +@!@!@STARTMSG 2192:0 @!@!@ +Checking temporal properties for the current state space with 197257 total distinct states at (2025-01-19 18:39:09) +@!@!@ENDMSG 2192 @!@!@ +@!@!@STARTMSG 2267:0 @!@!@ +Finished checking temporal properties in 00s at 2025-01-19 18:39:09 +@!@!@ENDMSG 2267 @!@!@ +@!@!@STARTMSG 2200:0 @!@!@ +Progress(20) at 2025-01-19 18:39:09: 3.084.377 states generated (3.006.521 s/min), 204.964 distinct states found (196.311 ds/min), 7.704 states left on queue. +@!@!@ENDMSG 2200 @!@!@ +@!@!@STARTMSG 2200:0 @!@!@ +Progress(25) at 2025-01-19 18:39:12: 3.224.329 states generated, 208.868 distinct states found, 0 states left on queue. +@!@!@ENDMSG 2200 @!@!@ +@!@!@STARTMSG 2192:0 @!@!@ +Checking temporal properties for the complete state space with 208868 total distinct states at (2025-01-19 18:39:12) +@!@!@ENDMSG 2192 @!@!@ +@!@!@STARTMSG 2267:0 @!@!@ +Finished checking temporal properties in 00s at 2025-01-19 18:39:12 +@!@!@ENDMSG 2267 @!@!@ +@!@!@STARTMSG 2193:0 @!@!@ +Model checking completed. No error has been found. + Estimates of the probability that TLC did not check all reachable states + because two distinct states had the same fingerprint: + calculated (optimistic): val = 3.4E-8 + based on the actual fingerprints: val = 6.3E-10 +@!@!@ENDMSG 2193 @!@!@ +@!@!@STARTMSG 2201:0 @!@!@ +The coverage statistics at 2025-01-19 18:39:14 +@!@!@ENDMSG 2201 @!@!@ +@!@!@STARTMSG 2773:0 @!@!@ +: 1:1 +@!@!@ENDMSG 2773 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 35, col 5 to line 38, col 26 of module replicated: 1 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 14290:208868 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 41, col 8 to line 44, col 44 of module replicated: 208868 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 41, col 18 to line 44, col 44 of module replicated: 208868 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 42, col 9 to line 44, col 44 of module replicated: 22348876 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 42, col 12 to line 42, col 48 of module replicated: 22348876 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 43, col 12 to line 43, col 44 of module replicated: 8981324 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 44, col 12 to line 44, col 44 of module replicated: 2924152 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 41, col 32 to line 41, col 48 of module replicated: 208868 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 45, col 8 to line 45, col 67 of module replicated: 208868 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 84:530666 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 48, col 8 to line 48, col 32 of module replicated: 2410478 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 48, col 8 to line 48, col 15 of module replicated: 1879812:4246157 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 48, col 27 to line 48, col 32 of module replicated: 1879812 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 49, col 8 to line 49, col 14 of module replicated: 1643803 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 49, col 8 to line 49, col 9 of module replicated: 1113137 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 49, col 13 to line 49, col 14 of module replicated: 1113137 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 50, col 8 to line 50, col 72 of module replicated: 1170534 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 50, col 8 to line 50, col 38 of module replicated: 639868 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 50, col 42 to line 50, col 72 of module replicated: 639868 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 54, col 13 to line 56, col 50 of module replicated: 530666 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 57, col 8 to line 57, col 58 of module replicated: 530666 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 682:54601 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 60, col 8 to line 60, col 32 of module replicated: 1934413 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 60, col 8 to line 60, col 15 of module replicated: 1879812:4246157 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 60, col 27 to line 60, col 32 of module replicated: 1879812 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 61, col 8 to line 61, col 72 of module replicated: 54601 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 61, col 8 to line 61, col 38 of module replicated: 1113137 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 61, col 42 to line 61, col 72 of module replicated: 1113137 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 62, col 8 to line 62, col 102 of module replicated: 54601 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 63, col 8 to line 63, col 58 of module replicated: 54601 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 45241:1113137 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 66, col 8 to line 66, col 30 of module replicated: 2992949 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 66, col 8 to line 66, col 13 of module replicated: 1879812:4412756 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 66, col 25 to line 66, col 30 of module replicated: 1879812 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 67, col 8 to line 74, col 29 of module replicated: 1113137 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 67, col 24 to line 74, col 29 of module replicated: 1113137 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 67, col 27 to line 67, col 91 of module replicated: 1113137 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 70, col 28 to line 70, col 45 of module replicated: 611653 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 71, col 31 to line 71, col 91 of module replicated: 611653 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 73, col 17 to line 73, col 54 of module replicated: 611653 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 74, col 18 to line 74, col 29 of module replicated: 501484 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 75, col 8 to line 75, col 62 of module replicated: 1113137 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 90643:1113137 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 78, col 8 to line 78, col 31 of module replicated: 2992949 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 78, col 8 to line 78, col 14 of module replicated: 1879812:5525893 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 78, col 26 to line 78, col 31 of module replicated: 1879812 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 84, col 13 to line 86, col 37 of module replicated: 1113137 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 84, col 33 to line 86, col 37 of module replicated: 1113137 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 84, col 36 to line 84, col 66 of module replicated: 1113137 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 85, col 22 to line 85, col 66 of module replicated: 406880 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 86, col 22 to line 86, col 37 of module replicated: 706257 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 87, col 8 to line 87, col 58 of module replicated: 1113137 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 57927:203919 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 97, col 8 to line 97, col 27 of module replicated: 412787 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 97, col 8 to line 97, col 10 of module replicated: 208868:417736 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 97, col 22 to line 97, col 27 of module replicated: 208868 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 98, col 8 to line 98, col 30 of module replicated: 412787 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 98, col 8 to line 98, col 25 of module replicated: 208868 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 92, col 15 to line 92, col 33 of module replicated: 208868 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 94, col 5 to line 94, col 66 of module replicated: 208868 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 94, col 26 to line 94, col 65 of module replicated: 626604 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 94, col 12 to line 94, col 23 of module replicated: 208868 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 98, col 24 to line 98, col 24 of module replicated: 208868 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 98, col 29 to line 98, col 30 of module replicated: 208868 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 99, col 8 to line 99, col 109 of module replicated: 203919 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 99, col 28 to line 99, col 109 of module replicated: 203919 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 99, col 29 to line 99, col 44 of module replicated: 203919 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 99, col 52 to line 99, col 108 of module replicated: 203919 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 99, col 72 to line 99, col 108 of module replicated: 203919 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 99, col 105 to line 99, col 108 of module replicated: 203919 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 99, col 85 to line 99, col 102 of module replicated: 203919 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 92, col 15 to line 92, col 33 of module replicated: 203919 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + ||||line 94, col 5 to line 94, col 66 of module replicated: 203919:203919 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||line 94, col 26 to line 94, col 65 of module replicated: 611757 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||line 94, col 12 to line 94, col 23 of module replicated: 203919 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 99, col 101 to line 99, col 101 of module replicated: 203919 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 100, col 8 to line 100, col 58 of module replicated: 203919 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2774:0 @!@!@ + +@!@!@ENDMSG 2774 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 118, col 13 to line 119, col 81 of module replicated: 736274 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 118, col 35 to line 119, col 81 of module replicated: 736274 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 119, col 9 to line 119, col 81 of module replicated: 2208822 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 118, col 44 to line 118, col 72 of module replicated: 736274 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 118, col 22 to line 118, col 32 of module replicated: 736274 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2202:0 @!@!@ +End of statistics. +@!@!@ENDMSG 2202 @!@!@ +@!@!@STARTMSG 2200:0 @!@!@ +Progress(25) at 2025-01-19 18:39:14: 3.224.329 states generated (2.761.383 s/min), 208.868 distinct states found (178.878 ds/min), 0 states left on queue. +@!@!@ENDMSG 2200 @!@!@ +@!@!@STARTMSG 2199:0 @!@!@ +3224329 states generated, 208868 distinct states found, 0 states left on queue. +@!@!@ENDMSG 2199 @!@!@ +@!@!@STARTMSG 2194:0 @!@!@ +The depth of the complete state graph search is 25. +@!@!@ENDMSG 2194 @!@!@ +@!@!@STARTMSG 2268:0 @!@!@ +The average outdegree of the complete state graph is 1 (minimum is 0, the maximum 9 and the 95th percentile is 3). +@!@!@ENDMSG 2268 @!@!@ +@!@!@STARTMSG 2186:0 @!@!@ +Finished in 70074ms at (2025-01-19 18:39:14) +@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308355472/MC.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308355472/MC.tla new file mode 100644 index 0000000000..434bbc3bd0 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308355472/MC.tla @@ -0,0 +1,65 @@ +---- MODULE MC ---- +EXTENDS replicated, TLC + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +b1, b2, b3 +---- + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +s1, s2, s3 +---- + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +p1 +---- + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +az1, az2, az3 +---- + +\* MV CONSTANT definitions brokers +const_1737308284086143000 == +{b1, b2, b3} +---- + +\* MV CONSTANT definitions safekeepers +const_1737308284086144000 == +{s1, s2, s3} +---- + +\* MV CONSTANT definitions pageservers +const_1737308284086145000 == +{p1} +---- + +\* MV CONSTANT definitions azs +const_1737308284086146000 == +{az1, az2, az3} +---- + +\* SYMMETRY definition +symm_1737308284086147000 == +Permutations(const_1737308284086143000) \union Permutations(const_1737308284086144000) \union Permutations(const_1737308284086145000) \union Permutations(const_1737308284086146000) +---- + +\* CONSTANT definitions @modelParameterConstants:4max_commit_lsn +const_1737308284086148000 == +2 +---- + +\* CONSTANT definitions @modelParameterConstants:5az_mapping +const_1737308284086149000 == +[ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2} , az3 |-> {b3,s3}] +---- + +\* CONSTRAINT definition @modelParameterContraint:0 +constr_1737308284086150000 == +StateConstraint +---- +============================================================================= +\* Modification History +\* Created Sun Jan 19 18:38:04 CET 2025 by cs diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308355472/MC_TE.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308355472/MC_TE.out new file mode 100644 index 0000000000..72ebe05b45 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308355472/MC_TE.out @@ -0,0 +1,354 @@ +@!@!@STARTMSG 2262:0 @!@!@ +TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) +@!@!@ENDMSG 2262 @!@!@ +@!@!@STARTMSG 2187:0 @!@!@ +Running breadth-first search Model-Checking with fp 96 and seed 147884281130356166 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 12007] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +@!@!@ENDMSG 2187 @!@!@ +@!@!@STARTMSG 2220:0 @!@!@ +Starting SANY... +@!@!@ENDMSG 2220 @!@!@ +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla +Semantic processing of module Naturals +Semantic processing of module Integers +Semantic processing of module Sequences +Semantic processing of module FiniteSets +Semantic processing of module replicated +Semantic processing of module TLC +Semantic processing of module MC +@!@!@STARTMSG 2219:0 @!@!@ +SANY finished. +@!@!@ENDMSG 2219 @!@!@ +@!@!@STARTMSG 2185:0 @!@!@ +Starting... (2025-01-19 18:38:05) +@!@!@ENDMSG 2185 @!@!@ +@!@!@STARTMSG 2279:3 @!@!@ +Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. +@!@!@ENDMSG 2279 @!@!@ +@!@!@STARTMSG 2284:3 @!@!@ +Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. +@!@!@ENDMSG 2284 @!@!@ +@!@!@STARTMSG 2212:0 @!@!@ +Implied-temporal checking--satisfiability problem has 1 branches. +@!@!@ENDMSG 2212 @!@!@ +@!@!@STARTMSG 2189:0 @!@!@ +Computing initial states... +@!@!@ENDMSG 2189 @!@!@ +@!@!@STARTMSG 2190:0 @!@!@ +Finished computing initial states: 1 distinct state generated at 2025-01-19 18:38:06. +@!@!@ENDMSG 2190 @!@!@ +@!@!@STARTMSG 2192:0 @!@!@ +Checking temporal properties for the current state space with 3861 total distinct states at (2025-01-19 18:38:09) +@!@!@ENDMSG 2192 @!@!@ +@!@!@STARTMSG 2267:0 @!@!@ +Finished checking temporal properties in 00s at 2025-01-19 18:38:09 +@!@!@ENDMSG 2267 @!@!@ +@!@!@STARTMSG 2200:0 @!@!@ +Progress(11) at 2025-01-19 18:38:09: 77.856 states generated (77.856 s/min), 8.653 distinct states found (8.653 ds/min), 4.790 states left on queue. +@!@!@ENDMSG 2200 @!@!@ +@!@!@STARTMSG 2192:0 @!@!@ +Checking temporal properties for the current state space with 197257 total distinct states at (2025-01-19 18:39:09) +@!@!@ENDMSG 2192 @!@!@ +@!@!@STARTMSG 2267:0 @!@!@ +Finished checking temporal properties in 00s at 2025-01-19 18:39:09 +@!@!@ENDMSG 2267 @!@!@ +@!@!@STARTMSG 2200:0 @!@!@ +Progress(20) at 2025-01-19 18:39:09: 3.084.377 states generated (3.006.521 s/min), 204.964 distinct states found (196.311 ds/min), 7.704 states left on queue. +@!@!@ENDMSG 2200 @!@!@ +@!@!@STARTMSG 2200:0 @!@!@ +Progress(25) at 2025-01-19 18:39:12: 3.224.329 states generated, 208.868 distinct states found, 0 states left on queue. +@!@!@ENDMSG 2200 @!@!@ +@!@!@STARTMSG 2192:0 @!@!@ +Checking temporal properties for the complete state space with 208868 total distinct states at (2025-01-19 18:39:12) +@!@!@ENDMSG 2192 @!@!@ +@!@!@STARTMSG 2267:0 @!@!@ +Finished checking temporal properties in 00s at 2025-01-19 18:39:12 +@!@!@ENDMSG 2267 @!@!@ +@!@!@STARTMSG 2193:0 @!@!@ +Model checking completed. No error has been found. + Estimates of the probability that TLC did not check all reachable states + because two distinct states had the same fingerprint: + calculated (optimistic): val = 3.4E-8 + based on the actual fingerprints: val = 6.3E-10 +@!@!@ENDMSG 2193 @!@!@ +@!@!@STARTMSG 2201:0 @!@!@ +The coverage statistics at 2025-01-19 18:39:14 +@!@!@ENDMSG 2201 @!@!@ +@!@!@STARTMSG 2773:0 @!@!@ +: 1:1 +@!@!@ENDMSG 2773 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 35, col 5 to line 38, col 26 of module replicated: 1 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 14290:208868 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 41, col 8 to line 44, col 44 of module replicated: 208868 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 41, col 18 to line 44, col 44 of module replicated: 208868 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 42, col 9 to line 44, col 44 of module replicated: 22348876 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 42, col 12 to line 42, col 48 of module replicated: 22348876 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 43, col 12 to line 43, col 44 of module replicated: 8981324 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 44, col 12 to line 44, col 44 of module replicated: 2924152 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 41, col 32 to line 41, col 48 of module replicated: 208868 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 45, col 8 to line 45, col 67 of module replicated: 208868 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 84:530666 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 48, col 8 to line 48, col 32 of module replicated: 2410478 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 48, col 8 to line 48, col 15 of module replicated: 1879812:4246157 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 48, col 27 to line 48, col 32 of module replicated: 1879812 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 49, col 8 to line 49, col 14 of module replicated: 1643803 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 49, col 8 to line 49, col 9 of module replicated: 1113137 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 49, col 13 to line 49, col 14 of module replicated: 1113137 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 50, col 8 to line 50, col 72 of module replicated: 1170534 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 50, col 8 to line 50, col 38 of module replicated: 639868 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 50, col 42 to line 50, col 72 of module replicated: 639868 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 54, col 13 to line 56, col 50 of module replicated: 530666 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 57, col 8 to line 57, col 58 of module replicated: 530666 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 682:54601 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 60, col 8 to line 60, col 32 of module replicated: 1934413 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 60, col 8 to line 60, col 15 of module replicated: 1879812:4246157 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 60, col 27 to line 60, col 32 of module replicated: 1879812 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 61, col 8 to line 61, col 72 of module replicated: 54601 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 61, col 8 to line 61, col 38 of module replicated: 1113137 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 61, col 42 to line 61, col 72 of module replicated: 1113137 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 62, col 8 to line 62, col 102 of module replicated: 54601 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 63, col 8 to line 63, col 58 of module replicated: 54601 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 45241:1113137 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 66, col 8 to line 66, col 30 of module replicated: 2992949 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 66, col 8 to line 66, col 13 of module replicated: 1879812:4412756 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 66, col 25 to line 66, col 30 of module replicated: 1879812 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 67, col 8 to line 74, col 29 of module replicated: 1113137 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 67, col 24 to line 74, col 29 of module replicated: 1113137 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 67, col 27 to line 67, col 91 of module replicated: 1113137 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 70, col 28 to line 70, col 45 of module replicated: 611653 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 71, col 31 to line 71, col 91 of module replicated: 611653 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 73, col 17 to line 73, col 54 of module replicated: 611653 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 74, col 18 to line 74, col 29 of module replicated: 501484 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 75, col 8 to line 75, col 62 of module replicated: 1113137 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 90643:1113137 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 78, col 8 to line 78, col 31 of module replicated: 2992949 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 78, col 8 to line 78, col 14 of module replicated: 1879812:5525893 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 78, col 26 to line 78, col 31 of module replicated: 1879812 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 84, col 13 to line 86, col 37 of module replicated: 1113137 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 84, col 33 to line 86, col 37 of module replicated: 1113137 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 84, col 36 to line 84, col 66 of module replicated: 1113137 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 85, col 22 to line 85, col 66 of module replicated: 406880 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 86, col 22 to line 86, col 37 of module replicated: 706257 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 87, col 8 to line 87, col 58 of module replicated: 1113137 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 57927:203919 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 97, col 8 to line 97, col 27 of module replicated: 412787 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 97, col 8 to line 97, col 10 of module replicated: 208868:417736 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 97, col 22 to line 97, col 27 of module replicated: 208868 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 98, col 8 to line 98, col 30 of module replicated: 412787 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 98, col 8 to line 98, col 25 of module replicated: 208868 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 92, col 15 to line 92, col 33 of module replicated: 208868 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 94, col 5 to line 94, col 66 of module replicated: 208868 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 94, col 26 to line 94, col 65 of module replicated: 626604 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 94, col 12 to line 94, col 23 of module replicated: 208868 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 98, col 24 to line 98, col 24 of module replicated: 208868 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 98, col 29 to line 98, col 30 of module replicated: 208868 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 99, col 8 to line 99, col 109 of module replicated: 203919 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 99, col 28 to line 99, col 109 of module replicated: 203919 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 99, col 29 to line 99, col 44 of module replicated: 203919 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 99, col 52 to line 99, col 108 of module replicated: 203919 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 99, col 72 to line 99, col 108 of module replicated: 203919 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 99, col 105 to line 99, col 108 of module replicated: 203919 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 99, col 85 to line 99, col 102 of module replicated: 203919 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 92, col 15 to line 92, col 33 of module replicated: 203919 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + ||||line 94, col 5 to line 94, col 66 of module replicated: 203919:203919 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||line 94, col 26 to line 94, col 65 of module replicated: 611757 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||line 94, col 12 to line 94, col 23 of module replicated: 203919 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 99, col 101 to line 99, col 101 of module replicated: 203919 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 100, col 8 to line 100, col 58 of module replicated: 203919 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2774:0 @!@!@ + +@!@!@ENDMSG 2774 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 118, col 13 to line 119, col 81 of module replicated: 736274 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 118, col 35 to line 119, col 81 of module replicated: 736274 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 119, col 9 to line 119, col 81 of module replicated: 2208822 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 118, col 44 to line 118, col 72 of module replicated: 736274 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 118, col 22 to line 118, col 32 of module replicated: 736274 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2202:0 @!@!@ +End of statistics. +@!@!@ENDMSG 2202 @!@!@ +@!@!@STARTMSG 2200:0 @!@!@ +Progress(25) at 2025-01-19 18:39:14: 3.224.329 states generated (2.761.383 s/min), 208.868 distinct states found (178.878 ds/min), 0 states left on queue. +@!@!@ENDMSG 2200 @!@!@ +@!@!@STARTMSG 2199:0 @!@!@ +3224329 states generated, 208868 distinct states found, 0 states left on queue. +@!@!@ENDMSG 2199 @!@!@ +@!@!@STARTMSG 2194:0 @!@!@ +The depth of the complete state graph search is 25. +@!@!@ENDMSG 2194 @!@!@ +@!@!@STARTMSG 2268:0 @!@!@ +The average outdegree of the complete state graph is 1 (minimum is 0, the maximum 9 and the 95th percentile is 3). +@!@!@ENDMSG 2268 @!@!@ +@!@!@STARTMSG 2186:0 @!@!@ +Finished in 70074ms at (2025-01-19 18:39:14) +@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308355472/replicated.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308355472/replicated.tla new file mode 100644 index 0000000000..33971e3071 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308355472/replicated.tla @@ -0,0 +1,134 @@ +---- MODULE replicated ---- + +EXTENDS Integers, FiniteSets + +VARIABLES broker_state, safekeeper_state, pageserver_state, online + + +CONSTANT + brokers, + safekeepers, + pageservers, + azs, + az_mapping + +CONSTANT + NULL + +CONSTANT + max_commit_lsn + +StateConstraint == + /\ \A s \in safekeepers: + /\ safekeeper_state[s].commit_lsn <= max_commit_lsn + /\ \A b \in brokers: + /\ \A s \in DOMAIN broker_state[b].sk: + /\ broker_state[b].sk[s].commit_lsn <= max_commit_lsn + + +InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0] +InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] +InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] +InitOnline == safekeepers \cup brokers \cup pageservers + +Init == + /\ broker_state = [b \in brokers |-> InitBroker] + /\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper] + /\ pageserver_state = [p \in pageservers |-> InitPageserver] + /\ online = InitOnline + +NodeOnlineOffline == + /\ online' = CHOOSE ss \in SUBSET InitOnline: + /\ Cardinality(ss \cap safekeepers) >= 2 + /\ Cardinality(ss \cap brokers) >= 2 + /\ ss \cap pageservers = pageservers \* assume no PS failures for now + /\ UNCHANGED <> + +SkCommit(s1, s2) == + /\ {s1, s2} \subseteq online + /\ s1 # s2 + /\ safekeeper_state[s1].commit_lsn = safekeeper_state[s2].commit_lsn + /\ LET + new_commit_lsn == safekeeper_state[s1].commit_lsn + 1 + IN + safekeeper_state' = [safekeeper_state EXCEPT + ![s1].commit_lsn = new_commit_lsn, + ![s2].commit_lsn = new_commit_lsn] + /\ UNCHANGED <> + +SkPeerRecovery(s1,s2) == + /\ {s1, s2} \subseteq online + /\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn + /\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn] + /\ UNCHANGED <> + +SkPushToBroker(s,b) == + /\ {s, b} \subseteq online + /\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn + THEN + LET + bsk == broker_state[b].sk + updbsk == [bsk EXCEPT ![s].commit_lsn = safekeeper_state[s].commit_lsn] + IN + [broker_state EXCEPT ![b].sk = updbsk] + ELSE broker_state + /\ UNCHANGED <> + +PsRecvBroker(b,p,s) == + /\ {b,p,s} \subseteq online + /\ LET + bsk == broker_state[b].sk[s] + psk == pageserver_state[p].sk[s] + updpsk == [psk EXCEPT !["commit_lsn"] = bsk.commit_lsn] + IN + pageserver_state' = IF bsk.commit_lsn > psk.commit_lsn + THEN [pageserver_state EXCEPT ![p].sk[s] = updpsk] + ELSE pageserver_state + /\ UNCHANGED <> + + +SksWithNewerWal(p) == + LET + ps == pageserver_state[p] + IN + {s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn} + +PsChooseSk(p) == + /\ {p} \subseteq online + /\ SksWithNewerWal(p) # {} + /\ pageserver_state' = [pageserver_state EXCEPT![p].preferred_sk = CHOOSE s \in SksWithNewerWal(p): TRUE] + /\ UNCHANGED <> + + +Next == + \/ NodeOnlineOffline + \/ \E s1 \in safekeepers: \E s2 \in safekeepers: + \/ SkCommit(s1, s2) + \/ SkPeerRecovery(s1, s2) + \/ \E s \in safekeepers: \E b \in brokers: SkPushToBroker(s, b) + \/ \E s \in safekeepers: \E b \in brokers: \E p \in pageservers: PsRecvBroker(b,p,s) + \/ \E p \in pageservers: PsChooseSk(p) + + +Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state,online>> + + +\* invariants + +PsLagsSk == \A p \in pageservers: \A s \in DOMAIN pageserver_state[p].sk: + /\ pageserver_state[p].sk[s].commit_lsn <= safekeeper_state[s].commit_lsn + + +EventuallyLaggingSkIsNotPreferredSk == <>( + LET + sks == safekeeper_state + lagging_sks == { s \in safekeepers: \A s2 \in safekeepers: sks[s].commit_lsn <= sks[s2].commit_lsn } + preferred_sks == {pageserver_state[p].preferred_sk: p \in pageservers} + IN + preferred_sks \cap lagging_sks = {} + + ) + + + +==== \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1.launch b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1.launch index e7455da5fd..a09d0d0885 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1.launch +++ b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1.launch @@ -12,7 +12,7 @@ - + @@ -21,10 +21,12 @@ - + - + + + @@ -35,9 +37,9 @@ - + - + diff --git a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737296416956.launch b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737296416956.launch deleted file mode 100644 index b6473f673b..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737296416956.launch +++ /dev/null @@ -1,38 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737297534393.launch b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737297534393.launch deleted file mode 100644 index 2d71f66906..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737297534393.launch +++ /dev/null @@ -1,40 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737297999722.launch b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737297999722.launch deleted file mode 100644 index 1a09cb6ee5..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737297999722.launch +++ /dev/null @@ -1,40 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737299352762.launch b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737299352762.launch deleted file mode 100644 index d7f0f71f05..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737299352762.launch +++ /dev/null @@ -1,42 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737301172627.launch b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737301172627.launch deleted file mode 100644 index 3acafd183d..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737301172627.launch +++ /dev/null @@ -1,58 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737301223409.launch b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737301223409.launch deleted file mode 100644 index 79f0c2c1e8..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737301223409.launch +++ /dev/null @@ -1,58 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737299381423.launch b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737307595008.launch similarity index 99% rename from storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737299381423.launch rename to storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737307595008.launch index 20569969c6..0c3da56e23 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737299381423.launch +++ b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737307595008.launch @@ -2,7 +2,7 @@ - + diff --git a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737299469039.launch b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737307621596.launch similarity index 99% rename from storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737299469039.launch rename to storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737307621596.launch index 66fb925b63..7175e68a8c 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737299469039.launch +++ b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737307621596.launch @@ -2,7 +2,7 @@ - + diff --git a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737299542008.launch b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737307660221.launch similarity index 99% rename from storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737299542008.launch rename to storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737307660221.launch index 971c7c5a63..5546705b36 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737299542008.launch +++ b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737307660221.launch @@ -2,7 +2,7 @@ - + diff --git a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737299744229.launch b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737307704621.launch similarity index 99% rename from storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737299744229.launch rename to storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737307704621.launch index d8b504d669..27f3ded305 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737299744229.launch +++ b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737307704621.launch @@ -2,7 +2,7 @@ - + diff --git a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737307769810.launch b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737307769810.launch new file mode 100644 index 0000000000..9d0cbac7dd --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737307769810.launch @@ -0,0 +1,58 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737307828738.launch b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737307828738.launch new file mode 100644 index 0000000000..eaecdfb9f5 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737307828738.launch @@ -0,0 +1,58 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737308024914.launch b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737308024914.launch new file mode 100644 index 0000000000..16960af230 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737308024914.launch @@ -0,0 +1,60 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737308183077.launch b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737308183077.launch new file mode 100644 index 0000000000..45c5003d49 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737308183077.launch @@ -0,0 +1,60 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737308216766.launch b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737308216766.launch new file mode 100644 index 0000000000..137c568ffe --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737308216766.launch @@ -0,0 +1,60 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737308355472.launch b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737308355472.launch new file mode 100644 index 0000000000..7d9ed3f070 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737308355472.launch @@ -0,0 +1,60 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +