diff --git a/storage_broker/spec/modelcheck.sh b/storage_broker/spec/modelcheck.sh new file mode 100755 index 0000000000..7b235d8ab9 --- /dev/null +++ b/storage_broker/spec/modelcheck.sh @@ -0,0 +1,52 @@ +#!/bin/bash + +# Usage: ./modelcheck.sh , e.g. +# ./modelcheck.sh models/MCProposerAcceptorStatic_p2_a3_t3_l3.cfg MCProposerAcceptorStatic.tla +# ./modelcheck.sh models/MCProposerAcceptorReconfig_p2_a3_t3_l3_c3.cfg MCProposerAcceptorReconfig.tla +CONFIG=$1 +SPEC=$2 + +MEM=4G +TOOLSPATH=/Applications/TLA+\ Toolbox.app/Contents/Eclipse/tla2tools.jar + +mkdir -p "tlc-results" +CONFIG_FILE=$(basename -- "$CONFIG") +outfilename="$SPEC-${CONFIG_FILE}-$(date --utc +%Y-%m-%d--%H-%M-%S)".log +outfile="tlc-results/$outfilename" +echo "saving results to $outfile" +touch $outfile + +# Save some info about the run. +GIT_REV=`git rev-parse --short HEAD` +INFO=`uname -a` + +# First for Linux, second for Mac. +CPUNAMELinux=$(lscpu | grep 'Model name' | cut -f 2 -d ":" | awk '{$1=$1}1') +CPUCORESLinux=`nproc` +CPUNAMEMac=`sysctl -n machdep.cpu.brand_string` +CPUCORESMac=`sysctl -n machdep.cpu.thread_count` + +echo "git revision: $GIT_REV" >> $outfile +echo "Platform: $INFO" >> $outfile +echo "CPU Info Linux: $CPUNAMELinux" >> $outfile +echo "CPU Cores Linux: $CPUCORESLinux" >> $outfile +echo "CPU Info Mac: $CPUNAMEMac" >> $outfile +echo "CPU Cores Mac: $CPUCORESMac" >> $outfile +echo "Spec: $SPEC" >> $outfile +echo "Config: $CONFIG" >> $outfile +echo "----" >> $outfile +cat $CONFIG >> $outfile +echo "" >> $outfile +echo "----" >> $outfile +echo "" >> $outfile + +# see +# https://lamport.azurewebsites.net/tla/current-tools.pdf +# for TLC options. +# OffHeapDiskFPSet is the optimal fingerprint set implementation +# https://docs.tlapl.us/codebase:architecture#fingerprint_sets_fpsets +# +# Add -simulate to run in infinite simulation mode. +# -coverage 1 is useful for profiling (check how many times actions are taken). +java -Xmx$MEM -XX:MaxDirectMemorySize=$MEM -XX:+UseParallelGC -Dtlc2.tool.fp.FPSet.impl=tlc2.tool.fp.OffHeapDiskFPSet \ + -cp "${TOOLSPATH}" tlc2.TLC $SPEC -config $CONFIG -workers auto -gzip | tee -a $outfile diff --git a/storage_broker/spec/modelcheck.sh~ b/storage_broker/spec/modelcheck.sh~ new file mode 100755 index 0000000000..0084a8c638 --- /dev/null +++ b/storage_broker/spec/modelcheck.sh~ @@ -0,0 +1,52 @@ +#!/bin/bash + +# Usage: ./modelcheck.sh , e.g. +# ./modelcheck.sh models/MCProposerAcceptorStatic_p2_a3_t3_l3.cfg MCProposerAcceptorStatic.tla +# ./modelcheck.sh models/MCProposerAcceptorReconfig_p2_a3_t3_l3_c3.cfg MCProposerAcceptorReconfig.tla +CONFIG=$1 +SPEC=$2 + +MEM=7G +TOOLSPATH="/opt/TLA+Toolbox/tla2tools.jar" + +mkdir -p "tlc-results" +CONFIG_FILE=$(basename -- "$CONFIG") +outfilename="$SPEC-${CONFIG_FILE}-$(date --utc +%Y-%m-%d--%H-%M-%S)".log +outfile="tlc-results/$outfilename" +echo "saving results to $outfile" +touch $outfile + +# Save some info about the run. +GIT_REV=`git rev-parse --short HEAD` +INFO=`uname -a` + +# First for Linux, second for Mac. +CPUNAMELinux=$(lscpu | grep 'Model name' | cut -f 2 -d ":" | awk '{$1=$1}1') +CPUCORESLinux=`nproc` +CPUNAMEMac=`sysctl -n machdep.cpu.brand_string` +CPUCORESMac=`sysctl -n machdep.cpu.thread_count` + +echo "git revision: $GIT_REV" >> $outfile +echo "Platform: $INFO" >> $outfile +echo "CPU Info Linux: $CPUNAMELinux" >> $outfile +echo "CPU Cores Linux: $CPUCORESLinux" >> $outfile +echo "CPU Info Mac: $CPUNAMEMac" >> $outfile +echo "CPU Cores Mac: $CPUCORESMac" >> $outfile +echo "Spec: $SPEC" >> $outfile +echo "Config: $CONFIG" >> $outfile +echo "----" >> $outfile +cat $CONFIG >> $outfile +echo "" >> $outfile +echo "----" >> $outfile +echo "" >> $outfile + +# see +# https://lamport.azurewebsites.net/tla/current-tools.pdf +# for TLC options. +# OffHeapDiskFPSet is the optimal fingerprint set implementation +# https://docs.tlapl.us/codebase:architecture#fingerprint_sets_fpsets +# +# Add -simulate to run in infinite simulation mode. +# -coverage 1 is useful for profiling (check how many times actions are taken). +java -Xmx$MEM -XX:MaxDirectMemorySize=$MEM -XX:+UseParallelGC -Dtlc2.tool.fp.FPSet.impl=tlc2.tool.fp.OffHeapDiskFPSet \ + -cp "${TOOLSPATH}" tlc2.TLC $SPEC -config $CONFIG -workers auto -gzip | tee -a $outfile diff --git a/storage_broker/spec/replicated/replicated.tla b/storage_broker/spec/replicated/replicated.tla index 33971e3071..8911d172d9 100644 --- a/storage_broker/spec/replicated/replicated.tla +++ b/storage_broker/spec/replicated/replicated.tla @@ -17,6 +17,20 @@ CONSTANT CONSTANT max_commit_lsn + +\* HELPERS + +Max(a,b) == IF a > b THEN a ELSE b + +(* The minimum of a non-empty set of integers *) +MinOfSet(S) == + CHOOSE x \in S: \A y \in S: x <= y + +(* The minimum of a non-empty set of integers *) +MaxOfSet(S) == + CHOOSE x \in S: \A y \in S: x >= y + +\* END HELPERS StateConstraint == /\ \A s \in safekeepers: @@ -25,9 +39,10 @@ StateConstraint == /\ \A s \in DOMAIN broker_state[b].sk: /\ broker_state[b].sk[s].commit_lsn <= max_commit_lsn + -InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0] -InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] +InitSafekeeper == [prune_lsn |-> 0, commit_lsn |-> 0, rx |-> [b \in brokers |-> NULL] ] +InitBroker == [sk |-> [s \in safekeepers |-> [prune_lsn |-> 0, commit_lsn |-> 0]]] InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] InitOnline == safekeepers \cup brokers \cup pageservers @@ -58,20 +73,21 @@ SkCommit(s1, s2) == SkPeerRecovery(s1,s2) == /\ {s1, s2} \subseteq online - /\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn + /\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn \* s2 has more WAL than s1 + /\ safekeeper_state[s2].prune_lsn < safekeeper_state[s1].commit_lsn \* s2 has not yet trimmed the WAL the WAL /\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn] /\ UNCHANGED <> SkPushToBroker(s,b) == /\ {s, b} \subseteq online - /\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn - THEN - LET - bsk == broker_state[b].sk - updbsk == [bsk EXCEPT ![s].commit_lsn = safekeeper_state[s].commit_lsn] - IN - [broker_state EXCEPT ![b].sk = updbsk] - ELSE broker_state + /\ broker_state' = LET + broker_side == broker_state[b].sk[s] + sk_side == safekeeper_state[s] + merged == [broker_side EXCEPT + !["commit_lsn"] = Max(broker_side.commit_lsn, sk_side.commit_lsn), + !["prune_lsn"] = Max(broker_side.prune_lsn, sk_side.prune_lsn)] + IN + [broker_state EXCEPT ![b].sk[s] = merged] /\ UNCHANGED <> PsRecvBroker(b,p,s) == @@ -86,6 +102,22 @@ PsRecvBroker(b,p,s) == ELSE pageserver_state /\ UNCHANGED <> + +SkRecvBroker(b,s) == + /\ {b,s} \subseteq online + /\ safekeeper_state' = [safekeeper_state EXCEPT ![s].rx[b] = broker_state[b]] + /\ UNCHANGED <> + +SkPrune(s) == + /\ {s} \subseteq online + /\ LET + sk == safekeeper_state[s] + skis == {<>: <> \in {<> \in { <>: b \in sk.rx }: bi # NULL} } + + IN + safekeeper_state' = safekeeper_state + /\ UNCHANGED <> + SksWithNewerWal(p) == LET @@ -105,7 +137,11 @@ Next == \/ \E s1 \in safekeepers: \E s2 \in safekeepers: \/ SkCommit(s1, s2) \/ SkPeerRecovery(s1, s2) - \/ \E s \in safekeepers: \E b \in brokers: SkPushToBroker(s, b) + \/ \E s \in safekeepers: \E b \in brokers: + \/ SkPushToBroker(s, b) + \/ SkRecvBroker(b, s) + \/ \E s \in safekeepers: + \/ SkPrune(s) \/ \E s \in safekeepers: \E b \in brokers: \E p \in pageservers: PsRecvBroker(b,p,s) \/ \E p \in pageservers: PsChooseSk(p) @@ -117,7 +153,12 @@ Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state,onl PsLagsSk == \A p \in pageservers: \A s \in DOMAIN pageserver_state[p].sk: /\ pageserver_state[p].sk[s].commit_lsn <= safekeeper_state[s].commit_lsn - + +PeerRecoveryIsPossible == + \A laggard \in (safekeepers \cap online): \E donor \in (safekeepers \cap online): + /\ (safekeeper_state[laggard].commit_lsn < safekeeper_state[donor].commit_lsn) + => safekeeper_state[donor].prune_lsn <= safekeeper_state[laggard].commit_lsn + EventuallyLaggingSkIsNotPreferredSk == <>( LET diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-23-52-40/0 b/storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-23-52-40/0 new file mode 100644 index 0000000000..abba549e8c Binary files /dev/null and b/storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-23-52-40/0 differ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-23-52-40/1 b/storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-23-52-40/1 new file mode 100644 index 0000000000..5d15e36051 Binary files /dev/null and b/storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-23-52-40/1 differ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-23-52-40/MC-0.st b/storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-23-52-40/MC-0.st new file mode 100644 index 0000000000..7d0052f5a8 Binary files /dev/null and b/storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-23-52-40/MC-0.st differ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-23-52-40/MC-1.st b/storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-23-52-40/MC-1.st new file mode 100644 index 0000000000..841d483d91 Binary files /dev/null and b/storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-23-52-40/MC-1.st differ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-23-52-40/MC-2.st b/storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-23-52-40/MC-2.st new file mode 100644 index 0000000000..552f720b5b Binary files /dev/null and b/storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-23-52-40/MC-2.st differ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-23-52-40/MC-3.st b/storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-23-52-40/MC-3.st new file mode 100644 index 0000000000..17245d3311 Binary files /dev/null and b/storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-23-52-40/MC-3.st differ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1/states/25-01-19-18-52-55/MC.st b/storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-23-52-40/MC.st similarity index 100% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1/states/25-01-19-18-52-55/MC.st rename to storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-23-52-40/MC.st diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1/states/25-01-19-18-52-55/MC_0.fp b/storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-23-52-40/MC_0.fp similarity index 100% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1/states/25-01-19-18-52-55/MC_0.fp rename to storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-23-52-40/MC_0.fp diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1/states/25-01-19-18-52-55/MC_1.fp b/storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-23-52-40/MC_1.fp similarity index 100% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1/states/25-01-19-18-52-55/MC_1.fp rename to storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-23-52-40/MC_1.fp diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1/states/25-01-19-18-52-55/nodes_0 b/storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-23-52-40/nodes_0 similarity index 100% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1/states/25-01-19-18-52-55/nodes_0 rename to storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-23-52-40/nodes_0 diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1/states/25-01-19-18-52-55/ptrs_0 b/storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-23-52-40/ptrs_0 similarity index 100% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1/states/25-01-19-18-52-55/ptrs_0 rename to storage_broker/spec/replicated/replicated.toolbox/Model_1/25-01-19-23-52-40/ptrs_0 diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.cfg b/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.cfg index f7828ba1ce..f1c0cf2115 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.cfg +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.cfg @@ -18,36 +18,37 @@ az2 = az2 az3 = az3 \* MV CONSTANT definitions CONSTANT -brokers <- const_1737309054555163000 +brokers <- const_1737327160682382000 \* CONSTANT declarations CONSTANT NULL = NULL \* MV CONSTANT definitions CONSTANT -safekeepers <- const_1737309054555164000 +safekeepers <- const_1737327160682383000 \* MV CONSTANT definitions CONSTANT -pageservers <- const_1737309054555165000 +pageservers <- const_1737327160682384000 \* MV CONSTANT definitions CONSTANT -azs <- const_1737309054555166000 +azs <- const_1737327160682385000 \* SYMMETRY definition -SYMMETRY symm_1737309054555167000 +SYMMETRY symm_1737327160682386000 \* CONSTANT definitions CONSTANT -max_commit_lsn <- const_1737309054555168000 +max_commit_lsn <- const_1737327160682387000 \* CONSTANT definitions CONSTANT -az_mapping <- const_1737309054555169000 +az_mapping <- const_1737327160682388000 \* CONSTRAINT definition CONSTRAINT -constr_1737309054555170000 +constr_1737327160682389000 \* SPECIFICATION definition SPECIFICATION Spec \* INVARIANT definition INVARIANT PsLagsSk +PeerRecoveryIsPossible \* PROPERTY definition PROPERTY EventuallyLaggingSkIsNotPreferredSk -\* Generated on Sun Jan 19 18:50:54 CET 2025 \ No newline at end of file +\* Generated on Sun Jan 19 23:52:40 CET 2025 \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.out index e69de29bb2..9996d5301e 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.out +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.out @@ -0,0 +1,53 @@ +@!@!@STARTMSG 2262:0 @!@!@ +TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) +@!@!@ENDMSG 2262 @!@!@ +@!@!@STARTMSG 2187:0 @!@!@ +Running breadth-first search Model-Checking with fp 121 and seed -1130553646976177579 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 25330] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +@!@!@ENDMSG 2187 @!@!@ +@!@!@STARTMSG 2220:0 @!@!@ +Starting SANY... +@!@!@ENDMSG 2220 @!@!@ +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla +Semantic processing of module Naturals +Semantic processing of module Integers +Semantic processing of module Sequences +Semantic processing of module FiniteSets +Semantic processing of module replicated +Semantic processing of module TLC +Semantic processing of module MC +@!@!@STARTMSG 2219:0 @!@!@ +SANY finished. +@!@!@ENDMSG 2219 @!@!@ +@!@!@STARTMSG 2185:0 @!@!@ +Starting... (2025-01-19 23:52:41) +@!@!@ENDMSG 2185 @!@!@ +@!@!@STARTMSG 2279:3 @!@!@ +Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. +@!@!@ENDMSG 2279 @!@!@ +@!@!@STARTMSG 2284:3 @!@!@ +Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. +@!@!@ENDMSG 2284 @!@!@ +@!@!@STARTMSG 2212:0 @!@!@ +Implied-temporal checking--satisfiability problem has 1 branches. +@!@!@ENDMSG 2212 @!@!@ +@!@!@STARTMSG 2189:0 @!@!@ +Computing initial states... +@!@!@ENDMSG 2189 @!@!@ +@!@!@STARTMSG 2190:0 @!@!@ +Finished computing initial states: 1 distinct state generated at 2025-01-19 23:52:43. +@!@!@ENDMSG 2190 @!@!@ +@!@!@STARTMSG 2192:0 @!@!@ +Checking temporal properties for the current state space with 1627 total distinct states at (2025-01-19 23:52:46) +@!@!@ENDMSG 2192 @!@!@ +@!@!@STARTMSG 2267:0 @!@!@ +Finished checking temporal properties in 00s at 2025-01-19 23:52:46 +@!@!@ENDMSG 2267 @!@!@ +@!@!@STARTMSG 2200:0 @!@!@ +Progress(9) at 2025-01-19 23:52:46: 45.678 states generated (45.678 s/min), 7.117 distinct states found (7.117 ds/min), 5.486 states left on queue. +@!@!@ENDMSG 2200 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla index b2245ec002..62ff97b5e7 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla @@ -22,44 +22,44 @@ az1, az2, az3 ---- \* MV CONSTANT definitions brokers -const_1737309054555163000 == +const_1737327160682382000 == {b1, b2, b3} ---- \* MV CONSTANT definitions safekeepers -const_1737309054555164000 == +const_1737327160682383000 == {s1, s2, s3} ---- \* MV CONSTANT definitions pageservers -const_1737309054555165000 == +const_1737327160682384000 == {p1} ---- \* MV CONSTANT definitions azs -const_1737309054555166000 == +const_1737327160682385000 == {az1, az2, az3} ---- \* SYMMETRY definition -symm_1737309054555167000 == -Permutations(const_1737309054555163000) \union Permutations(const_1737309054555164000) \union Permutations(const_1737309054555165000) \union Permutations(const_1737309054555166000) +symm_1737327160682386000 == +Permutations(const_1737327160682382000) \union Permutations(const_1737327160682383000) \union Permutations(const_1737327160682384000) \union Permutations(const_1737327160682385000) ---- \* CONSTANT definitions @modelParameterConstants:4max_commit_lsn -const_1737309054555168000 == +const_1737327160682387000 == 2 ---- \* CONSTANT definitions @modelParameterConstants:5az_mapping -const_1737309054555169000 == +const_1737327160682388000 == [ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2} , az3 |-> {b3,s3}] ---- \* CONSTRAINT definition @modelParameterContraint:0 -constr_1737309054555170000 == +constr_1737327160682389000 == StateConstraint ---- ============================================================================= \* Modification History -\* Created Sun Jan 19 18:50:54 CET 2025 by cs +\* Created Sun Jan 19 23:52:40 CET 2025 by cs diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC_TE.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC_TE.out index 72ebe05b45..9996d5301e 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC_TE.out +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC_TE.out @@ -2,7 +2,7 @@ TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) @!@!@ENDMSG 2262 @!@!@ @!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 96 and seed 147884281130356166 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 12007] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +Running breadth-first search Model-Checking with fp 121 and seed -1130553646976177579 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 25330] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). @!@!@ENDMSG 2187 @!@!@ @!@!@STARTMSG 2220:0 @!@!@ Starting SANY... @@ -25,7 +25,7 @@ Semantic processing of module MC SANY finished. @!@!@ENDMSG 2219 @!@!@ @!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 18:38:05) +Starting... (2025-01-19 23:52:41) @!@!@ENDMSG 2185 @!@!@ @!@!@STARTMSG 2279:3 @!@!@ Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. @@ -40,315 +40,14 @@ Implied-temporal checking--satisfiability problem has 1 branches. Computing initial states... @!@!@ENDMSG 2189 @!@!@ @!@!@STARTMSG 2190:0 @!@!@ -Finished computing initial states: 1 distinct state generated at 2025-01-19 18:38:06. +Finished computing initial states: 1 distinct state generated at 2025-01-19 23:52:43. @!@!@ENDMSG 2190 @!@!@ @!@!@STARTMSG 2192:0 @!@!@ -Checking temporal properties for the current state space with 3861 total distinct states at (2025-01-19 18:38:09) +Checking temporal properties for the current state space with 1627 total distinct states at (2025-01-19 23:52:46) @!@!@ENDMSG 2192 @!@!@ @!@!@STARTMSG 2267:0 @!@!@ -Finished checking temporal properties in 00s at 2025-01-19 18:38:09 +Finished checking temporal properties in 00s at 2025-01-19 23:52:46 @!@!@ENDMSG 2267 @!@!@ @!@!@STARTMSG 2200:0 @!@!@ -Progress(11) at 2025-01-19 18:38:09: 77.856 states generated (77.856 s/min), 8.653 distinct states found (8.653 ds/min), 4.790 states left on queue. +Progress(9) at 2025-01-19 23:52:46: 45.678 states generated (45.678 s/min), 7.117 distinct states found (7.117 ds/min), 5.486 states left on queue. @!@!@ENDMSG 2200 @!@!@ -@!@!@STARTMSG 2192:0 @!@!@ -Checking temporal properties for the current state space with 197257 total distinct states at (2025-01-19 18:39:09) -@!@!@ENDMSG 2192 @!@!@ -@!@!@STARTMSG 2267:0 @!@!@ -Finished checking temporal properties in 00s at 2025-01-19 18:39:09 -@!@!@ENDMSG 2267 @!@!@ -@!@!@STARTMSG 2200:0 @!@!@ -Progress(20) at 2025-01-19 18:39:09: 3.084.377 states generated (3.006.521 s/min), 204.964 distinct states found (196.311 ds/min), 7.704 states left on queue. -@!@!@ENDMSG 2200 @!@!@ -@!@!@STARTMSG 2200:0 @!@!@ -Progress(25) at 2025-01-19 18:39:12: 3.224.329 states generated, 208.868 distinct states found, 0 states left on queue. -@!@!@ENDMSG 2200 @!@!@ -@!@!@STARTMSG 2192:0 @!@!@ -Checking temporal properties for the complete state space with 208868 total distinct states at (2025-01-19 18:39:12) -@!@!@ENDMSG 2192 @!@!@ -@!@!@STARTMSG 2267:0 @!@!@ -Finished checking temporal properties in 00s at 2025-01-19 18:39:12 -@!@!@ENDMSG 2267 @!@!@ -@!@!@STARTMSG 2193:0 @!@!@ -Model checking completed. No error has been found. - Estimates of the probability that TLC did not check all reachable states - because two distinct states had the same fingerprint: - calculated (optimistic): val = 3.4E-8 - based on the actual fingerprints: val = 6.3E-10 -@!@!@ENDMSG 2193 @!@!@ -@!@!@STARTMSG 2201:0 @!@!@ -The coverage statistics at 2025-01-19 18:39:14 -@!@!@ENDMSG 2201 @!@!@ -@!@!@STARTMSG 2773:0 @!@!@ -: 1:1 -@!@!@ENDMSG 2773 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 35, col 5 to line 38, col 26 of module replicated: 1 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 14290:208868 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 41, col 8 to line 44, col 44 of module replicated: 208868 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 41, col 18 to line 44, col 44 of module replicated: 208868 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 42, col 9 to line 44, col 44 of module replicated: 22348876 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 42, col 12 to line 42, col 48 of module replicated: 22348876 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 43, col 12 to line 43, col 44 of module replicated: 8981324 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 44, col 12 to line 44, col 44 of module replicated: 2924152 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 41, col 32 to line 41, col 48 of module replicated: 208868 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 45, col 8 to line 45, col 67 of module replicated: 208868 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 84:530666 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 48, col 8 to line 48, col 32 of module replicated: 2410478 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2775:0 @!@!@ - |line 48, col 8 to line 48, col 15 of module replicated: 1879812:4246157 -@!@!@ENDMSG 2775 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 48, col 27 to line 48, col 32 of module replicated: 1879812 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 49, col 8 to line 49, col 14 of module replicated: 1643803 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 49, col 8 to line 49, col 9 of module replicated: 1113137 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 49, col 13 to line 49, col 14 of module replicated: 1113137 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 50, col 8 to line 50, col 72 of module replicated: 1170534 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 50, col 8 to line 50, col 38 of module replicated: 639868 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 50, col 42 to line 50, col 72 of module replicated: 639868 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 54, col 13 to line 56, col 50 of module replicated: 530666 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 57, col 8 to line 57, col 58 of module replicated: 530666 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 682:54601 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 60, col 8 to line 60, col 32 of module replicated: 1934413 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2775:0 @!@!@ - |line 60, col 8 to line 60, col 15 of module replicated: 1879812:4246157 -@!@!@ENDMSG 2775 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 60, col 27 to line 60, col 32 of module replicated: 1879812 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 61, col 8 to line 61, col 72 of module replicated: 54601 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 61, col 8 to line 61, col 38 of module replicated: 1113137 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 61, col 42 to line 61, col 72 of module replicated: 1113137 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 62, col 8 to line 62, col 102 of module replicated: 54601 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 63, col 8 to line 63, col 58 of module replicated: 54601 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 45241:1113137 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 66, col 8 to line 66, col 30 of module replicated: 2992949 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2775:0 @!@!@ - |line 66, col 8 to line 66, col 13 of module replicated: 1879812:4412756 -@!@!@ENDMSG 2775 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 66, col 25 to line 66, col 30 of module replicated: 1879812 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 67, col 8 to line 74, col 29 of module replicated: 1113137 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 67, col 24 to line 74, col 29 of module replicated: 1113137 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 67, col 27 to line 67, col 91 of module replicated: 1113137 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 70, col 28 to line 70, col 45 of module replicated: 611653 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 71, col 31 to line 71, col 91 of module replicated: 611653 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 73, col 17 to line 73, col 54 of module replicated: 611653 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 74, col 18 to line 74, col 29 of module replicated: 501484 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 75, col 8 to line 75, col 62 of module replicated: 1113137 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 90643:1113137 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 78, col 8 to line 78, col 31 of module replicated: 2992949 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2775:0 @!@!@ - |line 78, col 8 to line 78, col 14 of module replicated: 1879812:5525893 -@!@!@ENDMSG 2775 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 78, col 26 to line 78, col 31 of module replicated: 1879812 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 84, col 13 to line 86, col 37 of module replicated: 1113137 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 84, col 33 to line 86, col 37 of module replicated: 1113137 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 84, col 36 to line 84, col 66 of module replicated: 1113137 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 85, col 22 to line 85, col 66 of module replicated: 406880 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 86, col 22 to line 86, col 37 of module replicated: 706257 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 87, col 8 to line 87, col 58 of module replicated: 1113137 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 57927:203919 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 97, col 8 to line 97, col 27 of module replicated: 412787 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2775:0 @!@!@ - |line 97, col 8 to line 97, col 10 of module replicated: 208868:417736 -@!@!@ENDMSG 2775 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 97, col 22 to line 97, col 27 of module replicated: 208868 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 98, col 8 to line 98, col 30 of module replicated: 412787 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 98, col 8 to line 98, col 25 of module replicated: 208868 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 92, col 15 to line 92, col 33 of module replicated: 208868 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 94, col 5 to line 94, col 66 of module replicated: 208868 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 94, col 26 to line 94, col 65 of module replicated: 626604 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 94, col 12 to line 94, col 23 of module replicated: 208868 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 98, col 24 to line 98, col 24 of module replicated: 208868 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 98, col 29 to line 98, col 30 of module replicated: 208868 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 99, col 8 to line 99, col 109 of module replicated: 203919 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 99, col 28 to line 99, col 109 of module replicated: 203919 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 99, col 29 to line 99, col 44 of module replicated: 203919 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 99, col 52 to line 99, col 108 of module replicated: 203919 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 99, col 72 to line 99, col 108 of module replicated: 203919 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 99, col 105 to line 99, col 108 of module replicated: 203919 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 99, col 85 to line 99, col 102 of module replicated: 203919 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||||line 92, col 15 to line 92, col 33 of module replicated: 203919 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2775:0 @!@!@ - ||||line 94, col 5 to line 94, col 66 of module replicated: 203919:203919 -@!@!@ENDMSG 2775 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||||line 94, col 26 to line 94, col 65 of module replicated: 611757 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||||line 94, col 12 to line 94, col 23 of module replicated: 203919 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||||line 99, col 101 to line 99, col 101 of module replicated: 203919 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 100, col 8 to line 100, col 58 of module replicated: 203919 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2774:0 @!@!@ - -@!@!@ENDMSG 2774 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 118, col 13 to line 119, col 81 of module replicated: 736274 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 118, col 35 to line 119, col 81 of module replicated: 736274 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 119, col 9 to line 119, col 81 of module replicated: 2208822 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 118, col 44 to line 118, col 72 of module replicated: 736274 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 118, col 22 to line 118, col 32 of module replicated: 736274 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2202:0 @!@!@ -End of statistics. -@!@!@ENDMSG 2202 @!@!@ -@!@!@STARTMSG 2200:0 @!@!@ -Progress(25) at 2025-01-19 18:39:14: 3.224.329 states generated (2.761.383 s/min), 208.868 distinct states found (178.878 ds/min), 0 states left on queue. -@!@!@ENDMSG 2200 @!@!@ -@!@!@STARTMSG 2199:0 @!@!@ -3224329 states generated, 208868 distinct states found, 0 states left on queue. -@!@!@ENDMSG 2199 @!@!@ -@!@!@STARTMSG 2194:0 @!@!@ -The depth of the complete state graph search is 25. -@!@!@ENDMSG 2194 @!@!@ -@!@!@STARTMSG 2268:0 @!@!@ -The average outdegree of the complete state graph is 1 (minimum is 0, the maximum 9 and the 95th percentile is 3). -@!@!@ENDMSG 2268 @!@!@ -@!@!@STARTMSG 2186:0 @!@!@ -Finished in 70074ms at (2025-01-19 18:39:14) -@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla index 33971e3071..b59645ac75 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla @@ -17,6 +17,20 @@ CONSTANT CONSTANT max_commit_lsn + +\* HELPERS + +Max(a,b) == IF a > b THEN a ELSE b + +(* The minimum of a non-empty set of integers *) +MinOfSet(S) == + CHOOSE x \in S: \A y \in S: x <= y + +(* The minimum of a non-empty set of integers *) +MaxOfSet(S) == + CHOOSE x \in S: \A y \in S: x >= y + +\* END HELPERS StateConstraint == /\ \A s \in safekeepers: @@ -25,9 +39,10 @@ StateConstraint == /\ \A s \in DOMAIN broker_state[b].sk: /\ broker_state[b].sk[s].commit_lsn <= max_commit_lsn + -InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0] -InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] +InitSafekeeper == [prune_lsn |-> 0, commit_lsn |-> 0, rx |-> [b \in brokers |-> NULL] ] +InitBroker == [sk |-> [s \in safekeepers |-> [prune_lsn |-> 0, commit_lsn |-> 0]]] InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] InitOnline == safekeepers \cup brokers \cup pageservers @@ -58,20 +73,21 @@ SkCommit(s1, s2) == SkPeerRecovery(s1,s2) == /\ {s1, s2} \subseteq online - /\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn + /\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn \* s2 has more WAL than s1 + /\ safekeeper_state[s2].prune_lsn < safekeeper_state[s1].commit_lsn \* s2 has not yet trimmed the WAL the WAL /\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn] /\ UNCHANGED <> SkPushToBroker(s,b) == /\ {s, b} \subseteq online - /\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn - THEN - LET - bsk == broker_state[b].sk - updbsk == [bsk EXCEPT ![s].commit_lsn = safekeeper_state[s].commit_lsn] - IN - [broker_state EXCEPT ![b].sk = updbsk] - ELSE broker_state + /\ broker_state' = LET + broker_side == broker_state[b].sk[s] + sk_side == safekeeper_state[s] + merged == [broker_side EXCEPT + !["commit_lsn"] = Max(broker_side.commit_lsn, sk_side.commit_lsn), + !["prune_lsn"] = Max(broker_side.prune_lsn, sk_side.prune_lsn)] + IN + [broker_state EXCEPT ![b].sk[s] = merged] /\ UNCHANGED <> PsRecvBroker(b,p,s) == @@ -86,6 +102,21 @@ PsRecvBroker(b,p,s) == ELSE pageserver_state /\ UNCHANGED <> + +SkRecvBroker(b,s) == + /\ {b,s} \subseteq online + /\ safekeeper_state' = [safekeeper_state EXCEPT ![s].rx[b] = broker_state[b]] + /\ UNCHANGED <> + +SkPrune(s) == + /\ {s} \subseteq online + /\ LET + sk == safekeeper_state[s] + skis == {<>: <> \in {<> \in { <>: b \in sk.rx }: bi # NULL} } + IN + safekeeper_state' = safekeeper_state + /\ UNCHANGED <> + SksWithNewerWal(p) == LET @@ -105,7 +136,11 @@ Next == \/ \E s1 \in safekeepers: \E s2 \in safekeepers: \/ SkCommit(s1, s2) \/ SkPeerRecovery(s1, s2) - \/ \E s \in safekeepers: \E b \in brokers: SkPushToBroker(s, b) + \/ \E s \in safekeepers: \E b \in brokers: + \/ SkPushToBroker(s, b) + \/ SkRecvBroker(b, s) + \/ \E s \in safekeepers: + \/ SkPrune(s) \/ \E s \in safekeepers: \E b \in brokers: \E p \in pageservers: PsRecvBroker(b,p,s) \/ \E p \in pageservers: PsChooseSk(p) @@ -117,7 +152,12 @@ Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state,onl PsLagsSk == \A p \in pageservers: \A s \in DOMAIN pageserver_state[p].sk: /\ pageserver_state[p].sk[s].commit_lsn <= safekeeper_state[s].commit_lsn - + +PeerRecoveryIsPossible == + \A laggard \in (safekeepers \cap online): \E donor \in (safekeepers \cap online): + /\ (safekeeper_state[laggard].commit_lsn < safekeeper_state[donor].commit_lsn) + => safekeeper_state[donor].prune_lsn <= safekeeper_state[laggard].commit_lsn + EventuallyLaggingSkIsNotPreferredSk == <>( LET diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1/states/25-01-19-18-52-55/0 b/storage_broker/spec/replicated/replicated.toolbox/Model_1/states/25-01-19-18-52-55/0 deleted file mode 100644 index 589450a97d..0000000000 Binary files a/storage_broker/spec/replicated/replicated.toolbox/Model_1/states/25-01-19-18-52-55/0 and /dev/null differ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1/states/25-01-19-18-52-55/MC-0.st b/storage_broker/spec/replicated/replicated.toolbox/Model_1/states/25-01-19-18-52-55/MC-0.st deleted file mode 100644 index 662525646c..0000000000 Binary files a/storage_broker/spec/replicated/replicated.toolbox/Model_1/states/25-01-19-18-52-55/MC-0.st and /dev/null differ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307595008/MC.cfg b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307595008/MC.cfg deleted file mode 100644 index d030d28ac1..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307595008/MC.cfg +++ /dev/null @@ -1,51 +0,0 @@ -\* MV CONSTANT declarations -CONSTANTS -b1 = b1 -b2 = b2 -b3 = b3 -\* MV CONSTANT declarations -CONSTANTS -s1 = s1 -s2 = s2 -s3 = s3 -\* MV CONSTANT declarations -CONSTANTS -p1 = p1 -p2 = p2 -\* MV CONSTANT declarations -CONSTANTS -az1 = az1 -az2 = az2 -az3 = az3 -\* MV CONSTANT definitions -CONSTANT -brokers <- const_17373075907692000 -\* CONSTANT declarations -CONSTANT NULL = NULL -\* MV CONSTANT definitions -CONSTANT -safekeepers <- const_17373075907703000 -\* MV CONSTANT definitions -CONSTANT -pageservers <- const_17373075907704000 -\* MV CONSTANT definitions -CONSTANT -azs <- const_17373075907705000 -\* SYMMETRY definition -SYMMETRY symm_17373075907706000 -\* CONSTANT definitions -CONSTANT -max_commit_lsn <- const_17373075907707000 -\* CONSTANT definitions -CONSTANT -az_mapping <- const_17373075907708000 -\* CONSTRAINT definition -CONSTRAINT -constr_17373075907709000 -\* SPECIFICATION definition -SPECIFICATION -Spec -\* PROPERTY definition -PROPERTY -EventuallyLaggingSkIsNotPreferredSk -\* Generated on Sun Jan 19 18:26:30 CET 2025 \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307595008/MC.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307595008/MC.out deleted file mode 100644 index cfe6177fe8..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307595008/MC.out +++ /dev/null @@ -1,164 +0,0 @@ -@!@!@STARTMSG 2262:0 @!@!@ -TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) -@!@!@ENDMSG 2262 @!@!@ -@!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 44 and seed -6447714091281296951 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11418] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). -@!@!@ENDMSG 2187 @!@!@ -@!@!@STARTMSG 2220:0 @!@!@ -Starting SANY... -@!@!@ENDMSG 2220 @!@!@ -Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla -Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla -Semantic processing of module Naturals -Semantic processing of module Integers -Semantic processing of module Sequences -Semantic processing of module FiniteSets -Semantic processing of module replicated -Semantic processing of module TLC -Semantic processing of module MC -@!@!@STARTMSG 2219:0 @!@!@ -SANY finished. -@!@!@ENDMSG 2219 @!@!@ -@!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 18:26:32) -@!@!@ENDMSG 2185 @!@!@ -@!@!@STARTMSG 2140:3 @!@!@ -The subscript of the next-state relation specified by the specification -does not seem to contain the state variable online -@!@!@ENDMSG 2140 @!@!@ -@!@!@STARTMSG 2279:3 @!@!@ -Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. -@!@!@ENDMSG 2279 @!@!@ -@!@!@STARTMSG 2284:3 @!@!@ -Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. -@!@!@ENDMSG 2284 @!@!@ -@!@!@STARTMSG 2212:0 @!@!@ -Implied-temporal checking--satisfiability problem has 1 branches. -@!@!@ENDMSG 2212 @!@!@ -@!@!@STARTMSG 2189:0 @!@!@ -Computing initial states... -@!@!@ENDMSG 2189 @!@!@ -@!@!@STARTMSG 2190:0 @!@!@ -Finished computing initial states: 1 distinct state generated at 2025-01-19 18:26:33. -@!@!@ENDMSG 2190 @!@!@ -@!@!@STARTMSG 2109:1 @!@!@ -Successor state is not completely specified by action NodeOnlineOffline of the next-state relation. The following variables are not assigned: broker_state, pageserver_state, safekeeper_state. - -@!@!@ENDMSG 2109 @!@!@ -@!@!@STARTMSG 2121:1 @!@!@ -The behavior up to this point is: -@!@!@ENDMSG 2121 @!@!@ -@!@!@STARTMSG 2217:4 @!@!@ -1: -/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) -/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])]) -/\ online = {b1, b2, b3, s1, s2, s3, p1, p2} -/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0]) - -@!@!@ENDMSG 2217 @!@!@ -@!@!@STARTMSG 2217:4 @!@!@ -2: -/\ pageserver_state = null -/\ broker_state = null -/\ online = {b1, b2, s1, s2, p1, p2} -/\ safekeeper_state = null - -@!@!@ENDMSG 2217 @!@!@ -@!@!@STARTMSG 2201:0 @!@!@ -The coverage statistics at 2025-01-19 18:26:33 -@!@!@ENDMSG 2201 @!@!@ -@!@!@STARTMSG 2773:0 @!@!@ -: 1:1 -@!@!@ENDMSG 2773 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 35, col 5 to line 38, col 26 of module replicated: 1 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:2 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 40, col 22 to line 43, col 44 of module replicated: 1 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 40, col 32 to line 43, col 44 of module replicated: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 41, col 9 to line 43, col 44 of module replicated: 464 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 41, col 12 to line 41, col 48 of module replicated: 464 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 42, col 12 to line 42, col 44 of module replicated: 208 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 43, col 12 to line 43, col 44 of module replicated: 86 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 40, col 46 to line 40, col 62 of module replicated: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:0 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 52, col 13 to line 54, col 50 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 55, col 8 to line 55, col 51 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:0 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 60, col 8 to line 60, col 102 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 61, col 8 to line 61, col 51 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:0 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 65, col 8 to line 72, col 29 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 73, col 8 to line 73, col 55 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:0 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 82, col 13 to line 84, col 37 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 85, col 8 to line 85, col 51 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:0 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 98, col 8 to line 98, col 109 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 99, col 8 to line 99, col 51 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2202:0 @!@!@ -End of statistics. -@!@!@ENDMSG 2202 @!@!@ -@!@!@STARTMSG 2200:0 @!@!@ -Progress(1) at 2025-01-19 18:26:33: 2 states generated (45 s/min), 1 distinct states found (22 ds/min), 0 states left on queue. -@!@!@ENDMSG 2200 @!@!@ -@!@!@STARTMSG 2199:0 @!@!@ -2 states generated, 1 distinct states found, 0 states left on queue. -@!@!@ENDMSG 2199 @!@!@ -@!@!@STARTMSG 2194:0 @!@!@ -The depth of the complete state graph search is 1. -@!@!@ENDMSG 2194 @!@!@ -@!@!@STARTMSG 2186:0 @!@!@ -Finished in 2685ms at (2025-01-19 18:26:33) -@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307595008/MC.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307595008/MC.tla deleted file mode 100644 index be5c82d29b..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307595008/MC.tla +++ /dev/null @@ -1,65 +0,0 @@ ----- MODULE MC ---- -EXTENDS replicated, TLC - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -b1, b2, b3 ----- - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -s1, s2, s3 ----- - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -p1, p2 ----- - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -az1, az2, az3 ----- - -\* MV CONSTANT definitions brokers -const_17373075907692000 == -{b1, b2, b3} ----- - -\* MV CONSTANT definitions safekeepers -const_17373075907703000 == -{s1, s2, s3} ----- - -\* MV CONSTANT definitions pageservers -const_17373075907704000 == -{p1, p2} ----- - -\* MV CONSTANT definitions azs -const_17373075907705000 == -{az1, az2, az3} ----- - -\* SYMMETRY definition -symm_17373075907706000 == -Permutations(const_17373075907692000) \union Permutations(const_17373075907703000) \union Permutations(const_17373075907704000) \union Permutations(const_17373075907705000) ----- - -\* CONSTANT definitions @modelParameterConstants:4max_commit_lsn -const_17373075907707000 == -2 ----- - -\* CONSTANT definitions @modelParameterConstants:5az_mapping -const_17373075907708000 == -[ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2,p2} , az3 |-> {b3,s3}] ----- - -\* CONSTRAINT definition @modelParameterContraint:0 -constr_17373075907709000 == -StateConstraint ----- -============================================================================= -\* Modification History -\* Created Sun Jan 19 18:26:30 CET 2025 by cs diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307595008/MC_TE.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307595008/MC_TE.out deleted file mode 100644 index cfe6177fe8..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307595008/MC_TE.out +++ /dev/null @@ -1,164 +0,0 @@ -@!@!@STARTMSG 2262:0 @!@!@ -TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) -@!@!@ENDMSG 2262 @!@!@ -@!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 44 and seed -6447714091281296951 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11418] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). -@!@!@ENDMSG 2187 @!@!@ -@!@!@STARTMSG 2220:0 @!@!@ -Starting SANY... -@!@!@ENDMSG 2220 @!@!@ -Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla -Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla -Semantic processing of module Naturals -Semantic processing of module Integers -Semantic processing of module Sequences -Semantic processing of module FiniteSets -Semantic processing of module replicated -Semantic processing of module TLC -Semantic processing of module MC -@!@!@STARTMSG 2219:0 @!@!@ -SANY finished. -@!@!@ENDMSG 2219 @!@!@ -@!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 18:26:32) -@!@!@ENDMSG 2185 @!@!@ -@!@!@STARTMSG 2140:3 @!@!@ -The subscript of the next-state relation specified by the specification -does not seem to contain the state variable online -@!@!@ENDMSG 2140 @!@!@ -@!@!@STARTMSG 2279:3 @!@!@ -Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. -@!@!@ENDMSG 2279 @!@!@ -@!@!@STARTMSG 2284:3 @!@!@ -Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. -@!@!@ENDMSG 2284 @!@!@ -@!@!@STARTMSG 2212:0 @!@!@ -Implied-temporal checking--satisfiability problem has 1 branches. -@!@!@ENDMSG 2212 @!@!@ -@!@!@STARTMSG 2189:0 @!@!@ -Computing initial states... -@!@!@ENDMSG 2189 @!@!@ -@!@!@STARTMSG 2190:0 @!@!@ -Finished computing initial states: 1 distinct state generated at 2025-01-19 18:26:33. -@!@!@ENDMSG 2190 @!@!@ -@!@!@STARTMSG 2109:1 @!@!@ -Successor state is not completely specified by action NodeOnlineOffline of the next-state relation. The following variables are not assigned: broker_state, pageserver_state, safekeeper_state. - -@!@!@ENDMSG 2109 @!@!@ -@!@!@STARTMSG 2121:1 @!@!@ -The behavior up to this point is: -@!@!@ENDMSG 2121 @!@!@ -@!@!@STARTMSG 2217:4 @!@!@ -1: -/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) -/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])]) -/\ online = {b1, b2, b3, s1, s2, s3, p1, p2} -/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0]) - -@!@!@ENDMSG 2217 @!@!@ -@!@!@STARTMSG 2217:4 @!@!@ -2: -/\ pageserver_state = null -/\ broker_state = null -/\ online = {b1, b2, s1, s2, p1, p2} -/\ safekeeper_state = null - -@!@!@ENDMSG 2217 @!@!@ -@!@!@STARTMSG 2201:0 @!@!@ -The coverage statistics at 2025-01-19 18:26:33 -@!@!@ENDMSG 2201 @!@!@ -@!@!@STARTMSG 2773:0 @!@!@ -: 1:1 -@!@!@ENDMSG 2773 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 35, col 5 to line 38, col 26 of module replicated: 1 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:2 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 40, col 22 to line 43, col 44 of module replicated: 1 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 40, col 32 to line 43, col 44 of module replicated: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 41, col 9 to line 43, col 44 of module replicated: 464 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 41, col 12 to line 41, col 48 of module replicated: 464 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 42, col 12 to line 42, col 44 of module replicated: 208 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 43, col 12 to line 43, col 44 of module replicated: 86 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 40, col 46 to line 40, col 62 of module replicated: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:0 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 52, col 13 to line 54, col 50 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 55, col 8 to line 55, col 51 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:0 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 60, col 8 to line 60, col 102 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 61, col 8 to line 61, col 51 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:0 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 65, col 8 to line 72, col 29 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 73, col 8 to line 73, col 55 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:0 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 82, col 13 to line 84, col 37 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 85, col 8 to line 85, col 51 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:0 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 98, col 8 to line 98, col 109 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 99, col 8 to line 99, col 51 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2202:0 @!@!@ -End of statistics. -@!@!@ENDMSG 2202 @!@!@ -@!@!@STARTMSG 2200:0 @!@!@ -Progress(1) at 2025-01-19 18:26:33: 2 states generated (45 s/min), 1 distinct states found (22 ds/min), 0 states left on queue. -@!@!@ENDMSG 2200 @!@!@ -@!@!@STARTMSG 2199:0 @!@!@ -2 states generated, 1 distinct states found, 0 states left on queue. -@!@!@ENDMSG 2199 @!@!@ -@!@!@STARTMSG 2194:0 @!@!@ -The depth of the complete state graph search is 1. -@!@!@ENDMSG 2194 @!@!@ -@!@!@STARTMSG 2186:0 @!@!@ -Finished in 2685ms at (2025-01-19 18:26:33) -@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307595008/replicated.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307595008/replicated.tla deleted file mode 100644 index 0bd0ed6d91..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307595008/replicated.tla +++ /dev/null @@ -1,129 +0,0 @@ ----- MODULE replicated ---- - -EXTENDS Integers, FiniteSets - -VARIABLES broker_state, safekeeper_state, pageserver_state, online - - -CONSTANT - brokers, - safekeepers, - pageservers, - azs, - az_mapping - -CONSTANT - NULL - -CONSTANT - max_commit_lsn - -StateConstraint == - /\ \A s \in safekeepers: - /\ safekeeper_state[s].commit_lsn <= max_commit_lsn - /\ \A b \in brokers: - /\ \A s \in DOMAIN broker_state[b].sk: - /\ broker_state[b].sk[s].commit_lsn <= max_commit_lsn - - -InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0] -InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] -InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] -InitOnline == safekeepers \cup brokers \cup pageservers - -Init == - /\ broker_state = [b \in brokers |-> InitBroker] - /\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper] - /\ pageserver_state = [p \in pageservers |-> InitPageserver] - /\ online = InitOnline - -NodeOnlineOffline == online' = CHOOSE ss \in SUBSET InitOnline: - /\ Cardinality(ss \cap safekeepers) >= 2 - /\ Cardinality(ss \cap brokers) >= 2 - /\ ss \cap pageservers = pageservers \* assume no PS failures for now - -SkCommit(s1, s2) == - /\ {s1, s2} \subseteq online - /\ s1 # s2 - /\ safekeeper_state[s1].commit_lsn = safekeeper_state[s2].commit_lsn - /\ LET - new_commit_lsn == safekeeper_state[s1].commit_lsn + 1 - IN - safekeeper_state' = [safekeeper_state EXCEPT - ![s1].commit_lsn = new_commit_lsn, - ![s2].commit_lsn = new_commit_lsn] - /\ UNCHANGED <> - -SkPeerRecovery(s1,s2) == - /\ {s1, s2} \subseteq online - /\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn - /\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn] - /\ UNCHANGED <> - -SkPushToBroker(s,b) == - /\ {s, b} \subseteq online - /\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn - THEN - LET - bsk == broker_state[b].sk - updbsk == [bsk EXCEPT ![s].commit_lsn = safekeeper_state[s].commit_lsn] - IN - [broker_state EXCEPT ![b].sk = updbsk] - ELSE broker_state - /\ UNCHANGED <> - -PsRecvBroker(b,p,s) == - /\ {b,p,s} \subseteq online - /\ LET - bsk == broker_state[b].sk[s] - psk == pageserver_state[p].sk[s] - updpsk == [psk EXCEPT !["commit_lsn"] = bsk.commit_lsn] - IN - pageserver_state' = IF bsk.commit_lsn > psk.commit_lsn - THEN [pageserver_state EXCEPT ![p].sk[s] = updpsk] - ELSE pageserver_state - /\ UNCHANGED <> - - -SksWithNewerWal(p) == - /\ {p} \subseteq online - /\ - LET - ps == pageserver_state[p] - IN - {s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn} - -PsChooseSk(p) == - /\ SksWithNewerWal(p) # {} - /\ pageserver_state' = [pageserver_state EXCEPT![p].preferred_sk = CHOOSE s \in SksWithNewerWal(p): TRUE] - /\ UNCHANGED <> - - -Next == - \/ NodeOnlineOffline - \/ \E s1 \in safekeepers: \E s2 \in safekeepers: - \/ SkCommit(s1, s2) - \/ SkPeerRecovery(s1, s2) - \/ \E s \in safekeepers: \E b \in brokers: SkPushToBroker(s, b) - \/ \E s \in safekeepers: \E b \in brokers: \E p \in pageservers: PsRecvBroker(b,p,s) - \/ \E p \in pageservers: PsChooseSk(p) - - -Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state >> - - -\* invariants - -EventuallyLaggingSkIsNotPreferredSk == <>( - LET - sks == safekeeper_state - lagging_sks == { s \in safekeepers: \A s2 \in safekeepers: sks[s].commit_lsn <= sks[s2].commit_lsn } - preferred_sks == {pageserver_state[p].preferred_sk: p \in pageservers} - IN - preferred_sks \cap lagging_sks = {} - - ) - - - -==== \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307621596/MC.cfg b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307621596/MC.cfg deleted file mode 100644 index c3df677c50..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307621596/MC.cfg +++ /dev/null @@ -1,51 +0,0 @@ -\* MV CONSTANT declarations -CONSTANTS -b1 = b1 -b2 = b2 -b3 = b3 -\* MV CONSTANT declarations -CONSTANTS -s1 = s1 -s2 = s2 -s3 = s3 -\* MV CONSTANT declarations -CONSTANTS -p1 = p1 -p2 = p2 -\* MV CONSTANT declarations -CONSTANTS -az1 = az1 -az2 = az2 -az3 = az3 -\* MV CONSTANT definitions -CONSTANT -brokers <- const_173730761739711000 -\* CONSTANT declarations -CONSTANT NULL = NULL -\* MV CONSTANT definitions -CONSTANT -safekeepers <- const_173730761739712000 -\* MV CONSTANT definitions -CONSTANT -pageservers <- const_173730761739713000 -\* MV CONSTANT definitions -CONSTANT -azs <- const_173730761739714000 -\* SYMMETRY definition -SYMMETRY symm_173730761739715000 -\* CONSTANT definitions -CONSTANT -max_commit_lsn <- const_173730761739716000 -\* CONSTANT definitions -CONSTANT -az_mapping <- const_173730761739717000 -\* CONSTRAINT definition -CONSTRAINT -constr_173730761739718000 -\* SPECIFICATION definition -SPECIFICATION -Spec -\* PROPERTY definition -PROPERTY -EventuallyLaggingSkIsNotPreferredSk -\* Generated on Sun Jan 19 18:26:57 CET 2025 \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307621596/MC.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307621596/MC.out deleted file mode 100644 index a6e6eeecc3..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307621596/MC.out +++ /dev/null @@ -1,174 +0,0 @@ -@!@!@STARTMSG 2262:0 @!@!@ -TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) -@!@!@ENDMSG 2262 @!@!@ -@!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 92 and seed -7531418498003009516 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11444] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). -@!@!@ENDMSG 2187 @!@!@ -@!@!@STARTMSG 2220:0 @!@!@ -Starting SANY... -@!@!@ENDMSG 2220 @!@!@ -Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla -Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla -Semantic processing of module Naturals -Semantic processing of module Integers -Semantic processing of module Sequences -Semantic processing of module FiniteSets -Semantic processing of module replicated -Semantic processing of module TLC -Semantic processing of module MC -@!@!@STARTMSG 2219:0 @!@!@ -SANY finished. -@!@!@ENDMSG 2219 @!@!@ -@!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 18:26:58) -@!@!@ENDMSG 2185 @!@!@ -@!@!@STARTMSG 2140:3 @!@!@ -The subscript of the next-state relation specified by the specification -does not seem to contain the state variable online -@!@!@ENDMSG 2140 @!@!@ -@!@!@STARTMSG 2279:3 @!@!@ -Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. -@!@!@ENDMSG 2279 @!@!@ -@!@!@STARTMSG 2284:3 @!@!@ -Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. -@!@!@ENDMSG 2284 @!@!@ -@!@!@STARTMSG 2212:0 @!@!@ -Implied-temporal checking--satisfiability problem has 1 branches. -@!@!@ENDMSG 2212 @!@!@ -@!@!@STARTMSG 2189:0 @!@!@ -Computing initial states... -@!@!@ENDMSG 2189 @!@!@ -@!@!@STARTMSG 2190:0 @!@!@ -Finished computing initial states: 1 distinct state generated at 2025-01-19 18:27:00. -@!@!@ENDMSG 2190 @!@!@ -@!@!@STARTMSG 1000:1 @!@!@ -TLC threw an unexpected exception. -This was probably caused by an error in the spec or model. -See the User Output or TLC Console for clues to what happened. -The exception was a java.lang.RuntimeException -: @!@!@STARTMSG 2280:0 @!@!@ -In evaluation, the identifier safekeeper_state is either undefined or not an operator. -line 44, col 24 to line 44, col 39 of module replicated -@!@!@ENDMSG 2280 @!@!@ -@!@!@ENDMSG 1000 @!@!@ -@!@!@STARTMSG 2121:1 @!@!@ -The behavior up to this point is: -@!@!@ENDMSG 2121 @!@!@ -@!@!@STARTMSG 2217:4 @!@!@ -1: -/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) -/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])]) -/\ online = {b1, b2, b3, s1, s2, s3, p1, p2} -/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0]) - -@!@!@ENDMSG 2217 @!@!@ -@!@!@STARTMSG 2103:1 @!@!@ -The error occurred when TLC was evaluating the nested -expressions at the following positions: -0. Line 40, column 22 to line 44, column 71 in replicated -1. Line 40, column 32 to line 44, column 71 in replicated -2. Line 41, column 9 to line 44, column 71 in replicated -3. Line 44, column 12 to line 44, column 71 in replicated -4. Line 44, column 22 to line 44, column 71 in replicated -5. Line 44, column 24 to line 44, column 39 in replicated - - -@!@!@ENDMSG 2103 @!@!@ -@!@!@STARTMSG 2201:0 @!@!@ -The coverage statistics at 2025-01-19 18:27:00 -@!@!@ENDMSG 2201 @!@!@ -@!@!@STARTMSG 2773:0 @!@!@ -: 1:1 -@!@!@ENDMSG 2773 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 35, col 5 to line 38, col 26 of module replicated: 1 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:0 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 40, col 22 to line 44, col 71 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 40, col 32 to line 44, col 71 of module replicated: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 41, col 9 to line 44, col 71 of module replicated: 464 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 41, col 12 to line 41, col 48 of module replicated: 464 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 42, col 12 to line 42, col 44 of module replicated: 208 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 43, col 12 to line 43, col 44 of module replicated: 86 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 44, col 12 to line 44, col 71 of module replicated: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 40, col 46 to line 40, col 62 of module replicated: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:0 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 53, col 13 to line 55, col 50 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 56, col 8 to line 56, col 51 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:0 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 61, col 8 to line 61, col 102 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 62, col 8 to line 62, col 51 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:0 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 66, col 8 to line 73, col 29 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 74, col 8 to line 74, col 55 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:0 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 83, col 13 to line 85, col 37 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 86, col 8 to line 86, col 51 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:0 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 99, col 8 to line 99, col 109 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 100, col 8 to line 100, col 51 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2202:0 @!@!@ -End of statistics. -@!@!@ENDMSG 2202 @!@!@ -@!@!@STARTMSG 2200:0 @!@!@ -Progress(1) at 2025-01-19 18:27:00: 1 states generated (24 s/min), 1 distinct states found (24 ds/min), 0 states left on queue. -@!@!@ENDMSG 2200 @!@!@ -@!@!@STARTMSG 2199:0 @!@!@ -1 states generated, 1 distinct states found, 0 states left on queue. -@!@!@ENDMSG 2199 @!@!@ -@!@!@STARTMSG 2186:0 @!@!@ -Finished in 2483ms at (2025-01-19 18:27:00) -@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307621596/MC.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307621596/MC.tla deleted file mode 100644 index 2e29df8219..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307621596/MC.tla +++ /dev/null @@ -1,65 +0,0 @@ ----- MODULE MC ---- -EXTENDS replicated, TLC - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -b1, b2, b3 ----- - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -s1, s2, s3 ----- - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -p1, p2 ----- - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -az1, az2, az3 ----- - -\* MV CONSTANT definitions brokers -const_173730761739711000 == -{b1, b2, b3} ----- - -\* MV CONSTANT definitions safekeepers -const_173730761739712000 == -{s1, s2, s3} ----- - -\* MV CONSTANT definitions pageservers -const_173730761739713000 == -{p1, p2} ----- - -\* MV CONSTANT definitions azs -const_173730761739714000 == -{az1, az2, az3} ----- - -\* SYMMETRY definition -symm_173730761739715000 == -Permutations(const_173730761739711000) \union Permutations(const_173730761739712000) \union Permutations(const_173730761739713000) \union Permutations(const_173730761739714000) ----- - -\* CONSTANT definitions @modelParameterConstants:4max_commit_lsn -const_173730761739716000 == -2 ----- - -\* CONSTANT definitions @modelParameterConstants:5az_mapping -const_173730761739717000 == -[ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2,p2} , az3 |-> {b3,s3}] ----- - -\* CONSTRAINT definition @modelParameterContraint:0 -constr_173730761739718000 == -StateConstraint ----- -============================================================================= -\* Modification History -\* Created Sun Jan 19 18:26:57 CET 2025 by cs diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307621596/MC_TE.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307621596/MC_TE.out deleted file mode 100644 index a6e6eeecc3..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307621596/MC_TE.out +++ /dev/null @@ -1,174 +0,0 @@ -@!@!@STARTMSG 2262:0 @!@!@ -TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) -@!@!@ENDMSG 2262 @!@!@ -@!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 92 and seed -7531418498003009516 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11444] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). -@!@!@ENDMSG 2187 @!@!@ -@!@!@STARTMSG 2220:0 @!@!@ -Starting SANY... -@!@!@ENDMSG 2220 @!@!@ -Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla -Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla -Semantic processing of module Naturals -Semantic processing of module Integers -Semantic processing of module Sequences -Semantic processing of module FiniteSets -Semantic processing of module replicated -Semantic processing of module TLC -Semantic processing of module MC -@!@!@STARTMSG 2219:0 @!@!@ -SANY finished. -@!@!@ENDMSG 2219 @!@!@ -@!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 18:26:58) -@!@!@ENDMSG 2185 @!@!@ -@!@!@STARTMSG 2140:3 @!@!@ -The subscript of the next-state relation specified by the specification -does not seem to contain the state variable online -@!@!@ENDMSG 2140 @!@!@ -@!@!@STARTMSG 2279:3 @!@!@ -Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. -@!@!@ENDMSG 2279 @!@!@ -@!@!@STARTMSG 2284:3 @!@!@ -Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. -@!@!@ENDMSG 2284 @!@!@ -@!@!@STARTMSG 2212:0 @!@!@ -Implied-temporal checking--satisfiability problem has 1 branches. -@!@!@ENDMSG 2212 @!@!@ -@!@!@STARTMSG 2189:0 @!@!@ -Computing initial states... -@!@!@ENDMSG 2189 @!@!@ -@!@!@STARTMSG 2190:0 @!@!@ -Finished computing initial states: 1 distinct state generated at 2025-01-19 18:27:00. -@!@!@ENDMSG 2190 @!@!@ -@!@!@STARTMSG 1000:1 @!@!@ -TLC threw an unexpected exception. -This was probably caused by an error in the spec or model. -See the User Output or TLC Console for clues to what happened. -The exception was a java.lang.RuntimeException -: @!@!@STARTMSG 2280:0 @!@!@ -In evaluation, the identifier safekeeper_state is either undefined or not an operator. -line 44, col 24 to line 44, col 39 of module replicated -@!@!@ENDMSG 2280 @!@!@ -@!@!@ENDMSG 1000 @!@!@ -@!@!@STARTMSG 2121:1 @!@!@ -The behavior up to this point is: -@!@!@ENDMSG 2121 @!@!@ -@!@!@STARTMSG 2217:4 @!@!@ -1: -/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) -/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])]) -/\ online = {b1, b2, b3, s1, s2, s3, p1, p2} -/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0]) - -@!@!@ENDMSG 2217 @!@!@ -@!@!@STARTMSG 2103:1 @!@!@ -The error occurred when TLC was evaluating the nested -expressions at the following positions: -0. Line 40, column 22 to line 44, column 71 in replicated -1. Line 40, column 32 to line 44, column 71 in replicated -2. Line 41, column 9 to line 44, column 71 in replicated -3. Line 44, column 12 to line 44, column 71 in replicated -4. Line 44, column 22 to line 44, column 71 in replicated -5. Line 44, column 24 to line 44, column 39 in replicated - - -@!@!@ENDMSG 2103 @!@!@ -@!@!@STARTMSG 2201:0 @!@!@ -The coverage statistics at 2025-01-19 18:27:00 -@!@!@ENDMSG 2201 @!@!@ -@!@!@STARTMSG 2773:0 @!@!@ -: 1:1 -@!@!@ENDMSG 2773 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 35, col 5 to line 38, col 26 of module replicated: 1 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:0 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 40, col 22 to line 44, col 71 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 40, col 32 to line 44, col 71 of module replicated: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 41, col 9 to line 44, col 71 of module replicated: 464 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 41, col 12 to line 41, col 48 of module replicated: 464 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 42, col 12 to line 42, col 44 of module replicated: 208 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 43, col 12 to line 43, col 44 of module replicated: 86 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 44, col 12 to line 44, col 71 of module replicated: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 40, col 46 to line 40, col 62 of module replicated: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:0 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 53, col 13 to line 55, col 50 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 56, col 8 to line 56, col 51 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:0 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 61, col 8 to line 61, col 102 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 62, col 8 to line 62, col 51 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:0 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 66, col 8 to line 73, col 29 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 74, col 8 to line 74, col 55 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:0 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 83, col 13 to line 85, col 37 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 86, col 8 to line 86, col 51 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:0 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 99, col 8 to line 99, col 109 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 100, col 8 to line 100, col 51 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2202:0 @!@!@ -End of statistics. -@!@!@ENDMSG 2202 @!@!@ -@!@!@STARTMSG 2200:0 @!@!@ -Progress(1) at 2025-01-19 18:27:00: 1 states generated (24 s/min), 1 distinct states found (24 ds/min), 0 states left on queue. -@!@!@ENDMSG 2200 @!@!@ -@!@!@STARTMSG 2199:0 @!@!@ -1 states generated, 1 distinct states found, 0 states left on queue. -@!@!@ENDMSG 2199 @!@!@ -@!@!@STARTMSG 2186:0 @!@!@ -Finished in 2483ms at (2025-01-19 18:27:00) -@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307621596/replicated.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307621596/replicated.tla deleted file mode 100644 index 2b7501f8a1..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307621596/replicated.tla +++ /dev/null @@ -1,130 +0,0 @@ ----- MODULE replicated ---- - -EXTENDS Integers, FiniteSets - -VARIABLES broker_state, safekeeper_state, pageserver_state, online - - -CONSTANT - brokers, - safekeepers, - pageservers, - azs, - az_mapping - -CONSTANT - NULL - -CONSTANT - max_commit_lsn - -StateConstraint == - /\ \A s \in safekeepers: - /\ safekeeper_state[s].commit_lsn <= max_commit_lsn - /\ \A b \in brokers: - /\ \A s \in DOMAIN broker_state[b].sk: - /\ broker_state[b].sk[s].commit_lsn <= max_commit_lsn - - -InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0] -InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] -InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] -InitOnline == safekeepers \cup brokers \cup pageservers - -Init == - /\ broker_state = [b \in brokers |-> InitBroker] - /\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper] - /\ pageserver_state = [p \in pageservers |-> InitPageserver] - /\ online = InitOnline - -NodeOnlineOffline == online' = CHOOSE ss \in SUBSET InitOnline: - /\ Cardinality(ss \cap safekeepers) >= 2 - /\ Cardinality(ss \cap brokers) >= 2 - /\ ss \cap pageservers = pageservers \* assume no PS failures for now - /\ UNCHANGED <> - -SkCommit(s1, s2) == - /\ {s1, s2} \subseteq online - /\ s1 # s2 - /\ safekeeper_state[s1].commit_lsn = safekeeper_state[s2].commit_lsn - /\ LET - new_commit_lsn == safekeeper_state[s1].commit_lsn + 1 - IN - safekeeper_state' = [safekeeper_state EXCEPT - ![s1].commit_lsn = new_commit_lsn, - ![s2].commit_lsn = new_commit_lsn] - /\ UNCHANGED <> - -SkPeerRecovery(s1,s2) == - /\ {s1, s2} \subseteq online - /\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn - /\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn] - /\ UNCHANGED <> - -SkPushToBroker(s,b) == - /\ {s, b} \subseteq online - /\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn - THEN - LET - bsk == broker_state[b].sk - updbsk == [bsk EXCEPT ![s].commit_lsn = safekeeper_state[s].commit_lsn] - IN - [broker_state EXCEPT ![b].sk = updbsk] - ELSE broker_state - /\ UNCHANGED <> - -PsRecvBroker(b,p,s) == - /\ {b,p,s} \subseteq online - /\ LET - bsk == broker_state[b].sk[s] - psk == pageserver_state[p].sk[s] - updpsk == [psk EXCEPT !["commit_lsn"] = bsk.commit_lsn] - IN - pageserver_state' = IF bsk.commit_lsn > psk.commit_lsn - THEN [pageserver_state EXCEPT ![p].sk[s] = updpsk] - ELSE pageserver_state - /\ UNCHANGED <> - - -SksWithNewerWal(p) == - /\ {p} \subseteq online - /\ - LET - ps == pageserver_state[p] - IN - {s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn} - -PsChooseSk(p) == - /\ SksWithNewerWal(p) # {} - /\ pageserver_state' = [pageserver_state EXCEPT![p].preferred_sk = CHOOSE s \in SksWithNewerWal(p): TRUE] - /\ UNCHANGED <> - - -Next == - \/ NodeOnlineOffline - \/ \E s1 \in safekeepers: \E s2 \in safekeepers: - \/ SkCommit(s1, s2) - \/ SkPeerRecovery(s1, s2) - \/ \E s \in safekeepers: \E b \in brokers: SkPushToBroker(s, b) - \/ \E s \in safekeepers: \E b \in brokers: \E p \in pageservers: PsRecvBroker(b,p,s) - \/ \E p \in pageservers: PsChooseSk(p) - - -Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state >> - - -\* invariants - -EventuallyLaggingSkIsNotPreferredSk == <>( - LET - sks == safekeeper_state - lagging_sks == { s \in safekeepers: \A s2 \in safekeepers: sks[s].commit_lsn <= sks[s2].commit_lsn } - preferred_sks == {pageserver_state[p].preferred_sk: p \in pageservers} - IN - preferred_sks \cap lagging_sks = {} - - ) - - - -==== \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307660221/MC.cfg b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307660221/MC.cfg deleted file mode 100644 index d73d7b9017..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307660221/MC.cfg +++ /dev/null @@ -1,51 +0,0 @@ -\* MV CONSTANT declarations -CONSTANTS -b1 = b1 -b2 = b2 -b3 = b3 -\* MV CONSTANT declarations -CONSTANTS -s1 = s1 -s2 = s2 -s3 = s3 -\* MV CONSTANT declarations -CONSTANTS -p1 = p1 -p2 = p2 -\* MV CONSTANT declarations -CONSTANTS -az1 = az1 -az2 = az2 -az3 = az3 -\* MV CONSTANT definitions -CONSTANT -brokers <- const_173730765610820000 -\* CONSTANT declarations -CONSTANT NULL = NULL -\* MV CONSTANT definitions -CONSTANT -safekeepers <- const_173730765610821000 -\* MV CONSTANT definitions -CONSTANT -pageservers <- const_173730765610822000 -\* MV CONSTANT definitions -CONSTANT -azs <- const_173730765610823000 -\* SYMMETRY definition -SYMMETRY symm_173730765610824000 -\* CONSTANT definitions -CONSTANT -max_commit_lsn <- const_173730765610825000 -\* CONSTANT definitions -CONSTANT -az_mapping <- const_173730765610826000 -\* CONSTRAINT definition -CONSTRAINT -constr_173730765610827000 -\* SPECIFICATION definition -SPECIFICATION -Spec -\* PROPERTY definition -PROPERTY -EventuallyLaggingSkIsNotPreferredSk -\* Generated on Sun Jan 19 18:27:36 CET 2025 \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307660221/MC.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307660221/MC.out deleted file mode 100644 index 43fc616158..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307660221/MC.out +++ /dev/null @@ -1,203 +0,0 @@ -@!@!@STARTMSG 2262:0 @!@!@ -TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) -@!@!@ENDMSG 2262 @!@!@ -@!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 70 and seed -383534902230932382 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11483] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). -@!@!@ENDMSG 2187 @!@!@ -@!@!@STARTMSG 2220:0 @!@!@ -Starting SANY... -@!@!@ENDMSG 2220 @!@!@ -Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla -Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla -Semantic processing of module Naturals -Semantic processing of module Integers -Semantic processing of module Sequences -Semantic processing of module FiniteSets -Semantic processing of module replicated -Semantic processing of module TLC -Semantic processing of module MC -@!@!@STARTMSG 2219:0 @!@!@ -SANY finished. -@!@!@ENDMSG 2219 @!@!@ -@!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 18:27:37) -@!@!@ENDMSG 2185 @!@!@ -@!@!@STARTMSG 2140:3 @!@!@ -The subscript of the next-state relation specified by the specification -does not seem to contain the state variable online -@!@!@ENDMSG 2140 @!@!@ -@!@!@STARTMSG 2279:3 @!@!@ -Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. -@!@!@ENDMSG 2279 @!@!@ -@!@!@STARTMSG 2284:3 @!@!@ -Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. -@!@!@ENDMSG 2284 @!@!@ -@!@!@STARTMSG 2212:0 @!@!@ -Implied-temporal checking--satisfiability problem has 1 branches. -@!@!@ENDMSG 2212 @!@!@ -@!@!@STARTMSG 2189:0 @!@!@ -Computing initial states... -@!@!@ENDMSG 2189 @!@!@ -@!@!@STARTMSG 2190:0 @!@!@ -Finished computing initial states: 1 distinct state generated at 2025-01-19 18:27:38. -@!@!@ENDMSG 2190 @!@!@ -@!@!@STARTMSG 2109:1 @!@!@ -Successor state is not completely specified by action SkCommit of the next-state relation. The following variable is not assigned: online. - -@!@!@ENDMSG 2109 @!@!@ -@!@!@STARTMSG 2121:1 @!@!@ -The behavior up to this point is: -@!@!@ENDMSG 2121 @!@!@ -@!@!@STARTMSG 2217:4 @!@!@ -1: -/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) -/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])]) -/\ online = {b1, b2, b3, s1, s2, s3, p1, p2} -/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0]) - -@!@!@ENDMSG 2217 @!@!@ -@!@!@STARTMSG 2217:4 @!@!@ -2: -/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) -/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])]) -/\ online = null -/\ safekeeper_state = (s1 :> [commit_lsn |-> 1, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 1, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0]) - -@!@!@ENDMSG 2217 @!@!@ -@!@!@STARTMSG 2201:0 @!@!@ -The coverage statistics at 2025-01-19 18:27:38 -@!@!@ENDMSG 2201 @!@!@ -@!@!@STARTMSG 2773:0 @!@!@ -: 1:1 -@!@!@ENDMSG 2773 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 35, col 5 to line 38, col 26 of module replicated: 1 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 1:3 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 41, col 8 to line 44, col 44 of module replicated: 3 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 41, col 18 to line 44, col 44 of module replicated: 3 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 42, col 9 to line 44, col 44 of module replicated: 696 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 42, col 12 to line 42, col 48 of module replicated: 696 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 43, col 12 to line 43, col 44 of module replicated: 312 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 44, col 12 to line 44, col 44 of module replicated: 129 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 41, col 32 to line 41, col 48 of module replicated: 3 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 45, col 8 to line 45, col 67 of module replicated: 3 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:3 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 48, col 8 to line 48, col 32 of module replicated: 7 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2775:0 @!@!@ - |line 48, col 8 to line 48, col 15 of module replicated: 6:15 -@!@!@ENDMSG 2775 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 48, col 27 to line 48, col 32 of module replicated: 6 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 49, col 8 to line 49, col 14 of module replicated: 7 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 49, col 8 to line 49, col 9 of module replicated: 6 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 49, col 13 to line 49, col 14 of module replicated: 6 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 50, col 8 to line 50, col 72 of module replicated: 4 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 50, col 8 to line 50, col 38 of module replicated: 3 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 50, col 42 to line 50, col 72 of module replicated: 3 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 54, col 13 to line 56, col 50 of module replicated: 1 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 54, col 33 to line 56, col 50 of module replicated: 3 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 57, col 8 to line 57, col 51 of module replicated: 1 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:0 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 60, col 8 to line 60, col 32 of module replicated: 3 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 61, col 8 to line 61, col 72 of module replicated: 3 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 62, col 8 to line 62, col 102 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 63, col 8 to line 63, col 51 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:0 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 67, col 8 to line 74, col 29 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 75, col 8 to line 75, col 55 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:0 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 84, col 13 to line 86, col 37 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 87, col 8 to line 87, col 51 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:0 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 100, col 8 to line 100, col 109 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 101, col 8 to line 101, col 51 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2202:0 @!@!@ -End of statistics. -@!@!@ENDMSG 2202 @!@!@ -@!@!@STARTMSG 2200:0 @!@!@ -Progress(2) at 2025-01-19 18:27:38: 5 states generated (121 s/min), 2 distinct states found (48 ds/min), 0 states left on queue. -@!@!@ENDMSG 2200 @!@!@ -@!@!@STARTMSG 2199:0 @!@!@ -5 states generated, 2 distinct states found, 0 states left on queue. -@!@!@ENDMSG 2199 @!@!@ -@!@!@STARTMSG 2194:0 @!@!@ -The depth of the complete state graph search is 2. -@!@!@ENDMSG 2194 @!@!@ -@!@!@STARTMSG 2186:0 @!@!@ -Finished in 2493ms at (2025-01-19 18:27:38) -@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307660221/MC.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307660221/MC.tla deleted file mode 100644 index c30666e0ea..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307660221/MC.tla +++ /dev/null @@ -1,65 +0,0 @@ ----- MODULE MC ---- -EXTENDS replicated, TLC - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -b1, b2, b3 ----- - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -s1, s2, s3 ----- - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -p1, p2 ----- - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -az1, az2, az3 ----- - -\* MV CONSTANT definitions brokers -const_173730765610820000 == -{b1, b2, b3} ----- - -\* MV CONSTANT definitions safekeepers -const_173730765610821000 == -{s1, s2, s3} ----- - -\* MV CONSTANT definitions pageservers -const_173730765610822000 == -{p1, p2} ----- - -\* MV CONSTANT definitions azs -const_173730765610823000 == -{az1, az2, az3} ----- - -\* SYMMETRY definition -symm_173730765610824000 == -Permutations(const_173730765610820000) \union Permutations(const_173730765610821000) \union Permutations(const_173730765610822000) \union Permutations(const_173730765610823000) ----- - -\* CONSTANT definitions @modelParameterConstants:4max_commit_lsn -const_173730765610825000 == -2 ----- - -\* CONSTANT definitions @modelParameterConstants:5az_mapping -const_173730765610826000 == -[ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2,p2} , az3 |-> {b3,s3}] ----- - -\* CONSTRAINT definition @modelParameterContraint:0 -constr_173730765610827000 == -StateConstraint ----- -============================================================================= -\* Modification History -\* Created Sun Jan 19 18:27:36 CET 2025 by cs diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307660221/MC_TE.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307660221/MC_TE.out deleted file mode 100644 index 43fc616158..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307660221/MC_TE.out +++ /dev/null @@ -1,203 +0,0 @@ -@!@!@STARTMSG 2262:0 @!@!@ -TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) -@!@!@ENDMSG 2262 @!@!@ -@!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 70 and seed -383534902230932382 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11483] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). -@!@!@ENDMSG 2187 @!@!@ -@!@!@STARTMSG 2220:0 @!@!@ -Starting SANY... -@!@!@ENDMSG 2220 @!@!@ -Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla -Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla -Semantic processing of module Naturals -Semantic processing of module Integers -Semantic processing of module Sequences -Semantic processing of module FiniteSets -Semantic processing of module replicated -Semantic processing of module TLC -Semantic processing of module MC -@!@!@STARTMSG 2219:0 @!@!@ -SANY finished. -@!@!@ENDMSG 2219 @!@!@ -@!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 18:27:37) -@!@!@ENDMSG 2185 @!@!@ -@!@!@STARTMSG 2140:3 @!@!@ -The subscript of the next-state relation specified by the specification -does not seem to contain the state variable online -@!@!@ENDMSG 2140 @!@!@ -@!@!@STARTMSG 2279:3 @!@!@ -Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. -@!@!@ENDMSG 2279 @!@!@ -@!@!@STARTMSG 2284:3 @!@!@ -Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. -@!@!@ENDMSG 2284 @!@!@ -@!@!@STARTMSG 2212:0 @!@!@ -Implied-temporal checking--satisfiability problem has 1 branches. -@!@!@ENDMSG 2212 @!@!@ -@!@!@STARTMSG 2189:0 @!@!@ -Computing initial states... -@!@!@ENDMSG 2189 @!@!@ -@!@!@STARTMSG 2190:0 @!@!@ -Finished computing initial states: 1 distinct state generated at 2025-01-19 18:27:38. -@!@!@ENDMSG 2190 @!@!@ -@!@!@STARTMSG 2109:1 @!@!@ -Successor state is not completely specified by action SkCommit of the next-state relation. The following variable is not assigned: online. - -@!@!@ENDMSG 2109 @!@!@ -@!@!@STARTMSG 2121:1 @!@!@ -The behavior up to this point is: -@!@!@ENDMSG 2121 @!@!@ -@!@!@STARTMSG 2217:4 @!@!@ -1: -/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) -/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])]) -/\ online = {b1, b2, b3, s1, s2, s3, p1, p2} -/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0]) - -@!@!@ENDMSG 2217 @!@!@ -@!@!@STARTMSG 2217:4 @!@!@ -2: -/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) -/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])]) -/\ online = null -/\ safekeeper_state = (s1 :> [commit_lsn |-> 1, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 1, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0]) - -@!@!@ENDMSG 2217 @!@!@ -@!@!@STARTMSG 2201:0 @!@!@ -The coverage statistics at 2025-01-19 18:27:38 -@!@!@ENDMSG 2201 @!@!@ -@!@!@STARTMSG 2773:0 @!@!@ -: 1:1 -@!@!@ENDMSG 2773 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 35, col 5 to line 38, col 26 of module replicated: 1 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 1:3 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 41, col 8 to line 44, col 44 of module replicated: 3 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 41, col 18 to line 44, col 44 of module replicated: 3 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 42, col 9 to line 44, col 44 of module replicated: 696 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 42, col 12 to line 42, col 48 of module replicated: 696 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 43, col 12 to line 43, col 44 of module replicated: 312 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 44, col 12 to line 44, col 44 of module replicated: 129 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 41, col 32 to line 41, col 48 of module replicated: 3 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 45, col 8 to line 45, col 67 of module replicated: 3 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:3 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 48, col 8 to line 48, col 32 of module replicated: 7 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2775:0 @!@!@ - |line 48, col 8 to line 48, col 15 of module replicated: 6:15 -@!@!@ENDMSG 2775 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 48, col 27 to line 48, col 32 of module replicated: 6 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 49, col 8 to line 49, col 14 of module replicated: 7 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 49, col 8 to line 49, col 9 of module replicated: 6 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 49, col 13 to line 49, col 14 of module replicated: 6 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 50, col 8 to line 50, col 72 of module replicated: 4 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 50, col 8 to line 50, col 38 of module replicated: 3 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 50, col 42 to line 50, col 72 of module replicated: 3 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 54, col 13 to line 56, col 50 of module replicated: 1 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 54, col 33 to line 56, col 50 of module replicated: 3 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 57, col 8 to line 57, col 51 of module replicated: 1 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:0 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 60, col 8 to line 60, col 32 of module replicated: 3 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 61, col 8 to line 61, col 72 of module replicated: 3 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 62, col 8 to line 62, col 102 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 63, col 8 to line 63, col 51 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:0 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 67, col 8 to line 74, col 29 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 75, col 8 to line 75, col 55 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:0 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 84, col 13 to line 86, col 37 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 87, col 8 to line 87, col 51 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:0 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 100, col 8 to line 100, col 109 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 101, col 8 to line 101, col 51 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2202:0 @!@!@ -End of statistics. -@!@!@ENDMSG 2202 @!@!@ -@!@!@STARTMSG 2200:0 @!@!@ -Progress(2) at 2025-01-19 18:27:38: 5 states generated (121 s/min), 2 distinct states found (48 ds/min), 0 states left on queue. -@!@!@ENDMSG 2200 @!@!@ -@!@!@STARTMSG 2199:0 @!@!@ -5 states generated, 2 distinct states found, 0 states left on queue. -@!@!@ENDMSG 2199 @!@!@ -@!@!@STARTMSG 2194:0 @!@!@ -The depth of the complete state graph search is 2. -@!@!@ENDMSG 2194 @!@!@ -@!@!@STARTMSG 2186:0 @!@!@ -Finished in 2493ms at (2025-01-19 18:27:38) -@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307660221/replicated.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307660221/replicated.tla deleted file mode 100644 index 861110267e..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307660221/replicated.tla +++ /dev/null @@ -1,131 +0,0 @@ ----- MODULE replicated ---- - -EXTENDS Integers, FiniteSets - -VARIABLES broker_state, safekeeper_state, pageserver_state, online - - -CONSTANT - brokers, - safekeepers, - pageservers, - azs, - az_mapping - -CONSTANT - NULL - -CONSTANT - max_commit_lsn - -StateConstraint == - /\ \A s \in safekeepers: - /\ safekeeper_state[s].commit_lsn <= max_commit_lsn - /\ \A b \in brokers: - /\ \A s \in DOMAIN broker_state[b].sk: - /\ broker_state[b].sk[s].commit_lsn <= max_commit_lsn - - -InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0] -InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] -InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] -InitOnline == safekeepers \cup brokers \cup pageservers - -Init == - /\ broker_state = [b \in brokers |-> InitBroker] - /\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper] - /\ pageserver_state = [p \in pageservers |-> InitPageserver] - /\ online = InitOnline - -NodeOnlineOffline == - /\ online' = CHOOSE ss \in SUBSET InitOnline: - /\ Cardinality(ss \cap safekeepers) >= 2 - /\ Cardinality(ss \cap brokers) >= 2 - /\ ss \cap pageservers = pageservers \* assume no PS failures for now - /\ UNCHANGED <> - -SkCommit(s1, s2) == - /\ {s1, s2} \subseteq online - /\ s1 # s2 - /\ safekeeper_state[s1].commit_lsn = safekeeper_state[s2].commit_lsn - /\ LET - new_commit_lsn == safekeeper_state[s1].commit_lsn + 1 - IN - safekeeper_state' = [safekeeper_state EXCEPT - ![s1].commit_lsn = new_commit_lsn, - ![s2].commit_lsn = new_commit_lsn] - /\ UNCHANGED <> - -SkPeerRecovery(s1,s2) == - /\ {s1, s2} \subseteq online - /\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn - /\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn] - /\ UNCHANGED <> - -SkPushToBroker(s,b) == - /\ {s, b} \subseteq online - /\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn - THEN - LET - bsk == broker_state[b].sk - updbsk == [bsk EXCEPT ![s].commit_lsn = safekeeper_state[s].commit_lsn] - IN - [broker_state EXCEPT ![b].sk = updbsk] - ELSE broker_state - /\ UNCHANGED <> - -PsRecvBroker(b,p,s) == - /\ {b,p,s} \subseteq online - /\ LET - bsk == broker_state[b].sk[s] - psk == pageserver_state[p].sk[s] - updpsk == [psk EXCEPT !["commit_lsn"] = bsk.commit_lsn] - IN - pageserver_state' = IF bsk.commit_lsn > psk.commit_lsn - THEN [pageserver_state EXCEPT ![p].sk[s] = updpsk] - ELSE pageserver_state - /\ UNCHANGED <> - - -SksWithNewerWal(p) == - /\ {p} \subseteq online - /\ - LET - ps == pageserver_state[p] - IN - {s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn} - -PsChooseSk(p) == - /\ SksWithNewerWal(p) # {} - /\ pageserver_state' = [pageserver_state EXCEPT![p].preferred_sk = CHOOSE s \in SksWithNewerWal(p): TRUE] - /\ UNCHANGED <> - - -Next == - \/ NodeOnlineOffline - \/ \E s1 \in safekeepers: \E s2 \in safekeepers: - \/ SkCommit(s1, s2) - \/ SkPeerRecovery(s1, s2) - \/ \E s \in safekeepers: \E b \in brokers: SkPushToBroker(s, b) - \/ \E s \in safekeepers: \E b \in brokers: \E p \in pageservers: PsRecvBroker(b,p,s) - \/ \E p \in pageservers: PsChooseSk(p) - - -Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state >> - - -\* invariants - -EventuallyLaggingSkIsNotPreferredSk == <>( - LET - sks == safekeeper_state - lagging_sks == { s \in safekeepers: \A s2 \in safekeepers: sks[s].commit_lsn <= sks[s2].commit_lsn } - preferred_sks == {pageserver_state[p].preferred_sk: p \in pageservers} - IN - preferred_sks \cap lagging_sks = {} - - ) - - - -==== \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307704621/MC.cfg b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307704621/MC.cfg deleted file mode 100644 index 17ae6b83c8..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307704621/MC.cfg +++ /dev/null @@ -1,51 +0,0 @@ -\* MV CONSTANT declarations -CONSTANTS -b1 = b1 -b2 = b2 -b3 = b3 -\* MV CONSTANT declarations -CONSTANTS -s1 = s1 -s2 = s2 -s3 = s3 -\* MV CONSTANT declarations -CONSTANTS -p1 = p1 -p2 = p2 -\* MV CONSTANT declarations -CONSTANTS -az1 = az1 -az2 = az2 -az3 = az3 -\* MV CONSTANT definitions -CONSTANT -brokers <- const_173730770045629000 -\* CONSTANT declarations -CONSTANT NULL = NULL -\* MV CONSTANT definitions -CONSTANT -safekeepers <- const_173730770045630000 -\* MV CONSTANT definitions -CONSTANT -pageservers <- const_173730770045731000 -\* MV CONSTANT definitions -CONSTANT -azs <- const_173730770045732000 -\* SYMMETRY definition -SYMMETRY symm_173730770045733000 -\* CONSTANT definitions -CONSTANT -max_commit_lsn <- const_173730770045734000 -\* CONSTANT definitions -CONSTANT -az_mapping <- const_173730770045735000 -\* CONSTRAINT definition -CONSTRAINT -constr_173730770045736000 -\* SPECIFICATION definition -SPECIFICATION -Spec -\* PROPERTY definition -PROPERTY -EventuallyLaggingSkIsNotPreferredSk -\* Generated on Sun Jan 19 18:28:20 CET 2025 \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307704621/MC.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307704621/MC.out deleted file mode 100644 index 2e22ced64d..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307704621/MC.out +++ /dev/null @@ -1,282 +0,0 @@ -@!@!@STARTMSG 2262:0 @!@!@ -TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) -@!@!@ENDMSG 2262 @!@!@ -@!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 128 and seed -4991617861993001241 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11510] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). -@!@!@ENDMSG 2187 @!@!@ -@!@!@STARTMSG 2220:0 @!@!@ -Starting SANY... -@!@!@ENDMSG 2220 @!@!@ -Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla -Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla -Semantic processing of module Naturals -Semantic processing of module Integers -Semantic processing of module Sequences -Semantic processing of module FiniteSets -Semantic processing of module replicated -Semantic processing of module TLC -Semantic processing of module MC -@!@!@STARTMSG 2219:0 @!@!@ -SANY finished. -@!@!@ENDMSG 2219 @!@!@ -@!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 18:28:21) -@!@!@ENDMSG 2185 @!@!@ -@!@!@STARTMSG 2279:3 @!@!@ -Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. -@!@!@ENDMSG 2279 @!@!@ -@!@!@STARTMSG 2284:3 @!@!@ -Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. -@!@!@ENDMSG 2284 @!@!@ -@!@!@STARTMSG 2212:0 @!@!@ -Implied-temporal checking--satisfiability problem has 1 branches. -@!@!@ENDMSG 2212 @!@!@ -@!@!@STARTMSG 2189:0 @!@!@ -Computing initial states... -@!@!@ENDMSG 2189 @!@!@ -@!@!@STARTMSG 2190:0 @!@!@ -Finished computing initial states: 1 distinct state generated at 2025-01-19 18:28:23. -@!@!@ENDMSG 2190 @!@!@ -@!@!@STARTMSG 1000:1 @!@!@ -TLC threw an unexpected exception. -This was probably caused by an error in the spec or model. -See the User Output or TLC Console for clues to what happened. -The exception was a java.lang.RuntimeException -: A non-boolean expression (a set of the form {e1, ... ,eN}) was used as a formula in a conjunction. -line 93, col 9 to line 96, col 70 of module replicated -@!@!@ENDMSG 1000 @!@!@ -@!@!@STARTMSG 2121:1 @!@!@ -The behavior up to this point is: -@!@!@ENDMSG 2121 @!@!@ -@!@!@STARTMSG 2217:4 @!@!@ -1: -/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) -/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])]) -/\ online = {b1, b2, b3, s1, s2, s3, p1, p2} -/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0]) - -@!@!@ENDMSG 2217 @!@!@ -@!@!@STARTMSG 2217:4 @!@!@ -2: -/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) -/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])]) -/\ online = {b1, b2, s1, s2, p1, p2} -/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0]) - -@!@!@ENDMSG 2217 @!@!@ -@!@!@STARTMSG 2103:1 @!@!@ -The error occurred when TLC was evaluating the nested -expressions at the following positions: -0. Line 99, column 5 to line 101, column 58 in replicated -1. Line 99, column 8 to line 99, column 30 in replicated -2. Line 99, column 8 to line 99, column 25 in replicated -3. Line 91, column 5 to line 96, column 70 in replicated - - -@!@!@ENDMSG 2103 @!@!@ -@!@!@STARTMSG 2201:0 @!@!@ -The coverage statistics at 2025-01-19 18:28:23 -@!@!@ENDMSG 2201 @!@!@ -@!@!@STARTMSG 2773:0 @!@!@ -: 2:2 -@!@!@ENDMSG 2773 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 35, col 5 to line 38, col 26 of module replicated: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 1:6 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 41, col 8 to line 44, col 44 of module replicated: 6 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 41, col 18 to line 44, col 44 of module replicated: 6 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 42, col 9 to line 44, col 44 of module replicated: 1392 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 42, col 12 to line 42, col 48 of module replicated: 1392 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 43, col 12 to line 43, col 44 of module replicated: 624 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 44, col 12 to line 44, col 44 of module replicated: 258 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 41, col 32 to line 41, col 48 of module replicated: 6 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 45, col 8 to line 45, col 67 of module replicated: 6 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 4:14 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 48, col 8 to line 48, col 32 of module replicated: 59 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2775:0 @!@!@ - |line 48, col 8 to line 48, col 15 of module replicated: 45:105 -@!@!@ENDMSG 2775 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 48, col 27 to line 48, col 32 of module replicated: 45 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 49, col 8 to line 49, col 14 of module replicated: 44 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 49, col 8 to line 49, col 9 of module replicated: 30 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 49, col 13 to line 49, col 14 of module replicated: 30 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 50, col 8 to line 50, col 72 of module replicated: 32 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 50, col 8 to line 50, col 38 of module replicated: 18 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 50, col 42 to line 50, col 72 of module replicated: 18 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 54, col 13 to line 56, col 50 of module replicated: 14 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 57, col 8 to line 57, col 58 of module replicated: 14 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 1:2 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 60, col 8 to line 60, col 32 of module replicated: 47 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2775:0 @!@!@ - |line 60, col 8 to line 60, col 15 of module replicated: 45:105 -@!@!@ENDMSG 2775 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 60, col 27 to line 60, col 32 of module replicated: 45 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 61, col 8 to line 61, col 72 of module replicated: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 61, col 8 to line 61, col 38 of module replicated: 30 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 61, col 42 to line 61, col 72 of module replicated: 30 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 62, col 8 to line 62, col 102 of module replicated: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 63, col 8 to line 63, col 58 of module replicated: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 2:30 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 66, col 8 to line 66, col 30 of module replicated: 75 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2775:0 @!@!@ - |line 66, col 8 to line 66, col 13 of module replicated: 45:111 -@!@!@ENDMSG 2775 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 66, col 25 to line 66, col 30 of module replicated: 45 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 67, col 8 to line 74, col 29 of module replicated: 30 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 67, col 24 to line 74, col 29 of module replicated: 30 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 67, col 27 to line 67, col 91 of module replicated: 30 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 70, col 28 to line 70, col 45 of module replicated: 10 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 71, col 31 to line 71, col 91 of module replicated: 10 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 73, col 17 to line 73, col 54 of module replicated: 10 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 74, col 18 to line 74, col 29 of module replicated: 20 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 75, col 8 to line 75, col 62 of module replicated: 30 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:60 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 78, col 8 to line 78, col 31 of module replicated: 150 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2775:0 @!@!@ - |line 78, col 8 to line 78, col 14 of module replicated: 90:282 -@!@!@ENDMSG 2775 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 78, col 26 to line 78, col 31 of module replicated: 90 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 84, col 13 to line 86, col 37 of module replicated: 60 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 87, col 8 to line 87, col 58 of module replicated: 60 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:0 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 99, col 8 to line 99, col 30 of module replicated: 5 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 99, col 8 to line 99, col 25 of module replicated: 5 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 91, col 5 to line 96, col 70 of module replicated: 5 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 91, col 8 to line 91, col 27 of module replicated: 5 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 94, col 19 to line 94, col 37 of module replicated: 5 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 96, col 9 to line 96, col 70 of module replicated: 5 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||||line 96, col 30 to line 96, col 69 of module replicated: 15 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||||line 96, col 16 to line 96, col 27 of module replicated: 5 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 99, col 24 to line 99, col 24 of module replicated: 5 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 100, col 8 to line 100, col 109 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 101, col 8 to line 101, col 58 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2202:0 @!@!@ -End of statistics. -@!@!@ENDMSG 2202 @!@!@ -@!@!@STARTMSG 2200:0 @!@!@ -Progress(4) at 2025-01-19 18:28:23: 97 states generated (2.165 s/min), 9 distinct states found (200 ds/min), 5 states left on queue. -@!@!@ENDMSG 2200 @!@!@ -@!@!@STARTMSG 2199:0 @!@!@ -97 states generated, 9 distinct states found, 5 states left on queue. -@!@!@ENDMSG 2199 @!@!@ -@!@!@STARTMSG 2186:0 @!@!@ -Finished in 2701ms at (2025-01-19 18:28:23) -@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307704621/MC.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307704621/MC.tla deleted file mode 100644 index 683a638594..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307704621/MC.tla +++ /dev/null @@ -1,65 +0,0 @@ ----- MODULE MC ---- -EXTENDS replicated, TLC - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -b1, b2, b3 ----- - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -s1, s2, s3 ----- - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -p1, p2 ----- - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -az1, az2, az3 ----- - -\* MV CONSTANT definitions brokers -const_173730770045629000 == -{b1, b2, b3} ----- - -\* MV CONSTANT definitions safekeepers -const_173730770045630000 == -{s1, s2, s3} ----- - -\* MV CONSTANT definitions pageservers -const_173730770045731000 == -{p1, p2} ----- - -\* MV CONSTANT definitions azs -const_173730770045732000 == -{az1, az2, az3} ----- - -\* SYMMETRY definition -symm_173730770045733000 == -Permutations(const_173730770045629000) \union Permutations(const_173730770045630000) \union Permutations(const_173730770045731000) \union Permutations(const_173730770045732000) ----- - -\* CONSTANT definitions @modelParameterConstants:4max_commit_lsn -const_173730770045734000 == -2 ----- - -\* CONSTANT definitions @modelParameterConstants:5az_mapping -const_173730770045735000 == -[ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2,p2} , az3 |-> {b3,s3}] ----- - -\* CONSTRAINT definition @modelParameterContraint:0 -constr_173730770045736000 == -StateConstraint ----- -============================================================================= -\* Modification History -\* Created Sun Jan 19 18:28:20 CET 2025 by cs diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307704621/MC_TE.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307704621/MC_TE.out deleted file mode 100644 index 2e22ced64d..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307704621/MC_TE.out +++ /dev/null @@ -1,282 +0,0 @@ -@!@!@STARTMSG 2262:0 @!@!@ -TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) -@!@!@ENDMSG 2262 @!@!@ -@!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 128 and seed -4991617861993001241 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11510] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). -@!@!@ENDMSG 2187 @!@!@ -@!@!@STARTMSG 2220:0 @!@!@ -Starting SANY... -@!@!@ENDMSG 2220 @!@!@ -Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla -Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla -Semantic processing of module Naturals -Semantic processing of module Integers -Semantic processing of module Sequences -Semantic processing of module FiniteSets -Semantic processing of module replicated -Semantic processing of module TLC -Semantic processing of module MC -@!@!@STARTMSG 2219:0 @!@!@ -SANY finished. -@!@!@ENDMSG 2219 @!@!@ -@!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 18:28:21) -@!@!@ENDMSG 2185 @!@!@ -@!@!@STARTMSG 2279:3 @!@!@ -Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. -@!@!@ENDMSG 2279 @!@!@ -@!@!@STARTMSG 2284:3 @!@!@ -Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. -@!@!@ENDMSG 2284 @!@!@ -@!@!@STARTMSG 2212:0 @!@!@ -Implied-temporal checking--satisfiability problem has 1 branches. -@!@!@ENDMSG 2212 @!@!@ -@!@!@STARTMSG 2189:0 @!@!@ -Computing initial states... -@!@!@ENDMSG 2189 @!@!@ -@!@!@STARTMSG 2190:0 @!@!@ -Finished computing initial states: 1 distinct state generated at 2025-01-19 18:28:23. -@!@!@ENDMSG 2190 @!@!@ -@!@!@STARTMSG 1000:1 @!@!@ -TLC threw an unexpected exception. -This was probably caused by an error in the spec or model. -See the User Output or TLC Console for clues to what happened. -The exception was a java.lang.RuntimeException -: A non-boolean expression (a set of the form {e1, ... ,eN}) was used as a formula in a conjunction. -line 93, col 9 to line 96, col 70 of module replicated -@!@!@ENDMSG 1000 @!@!@ -@!@!@STARTMSG 2121:1 @!@!@ -The behavior up to this point is: -@!@!@ENDMSG 2121 @!@!@ -@!@!@STARTMSG 2217:4 @!@!@ -1: -/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) -/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])]) -/\ online = {b1, b2, b3, s1, s2, s3, p1, p2} -/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0]) - -@!@!@ENDMSG 2217 @!@!@ -@!@!@STARTMSG 2217:4 @!@!@ -2: -/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL] @@ p2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) -/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])]) -/\ online = {b1, b2, s1, s2, p1, p2} -/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0]) - -@!@!@ENDMSG 2217 @!@!@ -@!@!@STARTMSG 2103:1 @!@!@ -The error occurred when TLC was evaluating the nested -expressions at the following positions: -0. Line 99, column 5 to line 101, column 58 in replicated -1. Line 99, column 8 to line 99, column 30 in replicated -2. Line 99, column 8 to line 99, column 25 in replicated -3. Line 91, column 5 to line 96, column 70 in replicated - - -@!@!@ENDMSG 2103 @!@!@ -@!@!@STARTMSG 2201:0 @!@!@ -The coverage statistics at 2025-01-19 18:28:23 -@!@!@ENDMSG 2201 @!@!@ -@!@!@STARTMSG 2773:0 @!@!@ -: 2:2 -@!@!@ENDMSG 2773 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 35, col 5 to line 38, col 26 of module replicated: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 1:6 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 41, col 8 to line 44, col 44 of module replicated: 6 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 41, col 18 to line 44, col 44 of module replicated: 6 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 42, col 9 to line 44, col 44 of module replicated: 1392 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 42, col 12 to line 42, col 48 of module replicated: 1392 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 43, col 12 to line 43, col 44 of module replicated: 624 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 44, col 12 to line 44, col 44 of module replicated: 258 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 41, col 32 to line 41, col 48 of module replicated: 6 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 45, col 8 to line 45, col 67 of module replicated: 6 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 4:14 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 48, col 8 to line 48, col 32 of module replicated: 59 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2775:0 @!@!@ - |line 48, col 8 to line 48, col 15 of module replicated: 45:105 -@!@!@ENDMSG 2775 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 48, col 27 to line 48, col 32 of module replicated: 45 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 49, col 8 to line 49, col 14 of module replicated: 44 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 49, col 8 to line 49, col 9 of module replicated: 30 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 49, col 13 to line 49, col 14 of module replicated: 30 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 50, col 8 to line 50, col 72 of module replicated: 32 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 50, col 8 to line 50, col 38 of module replicated: 18 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 50, col 42 to line 50, col 72 of module replicated: 18 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 54, col 13 to line 56, col 50 of module replicated: 14 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 57, col 8 to line 57, col 58 of module replicated: 14 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 1:2 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 60, col 8 to line 60, col 32 of module replicated: 47 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2775:0 @!@!@ - |line 60, col 8 to line 60, col 15 of module replicated: 45:105 -@!@!@ENDMSG 2775 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 60, col 27 to line 60, col 32 of module replicated: 45 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 61, col 8 to line 61, col 72 of module replicated: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 61, col 8 to line 61, col 38 of module replicated: 30 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 61, col 42 to line 61, col 72 of module replicated: 30 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 62, col 8 to line 62, col 102 of module replicated: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 63, col 8 to line 63, col 58 of module replicated: 2 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 2:30 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 66, col 8 to line 66, col 30 of module replicated: 75 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2775:0 @!@!@ - |line 66, col 8 to line 66, col 13 of module replicated: 45:111 -@!@!@ENDMSG 2775 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 66, col 25 to line 66, col 30 of module replicated: 45 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 67, col 8 to line 74, col 29 of module replicated: 30 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 67, col 24 to line 74, col 29 of module replicated: 30 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 67, col 27 to line 67, col 91 of module replicated: 30 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 70, col 28 to line 70, col 45 of module replicated: 10 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 71, col 31 to line 71, col 91 of module replicated: 10 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 73, col 17 to line 73, col 54 of module replicated: 10 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 74, col 18 to line 74, col 29 of module replicated: 20 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 75, col 8 to line 75, col 62 of module replicated: 30 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:60 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 78, col 8 to line 78, col 31 of module replicated: 150 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2775:0 @!@!@ - |line 78, col 8 to line 78, col 14 of module replicated: 90:282 -@!@!@ENDMSG 2775 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 78, col 26 to line 78, col 31 of module replicated: 90 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 84, col 13 to line 86, col 37 of module replicated: 60 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 87, col 8 to line 87, col 58 of module replicated: 60 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 0:0 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 99, col 8 to line 99, col 30 of module replicated: 5 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 99, col 8 to line 99, col 25 of module replicated: 5 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 91, col 5 to line 96, col 70 of module replicated: 5 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 91, col 8 to line 91, col 27 of module replicated: 5 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 94, col 19 to line 94, col 37 of module replicated: 5 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 96, col 9 to line 96, col 70 of module replicated: 5 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||||line 96, col 30 to line 96, col 69 of module replicated: 15 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||||line 96, col 16 to line 96, col 27 of module replicated: 5 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 99, col 24 to line 99, col 24 of module replicated: 5 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 100, col 8 to line 100, col 109 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 101, col 8 to line 101, col 58 of module replicated: 0 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2202:0 @!@!@ -End of statistics. -@!@!@ENDMSG 2202 @!@!@ -@!@!@STARTMSG 2200:0 @!@!@ -Progress(4) at 2025-01-19 18:28:23: 97 states generated (2.165 s/min), 9 distinct states found (200 ds/min), 5 states left on queue. -@!@!@ENDMSG 2200 @!@!@ -@!@!@STARTMSG 2199:0 @!@!@ -97 states generated, 9 distinct states found, 5 states left on queue. -@!@!@ENDMSG 2199 @!@!@ -@!@!@STARTMSG 2186:0 @!@!@ -Finished in 2701ms at (2025-01-19 18:28:23) -@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307704621/replicated.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307704621/replicated.tla deleted file mode 100644 index a9b14acae2..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307704621/replicated.tla +++ /dev/null @@ -1,131 +0,0 @@ ----- MODULE replicated ---- - -EXTENDS Integers, FiniteSets - -VARIABLES broker_state, safekeeper_state, pageserver_state, online - - -CONSTANT - brokers, - safekeepers, - pageservers, - azs, - az_mapping - -CONSTANT - NULL - -CONSTANT - max_commit_lsn - -StateConstraint == - /\ \A s \in safekeepers: - /\ safekeeper_state[s].commit_lsn <= max_commit_lsn - /\ \A b \in brokers: - /\ \A s \in DOMAIN broker_state[b].sk: - /\ broker_state[b].sk[s].commit_lsn <= max_commit_lsn - - -InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0] -InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] -InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] -InitOnline == safekeepers \cup brokers \cup pageservers - -Init == - /\ broker_state = [b \in brokers |-> InitBroker] - /\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper] - /\ pageserver_state = [p \in pageservers |-> InitPageserver] - /\ online = InitOnline - -NodeOnlineOffline == - /\ online' = CHOOSE ss \in SUBSET InitOnline: - /\ Cardinality(ss \cap safekeepers) >= 2 - /\ Cardinality(ss \cap brokers) >= 2 - /\ ss \cap pageservers = pageservers \* assume no PS failures for now - /\ UNCHANGED <> - -SkCommit(s1, s2) == - /\ {s1, s2} \subseteq online - /\ s1 # s2 - /\ safekeeper_state[s1].commit_lsn = safekeeper_state[s2].commit_lsn - /\ LET - new_commit_lsn == safekeeper_state[s1].commit_lsn + 1 - IN - safekeeper_state' = [safekeeper_state EXCEPT - ![s1].commit_lsn = new_commit_lsn, - ![s2].commit_lsn = new_commit_lsn] - /\ UNCHANGED <> - -SkPeerRecovery(s1,s2) == - /\ {s1, s2} \subseteq online - /\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn - /\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn] - /\ UNCHANGED <> - -SkPushToBroker(s,b) == - /\ {s, b} \subseteq online - /\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn - THEN - LET - bsk == broker_state[b].sk - updbsk == [bsk EXCEPT ![s].commit_lsn = safekeeper_state[s].commit_lsn] - IN - [broker_state EXCEPT ![b].sk = updbsk] - ELSE broker_state - /\ UNCHANGED <> - -PsRecvBroker(b,p,s) == - /\ {b,p,s} \subseteq online - /\ LET - bsk == broker_state[b].sk[s] - psk == pageserver_state[p].sk[s] - updpsk == [psk EXCEPT !["commit_lsn"] = bsk.commit_lsn] - IN - pageserver_state' = IF bsk.commit_lsn > psk.commit_lsn - THEN [pageserver_state EXCEPT ![p].sk[s] = updpsk] - ELSE pageserver_state - /\ UNCHANGED <> - - -SksWithNewerWal(p) == - /\ {p} \subseteq online - /\ - LET - ps == pageserver_state[p] - IN - {s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn} - -PsChooseSk(p) == - /\ SksWithNewerWal(p) # {} - /\ pageserver_state' = [pageserver_state EXCEPT![p].preferred_sk = CHOOSE s \in SksWithNewerWal(p): TRUE] - /\ UNCHANGED <> - - -Next == - \/ NodeOnlineOffline - \/ \E s1 \in safekeepers: \E s2 \in safekeepers: - \/ SkCommit(s1, s2) - \/ SkPeerRecovery(s1, s2) - \/ \E s \in safekeepers: \E b \in brokers: SkPushToBroker(s, b) - \/ \E s \in safekeepers: \E b \in brokers: \E p \in pageservers: PsRecvBroker(b,p,s) - \/ \E p \in pageservers: PsChooseSk(p) - - -Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state,online>> - - -\* invariants - -EventuallyLaggingSkIsNotPreferredSk == <>( - LET - sks == safekeeper_state - lagging_sks == { s \in safekeepers: \A s2 \in safekeepers: sks[s].commit_lsn <= sks[s2].commit_lsn } - preferred_sks == {pageserver_state[p].preferred_sk: p \in pageservers} - IN - preferred_sks \cap lagging_sks = {} - - ) - - - -==== \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307769810/MC.cfg b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307769810/MC.cfg deleted file mode 100644 index d1470337f9..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307769810/MC.cfg +++ /dev/null @@ -1,51 +0,0 @@ -\* MV CONSTANT declarations -CONSTANTS -b1 = b1 -b2 = b2 -b3 = b3 -\* MV CONSTANT declarations -CONSTANTS -s1 = s1 -s2 = s2 -s3 = s3 -\* MV CONSTANT declarations -CONSTANTS -p1 = p1 -p2 = p2 -\* MV CONSTANT declarations -CONSTANTS -az1 = az1 -az2 = az2 -az3 = az3 -\* MV CONSTANT definitions -CONSTANT -brokers <- const_173730775393038000 -\* CONSTANT declarations -CONSTANT NULL = NULL -\* MV CONSTANT definitions -CONSTANT -safekeepers <- const_173730775393039000 -\* MV CONSTANT definitions -CONSTANT -pageservers <- const_173730775393040000 -\* MV CONSTANT definitions -CONSTANT -azs <- const_173730775393041000 -\* SYMMETRY definition -SYMMETRY symm_173730775393042000 -\* CONSTANT definitions -CONSTANT -max_commit_lsn <- const_173730775393043000 -\* CONSTANT definitions -CONSTANT -az_mapping <- const_173730775393044000 -\* CONSTRAINT definition -CONSTRAINT -constr_173730775393045000 -\* SPECIFICATION definition -SPECIFICATION -Spec -\* PROPERTY definition -PROPERTY -EventuallyLaggingSkIsNotPreferredSk -\* Generated on Sun Jan 19 18:29:13 CET 2025 \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307769810/MC.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307769810/MC.tla deleted file mode 100644 index 8b1824f370..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307769810/MC.tla +++ /dev/null @@ -1,65 +0,0 @@ ----- MODULE MC ---- -EXTENDS replicated, TLC - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -b1, b2, b3 ----- - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -s1, s2, s3 ----- - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -p1, p2 ----- - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -az1, az2, az3 ----- - -\* MV CONSTANT definitions brokers -const_173730775393038000 == -{b1, b2, b3} ----- - -\* MV CONSTANT definitions safekeepers -const_173730775393039000 == -{s1, s2, s3} ----- - -\* MV CONSTANT definitions pageservers -const_173730775393040000 == -{p1, p2} ----- - -\* MV CONSTANT definitions azs -const_173730775393041000 == -{az1, az2, az3} ----- - -\* SYMMETRY definition -symm_173730775393042000 == -Permutations(const_173730775393038000) \union Permutations(const_173730775393039000) \union Permutations(const_173730775393040000) \union Permutations(const_173730775393041000) ----- - -\* CONSTANT definitions @modelParameterConstants:4max_commit_lsn -const_173730775393043000 == -2 ----- - -\* CONSTANT definitions @modelParameterConstants:5az_mapping -const_173730775393044000 == -[ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2,p2} , az3 |-> {b3,s3}] ----- - -\* CONSTRAINT definition @modelParameterContraint:0 -constr_173730775393045000 == -StateConstraint ----- -============================================================================= -\* Modification History -\* Created Sun Jan 19 18:29:13 CET 2025 by cs diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307769810/MC_TE.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307769810/MC_TE.out deleted file mode 100644 index 21638f26fe..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307769810/MC_TE.out +++ /dev/null @@ -1,53 +0,0 @@ -@!@!@STARTMSG 2262:0 @!@!@ -TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) -@!@!@ENDMSG 2262 @!@!@ -@!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 19 and seed -4959290627086969114 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11541] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). -@!@!@ENDMSG 2187 @!@!@ -@!@!@STARTMSG 2220:0 @!@!@ -Starting SANY... -@!@!@ENDMSG 2220 @!@!@ -Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla -Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla -Semantic processing of module Naturals -Semantic processing of module Integers -Semantic processing of module Sequences -Semantic processing of module FiniteSets -Semantic processing of module replicated -Semantic processing of module TLC -Semantic processing of module MC -@!@!@STARTMSG 2219:0 @!@!@ -SANY finished. -@!@!@ENDMSG 2219 @!@!@ -@!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 18:29:15) -@!@!@ENDMSG 2185 @!@!@ -@!@!@STARTMSG 2279:3 @!@!@ -Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. -@!@!@ENDMSG 2279 @!@!@ -@!@!@STARTMSG 2284:3 @!@!@ -Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. -@!@!@ENDMSG 2284 @!@!@ -@!@!@STARTMSG 2212:0 @!@!@ -Implied-temporal checking--satisfiability problem has 1 branches. -@!@!@ENDMSG 2212 @!@!@ -@!@!@STARTMSG 2189:0 @!@!@ -Computing initial states... -@!@!@ENDMSG 2189 @!@!@ -@!@!@STARTMSG 2190:0 @!@!@ -Finished computing initial states: 1 distinct state generated at 2025-01-19 18:29:16. -@!@!@ENDMSG 2190 @!@!@ -@!@!@STARTMSG 2192:0 @!@!@ -Checking temporal properties for the current state space with 1431 total distinct states at (2025-01-19 18:29:19) -@!@!@ENDMSG 2192 @!@!@ -@!@!@STARTMSG 2267:0 @!@!@ -Finished checking temporal properties in 00s at 2025-01-19 18:29:19 -@!@!@ENDMSG 2267 @!@!@ -@!@!@STARTMSG 2200:0 @!@!@ -Progress(10) at 2025-01-19 18:29:19: 38.274 states generated (38.274 s/min), 4.060 distinct states found (4.060 ds/min), 2.625 states left on queue. -@!@!@ENDMSG 2200 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307769810/replicated.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307769810/replicated.tla deleted file mode 100644 index fca339edab..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307769810/replicated.tla +++ /dev/null @@ -1,130 +0,0 @@ ----- MODULE replicated ---- - -EXTENDS Integers, FiniteSets - -VARIABLES broker_state, safekeeper_state, pageserver_state, online - - -CONSTANT - brokers, - safekeepers, - pageservers, - azs, - az_mapping - -CONSTANT - NULL - -CONSTANT - max_commit_lsn - -StateConstraint == - /\ \A s \in safekeepers: - /\ safekeeper_state[s].commit_lsn <= max_commit_lsn - /\ \A b \in brokers: - /\ \A s \in DOMAIN broker_state[b].sk: - /\ broker_state[b].sk[s].commit_lsn <= max_commit_lsn - - -InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0] -InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] -InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] -InitOnline == safekeepers \cup brokers \cup pageservers - -Init == - /\ broker_state = [b \in brokers |-> InitBroker] - /\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper] - /\ pageserver_state = [p \in pageservers |-> InitPageserver] - /\ online = InitOnline - -NodeOnlineOffline == - /\ online' = CHOOSE ss \in SUBSET InitOnline: - /\ Cardinality(ss \cap safekeepers) >= 2 - /\ Cardinality(ss \cap brokers) >= 2 - /\ ss \cap pageservers = pageservers \* assume no PS failures for now - /\ UNCHANGED <> - -SkCommit(s1, s2) == - /\ {s1, s2} \subseteq online - /\ s1 # s2 - /\ safekeeper_state[s1].commit_lsn = safekeeper_state[s2].commit_lsn - /\ LET - new_commit_lsn == safekeeper_state[s1].commit_lsn + 1 - IN - safekeeper_state' = [safekeeper_state EXCEPT - ![s1].commit_lsn = new_commit_lsn, - ![s2].commit_lsn = new_commit_lsn] - /\ UNCHANGED <> - -SkPeerRecovery(s1,s2) == - /\ {s1, s2} \subseteq online - /\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn - /\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn] - /\ UNCHANGED <> - -SkPushToBroker(s,b) == - /\ {s, b} \subseteq online - /\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn - THEN - LET - bsk == broker_state[b].sk - updbsk == [bsk EXCEPT ![s].commit_lsn = safekeeper_state[s].commit_lsn] - IN - [broker_state EXCEPT ![b].sk = updbsk] - ELSE broker_state - /\ UNCHANGED <> - -PsRecvBroker(b,p,s) == - /\ {b,p,s} \subseteq online - /\ LET - bsk == broker_state[b].sk[s] - psk == pageserver_state[p].sk[s] - updpsk == [psk EXCEPT !["commit_lsn"] = bsk.commit_lsn] - IN - pageserver_state' = IF bsk.commit_lsn > psk.commit_lsn - THEN [pageserver_state EXCEPT ![p].sk[s] = updpsk] - ELSE pageserver_state - /\ UNCHANGED <> - - -SksWithNewerWal(p) == - LET - ps == pageserver_state[p] - IN - {s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn} - -PsChooseSk(p) == - /\ {p} \subseteq online - /\ SksWithNewerWal(p) # {} - /\ pageserver_state' = [pageserver_state EXCEPT![p].preferred_sk = CHOOSE s \in SksWithNewerWal(p): TRUE] - /\ UNCHANGED <> - - -Next == - \/ NodeOnlineOffline - \/ \E s1 \in safekeepers: \E s2 \in safekeepers: - \/ SkCommit(s1, s2) - \/ SkPeerRecovery(s1, s2) - \/ \E s \in safekeepers: \E b \in brokers: SkPushToBroker(s, b) - \/ \E s \in safekeepers: \E b \in brokers: \E p \in pageservers: PsRecvBroker(b,p,s) - \/ \E p \in pageservers: PsChooseSk(p) - - -Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state,online>> - - -\* invariants - -EventuallyLaggingSkIsNotPreferredSk == <>( - LET - sks == safekeeper_state - lagging_sks == { s \in safekeepers: \A s2 \in safekeepers: sks[s].commit_lsn <= sks[s2].commit_lsn } - preferred_sks == {pageserver_state[p].preferred_sk: p \in pageservers} - IN - preferred_sks \cap lagging_sks = {} - - ) - - - -==== \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307828738/MC.cfg b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307828738/MC.cfg deleted file mode 100644 index ff576a1795..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307828738/MC.cfg +++ /dev/null @@ -1,50 +0,0 @@ -\* MV CONSTANT declarations -CONSTANTS -b1 = b1 -b2 = b2 -b3 = b3 -\* MV CONSTANT declarations -CONSTANTS -s1 = s1 -s2 = s2 -s3 = s3 -\* MV CONSTANT declarations -CONSTANTS -p1 = p1 -\* MV CONSTANT declarations -CONSTANTS -az1 = az1 -az2 = az2 -az3 = az3 -\* MV CONSTANT definitions -CONSTANT -brokers <- const_173730781391774000 -\* CONSTANT declarations -CONSTANT NULL = NULL -\* MV CONSTANT definitions -CONSTANT -safekeepers <- const_173730781391775000 -\* MV CONSTANT definitions -CONSTANT -pageservers <- const_173730781391776000 -\* MV CONSTANT definitions -CONSTANT -azs <- const_173730781391777000 -\* SYMMETRY definition -SYMMETRY symm_173730781391778000 -\* CONSTANT definitions -CONSTANT -max_commit_lsn <- const_173730781391779000 -\* CONSTANT definitions -CONSTANT -az_mapping <- const_173730781391780000 -\* CONSTRAINT definition -CONSTRAINT -constr_173730781391781000 -\* SPECIFICATION definition -SPECIFICATION -Spec -\* PROPERTY definition -PROPERTY -EventuallyLaggingSkIsNotPreferredSk -\* Generated on Sun Jan 19 18:30:13 CET 2025 \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307828738/MC.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307828738/MC.out deleted file mode 100644 index f1349ccb01..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307828738/MC.out +++ /dev/null @@ -1,53 +0,0 @@ -@!@!@STARTMSG 2262:0 @!@!@ -TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) -@!@!@ENDMSG 2262 @!@!@ -@!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 24 and seed -1042781833563910669 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11591] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). -@!@!@ENDMSG 2187 @!@!@ -@!@!@STARTMSG 2220:0 @!@!@ -Starting SANY... -@!@!@ENDMSG 2220 @!@!@ -Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla -Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla -Semantic processing of module Naturals -Semantic processing of module Integers -Semantic processing of module Sequences -Semantic processing of module FiniteSets -Semantic processing of module replicated -Semantic processing of module TLC -Semantic processing of module MC -@!@!@STARTMSG 2219:0 @!@!@ -SANY finished. -@!@!@ENDMSG 2219 @!@!@ -@!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 18:30:15) -@!@!@ENDMSG 2185 @!@!@ -@!@!@STARTMSG 2279:3 @!@!@ -Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. -@!@!@ENDMSG 2279 @!@!@ -@!@!@STARTMSG 2284:3 @!@!@ -Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. -@!@!@ENDMSG 2284 @!@!@ -@!@!@STARTMSG 2212:0 @!@!@ -Implied-temporal checking--satisfiability problem has 1 branches. -@!@!@ENDMSG 2212 @!@!@ -@!@!@STARTMSG 2189:0 @!@!@ -Computing initial states... -@!@!@ENDMSG 2189 @!@!@ -@!@!@STARTMSG 2190:0 @!@!@ -Finished computing initial states: 1 distinct state generated at 2025-01-19 18:30:16. -@!@!@ENDMSG 2190 @!@!@ -@!@!@STARTMSG 2192:0 @!@!@ -Checking temporal properties for the current state space with 3889 total distinct states at (2025-01-19 18:30:19) -@!@!@ENDMSG 2192 @!@!@ -@!@!@STARTMSG 2267:0 @!@!@ -Finished checking temporal properties in 00s at 2025-01-19 18:30:19 -@!@!@ENDMSG 2267 @!@!@ -@!@!@STARTMSG 2200:0 @!@!@ -Progress(11) at 2025-01-19 18:30:19: 78.397 states generated (78.397 s/min), 8.627 distinct states found (8.627 ds/min), 4.735 states left on queue. -@!@!@ENDMSG 2200 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307828738/MC_TE.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307828738/MC_TE.out deleted file mode 100644 index f1349ccb01..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307828738/MC_TE.out +++ /dev/null @@ -1,53 +0,0 @@ -@!@!@STARTMSG 2262:0 @!@!@ -TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) -@!@!@ENDMSG 2262 @!@!@ -@!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 24 and seed -1042781833563910669 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11591] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). -@!@!@ENDMSG 2187 @!@!@ -@!@!@STARTMSG 2220:0 @!@!@ -Starting SANY... -@!@!@ENDMSG 2220 @!@!@ -Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla -Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla -Semantic processing of module Naturals -Semantic processing of module Integers -Semantic processing of module Sequences -Semantic processing of module FiniteSets -Semantic processing of module replicated -Semantic processing of module TLC -Semantic processing of module MC -@!@!@STARTMSG 2219:0 @!@!@ -SANY finished. -@!@!@ENDMSG 2219 @!@!@ -@!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 18:30:15) -@!@!@ENDMSG 2185 @!@!@ -@!@!@STARTMSG 2279:3 @!@!@ -Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. -@!@!@ENDMSG 2279 @!@!@ -@!@!@STARTMSG 2284:3 @!@!@ -Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. -@!@!@ENDMSG 2284 @!@!@ -@!@!@STARTMSG 2212:0 @!@!@ -Implied-temporal checking--satisfiability problem has 1 branches. -@!@!@ENDMSG 2212 @!@!@ -@!@!@STARTMSG 2189:0 @!@!@ -Computing initial states... -@!@!@ENDMSG 2189 @!@!@ -@!@!@STARTMSG 2190:0 @!@!@ -Finished computing initial states: 1 distinct state generated at 2025-01-19 18:30:16. -@!@!@ENDMSG 2190 @!@!@ -@!@!@STARTMSG 2192:0 @!@!@ -Checking temporal properties for the current state space with 3889 total distinct states at (2025-01-19 18:30:19) -@!@!@ENDMSG 2192 @!@!@ -@!@!@STARTMSG 2267:0 @!@!@ -Finished checking temporal properties in 00s at 2025-01-19 18:30:19 -@!@!@ENDMSG 2267 @!@!@ -@!@!@STARTMSG 2200:0 @!@!@ -Progress(11) at 2025-01-19 18:30:19: 78.397 states generated (78.397 s/min), 8.627 distinct states found (8.627 ds/min), 4.735 states left on queue. -@!@!@ENDMSG 2200 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307828738/replicated.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307828738/replicated.tla deleted file mode 100644 index fca339edab..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307828738/replicated.tla +++ /dev/null @@ -1,130 +0,0 @@ ----- MODULE replicated ---- - -EXTENDS Integers, FiniteSets - -VARIABLES broker_state, safekeeper_state, pageserver_state, online - - -CONSTANT - brokers, - safekeepers, - pageservers, - azs, - az_mapping - -CONSTANT - NULL - -CONSTANT - max_commit_lsn - -StateConstraint == - /\ \A s \in safekeepers: - /\ safekeeper_state[s].commit_lsn <= max_commit_lsn - /\ \A b \in brokers: - /\ \A s \in DOMAIN broker_state[b].sk: - /\ broker_state[b].sk[s].commit_lsn <= max_commit_lsn - - -InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0] -InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] -InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] -InitOnline == safekeepers \cup brokers \cup pageservers - -Init == - /\ broker_state = [b \in brokers |-> InitBroker] - /\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper] - /\ pageserver_state = [p \in pageservers |-> InitPageserver] - /\ online = InitOnline - -NodeOnlineOffline == - /\ online' = CHOOSE ss \in SUBSET InitOnline: - /\ Cardinality(ss \cap safekeepers) >= 2 - /\ Cardinality(ss \cap brokers) >= 2 - /\ ss \cap pageservers = pageservers \* assume no PS failures for now - /\ UNCHANGED <> - -SkCommit(s1, s2) == - /\ {s1, s2} \subseteq online - /\ s1 # s2 - /\ safekeeper_state[s1].commit_lsn = safekeeper_state[s2].commit_lsn - /\ LET - new_commit_lsn == safekeeper_state[s1].commit_lsn + 1 - IN - safekeeper_state' = [safekeeper_state EXCEPT - ![s1].commit_lsn = new_commit_lsn, - ![s2].commit_lsn = new_commit_lsn] - /\ UNCHANGED <> - -SkPeerRecovery(s1,s2) == - /\ {s1, s2} \subseteq online - /\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn - /\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn] - /\ UNCHANGED <> - -SkPushToBroker(s,b) == - /\ {s, b} \subseteq online - /\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn - THEN - LET - bsk == broker_state[b].sk - updbsk == [bsk EXCEPT ![s].commit_lsn = safekeeper_state[s].commit_lsn] - IN - [broker_state EXCEPT ![b].sk = updbsk] - ELSE broker_state - /\ UNCHANGED <> - -PsRecvBroker(b,p,s) == - /\ {b,p,s} \subseteq online - /\ LET - bsk == broker_state[b].sk[s] - psk == pageserver_state[p].sk[s] - updpsk == [psk EXCEPT !["commit_lsn"] = bsk.commit_lsn] - IN - pageserver_state' = IF bsk.commit_lsn > psk.commit_lsn - THEN [pageserver_state EXCEPT ![p].sk[s] = updpsk] - ELSE pageserver_state - /\ UNCHANGED <> - - -SksWithNewerWal(p) == - LET - ps == pageserver_state[p] - IN - {s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn} - -PsChooseSk(p) == - /\ {p} \subseteq online - /\ SksWithNewerWal(p) # {} - /\ pageserver_state' = [pageserver_state EXCEPT![p].preferred_sk = CHOOSE s \in SksWithNewerWal(p): TRUE] - /\ UNCHANGED <> - - -Next == - \/ NodeOnlineOffline - \/ \E s1 \in safekeepers: \E s2 \in safekeepers: - \/ SkCommit(s1, s2) - \/ SkPeerRecovery(s1, s2) - \/ \E s \in safekeepers: \E b \in brokers: SkPushToBroker(s, b) - \/ \E s \in safekeepers: \E b \in brokers: \E p \in pageservers: PsRecvBroker(b,p,s) - \/ \E p \in pageservers: PsChooseSk(p) - - -Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state,online>> - - -\* invariants - -EventuallyLaggingSkIsNotPreferredSk == <>( - LET - sks == safekeeper_state - lagging_sks == { s \in safekeepers: \A s2 \in safekeepers: sks[s].commit_lsn <= sks[s2].commit_lsn } - preferred_sks == {pageserver_state[p].preferred_sk: p \in pageservers} - IN - preferred_sks \cap lagging_sks = {} - - ) - - - -==== \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308024914/MC.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308024914/MC.out deleted file mode 100644 index 59da3df845..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308024914/MC.out +++ /dev/null @@ -1,35 +0,0 @@ -@!@!@STARTMSG 2262:0 @!@!@ -TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) -@!@!@ENDMSG 2262 @!@!@ -@!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 95 and seed 5720921755138129000 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11738] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). -@!@!@ENDMSG 2187 @!@!@ -@!@!@STARTMSG 2220:0 @!@!@ -Starting SANY... -@!@!@ENDMSG 2220 @!@!@ -Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla -Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla -Semantic processing of module Naturals -Semantic processing of module Integers -Semantic processing of module Sequences -Semantic processing of module FiniteSets -Semantic processing of module replicated -Semantic processing of module TLC -Semantic processing of module MC -@!@!@STARTMSG 2219:0 @!@!@ -SANY finished. -@!@!@ENDMSG 2219 @!@!@ -@!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 18:33:43) -@!@!@ENDMSG 2185 @!@!@ -@!@!@STARTMSG 2146:1 @!@!@ -The invariant PsLagsSk is not a state predicate (one with no primes or temporal operators). -@!@!@ENDMSG 2146 @!@!@ -@!@!@STARTMSG 2186:0 @!@!@ -Finished in 1009ms at (2025-01-19 18:33:43) -@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308024914/MC_TE.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308024914/MC_TE.out deleted file mode 100644 index 59da3df845..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308024914/MC_TE.out +++ /dev/null @@ -1,35 +0,0 @@ -@!@!@STARTMSG 2262:0 @!@!@ -TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) -@!@!@ENDMSG 2262 @!@!@ -@!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 95 and seed 5720921755138129000 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11738] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). -@!@!@ENDMSG 2187 @!@!@ -@!@!@STARTMSG 2220:0 @!@!@ -Starting SANY... -@!@!@ENDMSG 2220 @!@!@ -Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla -Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla -Semantic processing of module Naturals -Semantic processing of module Integers -Semantic processing of module Sequences -Semantic processing of module FiniteSets -Semantic processing of module replicated -Semantic processing of module TLC -Semantic processing of module MC -@!@!@STARTMSG 2219:0 @!@!@ -SANY finished. -@!@!@ENDMSG 2219 @!@!@ -@!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 18:33:43) -@!@!@ENDMSG 2185 @!@!@ -@!@!@STARTMSG 2146:1 @!@!@ -The invariant PsLagsSk is not a state predicate (one with no primes or temporal operators). -@!@!@ENDMSG 2146 @!@!@ -@!@!@STARTMSG 2186:0 @!@!@ -Finished in 1009ms at (2025-01-19 18:33:43) -@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308183077/MC.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308183077/MC.out deleted file mode 100644 index 00a833e2f0..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308183077/MC.out +++ /dev/null @@ -1,52 +0,0 @@ -@!@!@STARTMSG 2262:0 @!@!@ -TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) -@!@!@ENDMSG 2262 @!@!@ -@!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 92 and seed -5681728403679829533 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11930] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). -@!@!@ENDMSG 2187 @!@!@ -@!@!@STARTMSG 2220:0 @!@!@ -Starting SANY... -@!@!@ENDMSG 2220 @!@!@ -Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla -Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla -Semantic processing of module Naturals -Semantic processing of module Integers -Semantic processing of module Sequences -Semantic processing of module FiniteSets -Semantic processing of module replicated -Semantic processing of module TLC -Semantic processing of module MC -@!@!@STARTMSG 2219:0 @!@!@ -SANY finished. -@!@!@ENDMSG 2219 @!@!@ -@!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 18:36:20) -@!@!@ENDMSG 2185 @!@!@ -@!@!@STARTMSG 2279:3 @!@!@ -Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. -@!@!@ENDMSG 2279 @!@!@ -@!@!@STARTMSG 2284:3 @!@!@ -Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. -@!@!@ENDMSG 2284 @!@!@ -@!@!@STARTMSG 2212:0 @!@!@ -Implied-temporal checking--satisfiability problem has 1 branches. -@!@!@ENDMSG 2212 @!@!@ -@!@!@STARTMSG 2189:0 @!@!@ -Computing initial states... -@!@!@ENDMSG 2189 @!@!@ -@!@!@STARTMSG 2107:1 @!@!@ -Invariant PsLagsSk is violated by the initial state: -/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) -/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])]) -/\ online = {b1, b2, b3, s1, s2, s3, p1} -/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0]) - -@!@!@ENDMSG 2107 @!@!@ -@!@!@STARTMSG 2186:0 @!@!@ -Finished in 2710ms at (2025-01-19 18:36:21) -@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308183077/MC_TE.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308183077/MC_TE.out deleted file mode 100644 index 00a833e2f0..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308183077/MC_TE.out +++ /dev/null @@ -1,52 +0,0 @@ -@!@!@STARTMSG 2262:0 @!@!@ -TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) -@!@!@ENDMSG 2262 @!@!@ -@!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 92 and seed -5681728403679829533 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11930] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). -@!@!@ENDMSG 2187 @!@!@ -@!@!@STARTMSG 2220:0 @!@!@ -Starting SANY... -@!@!@ENDMSG 2220 @!@!@ -Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla -Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla -Semantic processing of module Naturals -Semantic processing of module Integers -Semantic processing of module Sequences -Semantic processing of module FiniteSets -Semantic processing of module replicated -Semantic processing of module TLC -Semantic processing of module MC -@!@!@STARTMSG 2219:0 @!@!@ -SANY finished. -@!@!@ENDMSG 2219 @!@!@ -@!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 18:36:20) -@!@!@ENDMSG 2185 @!@!@ -@!@!@STARTMSG 2279:3 @!@!@ -Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. -@!@!@ENDMSG 2279 @!@!@ -@!@!@STARTMSG 2284:3 @!@!@ -Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. -@!@!@ENDMSG 2284 @!@!@ -@!@!@STARTMSG 2212:0 @!@!@ -Implied-temporal checking--satisfiability problem has 1 branches. -@!@!@ENDMSG 2212 @!@!@ -@!@!@STARTMSG 2189:0 @!@!@ -Computing initial states... -@!@!@ENDMSG 2189 @!@!@ -@!@!@STARTMSG 2107:1 @!@!@ -Invariant PsLagsSk is violated by the initial state: -/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) -/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0])]) -/\ online = {b1, b2, b3, s1, s2, s3, p1} -/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, pruned_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, pruned_lsn |-> 0]) - -@!@!@ENDMSG 2107 @!@!@ -@!@!@STARTMSG 2186:0 @!@!@ -Finished in 2710ms at (2025-01-19 18:36:21) -@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308216766/MC.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308216766/MC.out deleted file mode 100644 index 366883d749..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308216766/MC.out +++ /dev/null @@ -1,53 +0,0 @@ -@!@!@STARTMSG 2262:0 @!@!@ -TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) -@!@!@ENDMSG 2262 @!@!@ -@!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 39 and seed -9180611051874563891 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11941] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). -@!@!@ENDMSG 2187 @!@!@ -@!@!@STARTMSG 2220:0 @!@!@ -Starting SANY... -@!@!@ENDMSG 2220 @!@!@ -Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla -Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla -Semantic processing of module Naturals -Semantic processing of module Integers -Semantic processing of module Sequences -Semantic processing of module FiniteSets -Semantic processing of module replicated -Semantic processing of module TLC -Semantic processing of module MC -@!@!@STARTMSG 2219:0 @!@!@ -SANY finished. -@!@!@ENDMSG 2219 @!@!@ -@!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 18:36:40) -@!@!@ENDMSG 2185 @!@!@ -@!@!@STARTMSG 2279:3 @!@!@ -Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. -@!@!@ENDMSG 2279 @!@!@ -@!@!@STARTMSG 2284:3 @!@!@ -Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. -@!@!@ENDMSG 2284 @!@!@ -@!@!@STARTMSG 2212:0 @!@!@ -Implied-temporal checking--satisfiability problem has 1 branches. -@!@!@ENDMSG 2212 @!@!@ -@!@!@STARTMSG 2189:0 @!@!@ -Computing initial states... -@!@!@ENDMSG 2189 @!@!@ -@!@!@STARTMSG 2190:0 @!@!@ -Finished computing initial states: 1 distinct state generated at 2025-01-19 18:36:41. -@!@!@ENDMSG 2190 @!@!@ -@!@!@STARTMSG 2192:0 @!@!@ -Checking temporal properties for the current state space with 3587 total distinct states at (2025-01-19 18:36:44) -@!@!@ENDMSG 2192 @!@!@ -@!@!@STARTMSG 2267:0 @!@!@ -Finished checking temporal properties in 00s at 2025-01-19 18:36:44 -@!@!@ENDMSG 2267 @!@!@ -@!@!@STARTMSG 2200:0 @!@!@ -Progress(11) at 2025-01-19 18:36:44: 73.018 states generated (73.018 s/min), 8.206 distinct states found (8.206 ds/min), 4.615 states left on queue. -@!@!@ENDMSG 2200 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308355472/MC.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308355472/MC.out deleted file mode 100644 index 72ebe05b45..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308355472/MC.out +++ /dev/null @@ -1,354 +0,0 @@ -@!@!@STARTMSG 2262:0 @!@!@ -TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) -@!@!@ENDMSG 2262 @!@!@ -@!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 96 and seed 147884281130356166 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 12007] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). -@!@!@ENDMSG 2187 @!@!@ -@!@!@STARTMSG 2220:0 @!@!@ -Starting SANY... -@!@!@ENDMSG 2220 @!@!@ -Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla -Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla -Semantic processing of module Naturals -Semantic processing of module Integers -Semantic processing of module Sequences -Semantic processing of module FiniteSets -Semantic processing of module replicated -Semantic processing of module TLC -Semantic processing of module MC -@!@!@STARTMSG 2219:0 @!@!@ -SANY finished. -@!@!@ENDMSG 2219 @!@!@ -@!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 18:38:05) -@!@!@ENDMSG 2185 @!@!@ -@!@!@STARTMSG 2279:3 @!@!@ -Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. -@!@!@ENDMSG 2279 @!@!@ -@!@!@STARTMSG 2284:3 @!@!@ -Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. -@!@!@ENDMSG 2284 @!@!@ -@!@!@STARTMSG 2212:0 @!@!@ -Implied-temporal checking--satisfiability problem has 1 branches. -@!@!@ENDMSG 2212 @!@!@ -@!@!@STARTMSG 2189:0 @!@!@ -Computing initial states... -@!@!@ENDMSG 2189 @!@!@ -@!@!@STARTMSG 2190:0 @!@!@ -Finished computing initial states: 1 distinct state generated at 2025-01-19 18:38:06. -@!@!@ENDMSG 2190 @!@!@ -@!@!@STARTMSG 2192:0 @!@!@ -Checking temporal properties for the current state space with 3861 total distinct states at (2025-01-19 18:38:09) -@!@!@ENDMSG 2192 @!@!@ -@!@!@STARTMSG 2267:0 @!@!@ -Finished checking temporal properties in 00s at 2025-01-19 18:38:09 -@!@!@ENDMSG 2267 @!@!@ -@!@!@STARTMSG 2200:0 @!@!@ -Progress(11) at 2025-01-19 18:38:09: 77.856 states generated (77.856 s/min), 8.653 distinct states found (8.653 ds/min), 4.790 states left on queue. -@!@!@ENDMSG 2200 @!@!@ -@!@!@STARTMSG 2192:0 @!@!@ -Checking temporal properties for the current state space with 197257 total distinct states at (2025-01-19 18:39:09) -@!@!@ENDMSG 2192 @!@!@ -@!@!@STARTMSG 2267:0 @!@!@ -Finished checking temporal properties in 00s at 2025-01-19 18:39:09 -@!@!@ENDMSG 2267 @!@!@ -@!@!@STARTMSG 2200:0 @!@!@ -Progress(20) at 2025-01-19 18:39:09: 3.084.377 states generated (3.006.521 s/min), 204.964 distinct states found (196.311 ds/min), 7.704 states left on queue. -@!@!@ENDMSG 2200 @!@!@ -@!@!@STARTMSG 2200:0 @!@!@ -Progress(25) at 2025-01-19 18:39:12: 3.224.329 states generated, 208.868 distinct states found, 0 states left on queue. -@!@!@ENDMSG 2200 @!@!@ -@!@!@STARTMSG 2192:0 @!@!@ -Checking temporal properties for the complete state space with 208868 total distinct states at (2025-01-19 18:39:12) -@!@!@ENDMSG 2192 @!@!@ -@!@!@STARTMSG 2267:0 @!@!@ -Finished checking temporal properties in 00s at 2025-01-19 18:39:12 -@!@!@ENDMSG 2267 @!@!@ -@!@!@STARTMSG 2193:0 @!@!@ -Model checking completed. No error has been found. - Estimates of the probability that TLC did not check all reachable states - because two distinct states had the same fingerprint: - calculated (optimistic): val = 3.4E-8 - based on the actual fingerprints: val = 6.3E-10 -@!@!@ENDMSG 2193 @!@!@ -@!@!@STARTMSG 2201:0 @!@!@ -The coverage statistics at 2025-01-19 18:39:14 -@!@!@ENDMSG 2201 @!@!@ -@!@!@STARTMSG 2773:0 @!@!@ -: 1:1 -@!@!@ENDMSG 2773 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 35, col 5 to line 38, col 26 of module replicated: 1 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 14290:208868 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 41, col 8 to line 44, col 44 of module replicated: 208868 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 41, col 18 to line 44, col 44 of module replicated: 208868 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 42, col 9 to line 44, col 44 of module replicated: 22348876 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 42, col 12 to line 42, col 48 of module replicated: 22348876 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 43, col 12 to line 43, col 44 of module replicated: 8981324 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 44, col 12 to line 44, col 44 of module replicated: 2924152 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 41, col 32 to line 41, col 48 of module replicated: 208868 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 45, col 8 to line 45, col 67 of module replicated: 208868 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 84:530666 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 48, col 8 to line 48, col 32 of module replicated: 2410478 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2775:0 @!@!@ - |line 48, col 8 to line 48, col 15 of module replicated: 1879812:4246157 -@!@!@ENDMSG 2775 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 48, col 27 to line 48, col 32 of module replicated: 1879812 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 49, col 8 to line 49, col 14 of module replicated: 1643803 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 49, col 8 to line 49, col 9 of module replicated: 1113137 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 49, col 13 to line 49, col 14 of module replicated: 1113137 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 50, col 8 to line 50, col 72 of module replicated: 1170534 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 50, col 8 to line 50, col 38 of module replicated: 639868 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 50, col 42 to line 50, col 72 of module replicated: 639868 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 54, col 13 to line 56, col 50 of module replicated: 530666 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 57, col 8 to line 57, col 58 of module replicated: 530666 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 682:54601 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 60, col 8 to line 60, col 32 of module replicated: 1934413 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2775:0 @!@!@ - |line 60, col 8 to line 60, col 15 of module replicated: 1879812:4246157 -@!@!@ENDMSG 2775 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 60, col 27 to line 60, col 32 of module replicated: 1879812 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 61, col 8 to line 61, col 72 of module replicated: 54601 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 61, col 8 to line 61, col 38 of module replicated: 1113137 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 61, col 42 to line 61, col 72 of module replicated: 1113137 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 62, col 8 to line 62, col 102 of module replicated: 54601 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 63, col 8 to line 63, col 58 of module replicated: 54601 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 45241:1113137 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 66, col 8 to line 66, col 30 of module replicated: 2992949 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2775:0 @!@!@ - |line 66, col 8 to line 66, col 13 of module replicated: 1879812:4412756 -@!@!@ENDMSG 2775 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 66, col 25 to line 66, col 30 of module replicated: 1879812 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 67, col 8 to line 74, col 29 of module replicated: 1113137 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 67, col 24 to line 74, col 29 of module replicated: 1113137 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 67, col 27 to line 67, col 91 of module replicated: 1113137 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 70, col 28 to line 70, col 45 of module replicated: 611653 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 71, col 31 to line 71, col 91 of module replicated: 611653 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 73, col 17 to line 73, col 54 of module replicated: 611653 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 74, col 18 to line 74, col 29 of module replicated: 501484 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 75, col 8 to line 75, col 62 of module replicated: 1113137 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 90643:1113137 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 78, col 8 to line 78, col 31 of module replicated: 2992949 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2775:0 @!@!@ - |line 78, col 8 to line 78, col 14 of module replicated: 1879812:5525893 -@!@!@ENDMSG 2775 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 78, col 26 to line 78, col 31 of module replicated: 1879812 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 84, col 13 to line 86, col 37 of module replicated: 1113137 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 84, col 33 to line 86, col 37 of module replicated: 1113137 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 84, col 36 to line 84, col 66 of module replicated: 1113137 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 85, col 22 to line 85, col 66 of module replicated: 406880 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 86, col 22 to line 86, col 37 of module replicated: 706257 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 87, col 8 to line 87, col 58 of module replicated: 1113137 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 57927:203919 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 97, col 8 to line 97, col 27 of module replicated: 412787 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2775:0 @!@!@ - |line 97, col 8 to line 97, col 10 of module replicated: 208868:417736 -@!@!@ENDMSG 2775 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 97, col 22 to line 97, col 27 of module replicated: 208868 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 98, col 8 to line 98, col 30 of module replicated: 412787 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 98, col 8 to line 98, col 25 of module replicated: 208868 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 92, col 15 to line 92, col 33 of module replicated: 208868 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 94, col 5 to line 94, col 66 of module replicated: 208868 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 94, col 26 to line 94, col 65 of module replicated: 626604 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 94, col 12 to line 94, col 23 of module replicated: 208868 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 98, col 24 to line 98, col 24 of module replicated: 208868 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 98, col 29 to line 98, col 30 of module replicated: 208868 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 99, col 8 to line 99, col 109 of module replicated: 203919 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 99, col 28 to line 99, col 109 of module replicated: 203919 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 99, col 29 to line 99, col 44 of module replicated: 203919 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 99, col 52 to line 99, col 108 of module replicated: 203919 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 99, col 72 to line 99, col 108 of module replicated: 203919 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 99, col 105 to line 99, col 108 of module replicated: 203919 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 99, col 85 to line 99, col 102 of module replicated: 203919 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||||line 92, col 15 to line 92, col 33 of module replicated: 203919 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2775:0 @!@!@ - ||||line 94, col 5 to line 94, col 66 of module replicated: 203919:203919 -@!@!@ENDMSG 2775 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||||line 94, col 26 to line 94, col 65 of module replicated: 611757 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||||line 94, col 12 to line 94, col 23 of module replicated: 203919 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||||line 99, col 101 to line 99, col 101 of module replicated: 203919 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 100, col 8 to line 100, col 58 of module replicated: 203919 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2774:0 @!@!@ - -@!@!@ENDMSG 2774 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 118, col 13 to line 119, col 81 of module replicated: 736274 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 118, col 35 to line 119, col 81 of module replicated: 736274 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 119, col 9 to line 119, col 81 of module replicated: 2208822 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 118, col 44 to line 118, col 72 of module replicated: 736274 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 118, col 22 to line 118, col 32 of module replicated: 736274 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2202:0 @!@!@ -End of statistics. -@!@!@ENDMSG 2202 @!@!@ -@!@!@STARTMSG 2200:0 @!@!@ -Progress(25) at 2025-01-19 18:39:14: 3.224.329 states generated (2.761.383 s/min), 208.868 distinct states found (178.878 ds/min), 0 states left on queue. -@!@!@ENDMSG 2200 @!@!@ -@!@!@STARTMSG 2199:0 @!@!@ -3224329 states generated, 208868 distinct states found, 0 states left on queue. -@!@!@ENDMSG 2199 @!@!@ -@!@!@STARTMSG 2194:0 @!@!@ -The depth of the complete state graph search is 25. -@!@!@ENDMSG 2194 @!@!@ -@!@!@STARTMSG 2268:0 @!@!@ -The average outdegree of the complete state graph is 1 (minimum is 0, the maximum 9 and the 95th percentile is 3). -@!@!@ENDMSG 2268 @!@!@ -@!@!@STARTMSG 2186:0 @!@!@ -Finished in 70074ms at (2025-01-19 18:39:14) -@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308355472/MC.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308355472/MC.tla deleted file mode 100644 index 434bbc3bd0..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308355472/MC.tla +++ /dev/null @@ -1,65 +0,0 @@ ----- MODULE MC ---- -EXTENDS replicated, TLC - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -b1, b2, b3 ----- - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -s1, s2, s3 ----- - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -p1 ----- - -\* MV CONSTANT declarations@modelParameterConstants -CONSTANTS -az1, az2, az3 ----- - -\* MV CONSTANT definitions brokers -const_1737308284086143000 == -{b1, b2, b3} ----- - -\* MV CONSTANT definitions safekeepers -const_1737308284086144000 == -{s1, s2, s3} ----- - -\* MV CONSTANT definitions pageservers -const_1737308284086145000 == -{p1} ----- - -\* MV CONSTANT definitions azs -const_1737308284086146000 == -{az1, az2, az3} ----- - -\* SYMMETRY definition -symm_1737308284086147000 == -Permutations(const_1737308284086143000) \union Permutations(const_1737308284086144000) \union Permutations(const_1737308284086145000) \union Permutations(const_1737308284086146000) ----- - -\* CONSTANT definitions @modelParameterConstants:4max_commit_lsn -const_1737308284086148000 == -2 ----- - -\* CONSTANT definitions @modelParameterConstants:5az_mapping -const_1737308284086149000 == -[ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2} , az3 |-> {b3,s3}] ----- - -\* CONSTRAINT definition @modelParameterContraint:0 -constr_1737308284086150000 == -StateConstraint ----- -============================================================================= -\* Modification History -\* Created Sun Jan 19 18:38:04 CET 2025 by cs diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308355472/MC_TE.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308355472/MC_TE.out deleted file mode 100644 index 72ebe05b45..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308355472/MC_TE.out +++ /dev/null @@ -1,354 +0,0 @@ -@!@!@STARTMSG 2262:0 @!@!@ -TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) -@!@!@ENDMSG 2262 @!@!@ -@!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 96 and seed 147884281130356166 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 12007] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). -@!@!@ENDMSG 2187 @!@!@ -@!@!@STARTMSG 2220:0 @!@!@ -Starting SANY... -@!@!@ENDMSG 2220 @!@!@ -Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla -Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla -Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla -Semantic processing of module Naturals -Semantic processing of module Integers -Semantic processing of module Sequences -Semantic processing of module FiniteSets -Semantic processing of module replicated -Semantic processing of module TLC -Semantic processing of module MC -@!@!@STARTMSG 2219:0 @!@!@ -SANY finished. -@!@!@ENDMSG 2219 @!@!@ -@!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 18:38:05) -@!@!@ENDMSG 2185 @!@!@ -@!@!@STARTMSG 2279:3 @!@!@ -Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. -@!@!@ENDMSG 2279 @!@!@ -@!@!@STARTMSG 2284:3 @!@!@ -Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. -@!@!@ENDMSG 2284 @!@!@ -@!@!@STARTMSG 2212:0 @!@!@ -Implied-temporal checking--satisfiability problem has 1 branches. -@!@!@ENDMSG 2212 @!@!@ -@!@!@STARTMSG 2189:0 @!@!@ -Computing initial states... -@!@!@ENDMSG 2189 @!@!@ -@!@!@STARTMSG 2190:0 @!@!@ -Finished computing initial states: 1 distinct state generated at 2025-01-19 18:38:06. -@!@!@ENDMSG 2190 @!@!@ -@!@!@STARTMSG 2192:0 @!@!@ -Checking temporal properties for the current state space with 3861 total distinct states at (2025-01-19 18:38:09) -@!@!@ENDMSG 2192 @!@!@ -@!@!@STARTMSG 2267:0 @!@!@ -Finished checking temporal properties in 00s at 2025-01-19 18:38:09 -@!@!@ENDMSG 2267 @!@!@ -@!@!@STARTMSG 2200:0 @!@!@ -Progress(11) at 2025-01-19 18:38:09: 77.856 states generated (77.856 s/min), 8.653 distinct states found (8.653 ds/min), 4.790 states left on queue. -@!@!@ENDMSG 2200 @!@!@ -@!@!@STARTMSG 2192:0 @!@!@ -Checking temporal properties for the current state space with 197257 total distinct states at (2025-01-19 18:39:09) -@!@!@ENDMSG 2192 @!@!@ -@!@!@STARTMSG 2267:0 @!@!@ -Finished checking temporal properties in 00s at 2025-01-19 18:39:09 -@!@!@ENDMSG 2267 @!@!@ -@!@!@STARTMSG 2200:0 @!@!@ -Progress(20) at 2025-01-19 18:39:09: 3.084.377 states generated (3.006.521 s/min), 204.964 distinct states found (196.311 ds/min), 7.704 states left on queue. -@!@!@ENDMSG 2200 @!@!@ -@!@!@STARTMSG 2200:0 @!@!@ -Progress(25) at 2025-01-19 18:39:12: 3.224.329 states generated, 208.868 distinct states found, 0 states left on queue. -@!@!@ENDMSG 2200 @!@!@ -@!@!@STARTMSG 2192:0 @!@!@ -Checking temporal properties for the complete state space with 208868 total distinct states at (2025-01-19 18:39:12) -@!@!@ENDMSG 2192 @!@!@ -@!@!@STARTMSG 2267:0 @!@!@ -Finished checking temporal properties in 00s at 2025-01-19 18:39:12 -@!@!@ENDMSG 2267 @!@!@ -@!@!@STARTMSG 2193:0 @!@!@ -Model checking completed. No error has been found. - Estimates of the probability that TLC did not check all reachable states - because two distinct states had the same fingerprint: - calculated (optimistic): val = 3.4E-8 - based on the actual fingerprints: val = 6.3E-10 -@!@!@ENDMSG 2193 @!@!@ -@!@!@STARTMSG 2201:0 @!@!@ -The coverage statistics at 2025-01-19 18:39:14 -@!@!@ENDMSG 2201 @!@!@ -@!@!@STARTMSG 2773:0 @!@!@ -: 1:1 -@!@!@ENDMSG 2773 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 35, col 5 to line 38, col 26 of module replicated: 1 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 14290:208868 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 41, col 8 to line 44, col 44 of module replicated: 208868 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 41, col 18 to line 44, col 44 of module replicated: 208868 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 42, col 9 to line 44, col 44 of module replicated: 22348876 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 42, col 12 to line 42, col 48 of module replicated: 22348876 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 43, col 12 to line 43, col 44 of module replicated: 8981324 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 44, col 12 to line 44, col 44 of module replicated: 2924152 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 41, col 32 to line 41, col 48 of module replicated: 208868 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 45, col 8 to line 45, col 67 of module replicated: 208868 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 84:530666 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 48, col 8 to line 48, col 32 of module replicated: 2410478 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2775:0 @!@!@ - |line 48, col 8 to line 48, col 15 of module replicated: 1879812:4246157 -@!@!@ENDMSG 2775 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 48, col 27 to line 48, col 32 of module replicated: 1879812 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 49, col 8 to line 49, col 14 of module replicated: 1643803 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 49, col 8 to line 49, col 9 of module replicated: 1113137 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 49, col 13 to line 49, col 14 of module replicated: 1113137 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 50, col 8 to line 50, col 72 of module replicated: 1170534 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 50, col 8 to line 50, col 38 of module replicated: 639868 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 50, col 42 to line 50, col 72 of module replicated: 639868 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 54, col 13 to line 56, col 50 of module replicated: 530666 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 57, col 8 to line 57, col 58 of module replicated: 530666 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 682:54601 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 60, col 8 to line 60, col 32 of module replicated: 1934413 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2775:0 @!@!@ - |line 60, col 8 to line 60, col 15 of module replicated: 1879812:4246157 -@!@!@ENDMSG 2775 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 60, col 27 to line 60, col 32 of module replicated: 1879812 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 61, col 8 to line 61, col 72 of module replicated: 54601 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 61, col 8 to line 61, col 38 of module replicated: 1113137 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 61, col 42 to line 61, col 72 of module replicated: 1113137 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 62, col 8 to line 62, col 102 of module replicated: 54601 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 63, col 8 to line 63, col 58 of module replicated: 54601 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 45241:1113137 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 66, col 8 to line 66, col 30 of module replicated: 2992949 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2775:0 @!@!@ - |line 66, col 8 to line 66, col 13 of module replicated: 1879812:4412756 -@!@!@ENDMSG 2775 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 66, col 25 to line 66, col 30 of module replicated: 1879812 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 67, col 8 to line 74, col 29 of module replicated: 1113137 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 67, col 24 to line 74, col 29 of module replicated: 1113137 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 67, col 27 to line 67, col 91 of module replicated: 1113137 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 70, col 28 to line 70, col 45 of module replicated: 611653 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 71, col 31 to line 71, col 91 of module replicated: 611653 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 73, col 17 to line 73, col 54 of module replicated: 611653 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 74, col 18 to line 74, col 29 of module replicated: 501484 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 75, col 8 to line 75, col 62 of module replicated: 1113137 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 90643:1113137 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 78, col 8 to line 78, col 31 of module replicated: 2992949 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2775:0 @!@!@ - |line 78, col 8 to line 78, col 14 of module replicated: 1879812:5525893 -@!@!@ENDMSG 2775 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 78, col 26 to line 78, col 31 of module replicated: 1879812 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 84, col 13 to line 86, col 37 of module replicated: 1113137 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 84, col 33 to line 86, col 37 of module replicated: 1113137 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 84, col 36 to line 84, col 66 of module replicated: 1113137 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 85, col 22 to line 85, col 66 of module replicated: 406880 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 86, col 22 to line 86, col 37 of module replicated: 706257 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 87, col 8 to line 87, col 58 of module replicated: 1113137 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2772:0 @!@!@ -: 57927:203919 -@!@!@ENDMSG 2772 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 97, col 8 to line 97, col 27 of module replicated: 412787 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2775:0 @!@!@ - |line 97, col 8 to line 97, col 10 of module replicated: 208868:417736 -@!@!@ENDMSG 2775 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 97, col 22 to line 97, col 27 of module replicated: 208868 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 98, col 8 to line 98, col 30 of module replicated: 412787 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 98, col 8 to line 98, col 25 of module replicated: 208868 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 92, col 15 to line 92, col 33 of module replicated: 208868 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 94, col 5 to line 94, col 66 of module replicated: 208868 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 94, col 26 to line 94, col 65 of module replicated: 626604 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 94, col 12 to line 94, col 23 of module replicated: 208868 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 98, col 24 to line 98, col 24 of module replicated: 208868 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 98, col 29 to line 98, col 30 of module replicated: 208868 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 99, col 8 to line 99, col 109 of module replicated: 203919 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 99, col 28 to line 99, col 109 of module replicated: 203919 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 99, col 29 to line 99, col 44 of module replicated: 203919 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 99, col 52 to line 99, col 108 of module replicated: 203919 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 99, col 72 to line 99, col 108 of module replicated: 203919 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 99, col 105 to line 99, col 108 of module replicated: 203919 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||line 99, col 85 to line 99, col 102 of module replicated: 203919 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||||line 92, col 15 to line 92, col 33 of module replicated: 203919 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2775:0 @!@!@ - ||||line 94, col 5 to line 94, col 66 of module replicated: 203919:203919 -@!@!@ENDMSG 2775 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||||line 94, col 26 to line 94, col 65 of module replicated: 611757 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |||||line 94, col 12 to line 94, col 23 of module replicated: 203919 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||||line 99, col 101 to line 99, col 101 of module replicated: 203919 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 100, col 8 to line 100, col 58 of module replicated: 203919 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2774:0 @!@!@ - -@!@!@ENDMSG 2774 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - line 118, col 13 to line 119, col 81 of module replicated: 736274 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 118, col 35 to line 119, col 81 of module replicated: 736274 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 119, col 9 to line 119, col 81 of module replicated: 2208822 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - ||line 118, col 44 to line 118, col 72 of module replicated: 736274 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2221:0 @!@!@ - |line 118, col 22 to line 118, col 32 of module replicated: 736274 -@!@!@ENDMSG 2221 @!@!@ -@!@!@STARTMSG 2202:0 @!@!@ -End of statistics. -@!@!@ENDMSG 2202 @!@!@ -@!@!@STARTMSG 2200:0 @!@!@ -Progress(25) at 2025-01-19 18:39:14: 3.224.329 states generated (2.761.383 s/min), 208.868 distinct states found (178.878 ds/min), 0 states left on queue. -@!@!@ENDMSG 2200 @!@!@ -@!@!@STARTMSG 2199:0 @!@!@ -3224329 states generated, 208868 distinct states found, 0 states left on queue. -@!@!@ENDMSG 2199 @!@!@ -@!@!@STARTMSG 2194:0 @!@!@ -The depth of the complete state graph search is 25. -@!@!@ENDMSG 2194 @!@!@ -@!@!@STARTMSG 2268:0 @!@!@ -The average outdegree of the complete state graph is 1 (minimum is 0, the maximum 9 and the 95th percentile is 3). -@!@!@ENDMSG 2268 @!@!@ -@!@!@STARTMSG 2186:0 @!@!@ -Finished in 70074ms at (2025-01-19 18:39:14) -@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308024914/MC.cfg b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737323805723/MC.cfg similarity index 66% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308024914/MC.cfg rename to storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737323805723/MC.cfg index 8dd1d266c3..32dbea163c 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308024914/MC.cfg +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737323805723/MC.cfg @@ -18,36 +18,37 @@ az2 = az2 az3 = az3 \* MV CONSTANT definitions CONSTANT -brokers <- const_1737308022622113000 +brokers <- const_1737323801657283000 \* CONSTANT declarations CONSTANT NULL = NULL \* MV CONSTANT definitions CONSTANT -safekeepers <- const_1737308022622114000 +safekeepers <- const_1737323801657284000 \* MV CONSTANT definitions CONSTANT -pageservers <- const_1737308022622115000 +pageservers <- const_1737323801657285000 \* MV CONSTANT definitions CONSTANT -azs <- const_1737308022622116000 +azs <- const_1737323801657286000 \* SYMMETRY definition -SYMMETRY symm_1737308022622117000 +SYMMETRY symm_1737323801657287000 \* CONSTANT definitions CONSTANT -max_commit_lsn <- const_1737308022622118000 +max_commit_lsn <- const_1737323801657288000 \* CONSTANT definitions CONSTANT -az_mapping <- const_1737308022622119000 +az_mapping <- const_1737323801657289000 \* CONSTRAINT definition CONSTRAINT -constr_1737308022622120000 +constr_1737323801657290000 \* SPECIFICATION definition SPECIFICATION Spec \* INVARIANT definition INVARIANT PsLagsSk +PeerRecoveryIsPossible \* PROPERTY definition PROPERTY EventuallyLaggingSkIsNotPreferredSk -\* Generated on Sun Jan 19 18:33:42 CET 2025 \ No newline at end of file +\* Generated on Sun Jan 19 22:56:41 CET 2025 \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737323805723/MC.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737323805723/MC.out new file mode 100644 index 0000000000..b9873c84f2 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737323805723/MC.out @@ -0,0 +1,353 @@ +@!@!@STARTMSG 2262:0 @!@!@ +TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) +@!@!@ENDMSG 2262 @!@!@ +@!@!@STARTMSG 2187:0 @!@!@ +Running breadth-first search Model-Checking with fp 8 and seed -3590178470709523625 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 22966] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +@!@!@ENDMSG 2187 @!@!@ +@!@!@STARTMSG 2220:0 @!@!@ +Starting SANY... +@!@!@ENDMSG 2220 @!@!@ +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla +Semantic processing of module Naturals +Semantic processing of module Integers +Semantic processing of module Sequences +Semantic processing of module FiniteSets +Semantic processing of module replicated +Semantic processing of module TLC +Semantic processing of module MC +@!@!@STARTMSG 2219:0 @!@!@ +SANY finished. +@!@!@ENDMSG 2219 @!@!@ +@!@!@STARTMSG 2185:0 @!@!@ +Starting... (2025-01-19 22:56:42) +@!@!@ENDMSG 2185 @!@!@ +@!@!@STARTMSG 2279:3 @!@!@ +Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. +@!@!@ENDMSG 2279 @!@!@ +@!@!@STARTMSG 2284:3 @!@!@ +Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. +@!@!@ENDMSG 2284 @!@!@ +@!@!@STARTMSG 2212:0 @!@!@ +Implied-temporal checking--satisfiability problem has 1 branches. +@!@!@ENDMSG 2212 @!@!@ +@!@!@STARTMSG 2189:0 @!@!@ +Computing initial states... +@!@!@ENDMSG 2189 @!@!@ +@!@!@STARTMSG 2190:0 @!@!@ +Finished computing initial states: 1 distinct state generated at 2025-01-19 22:56:44. +@!@!@ENDMSG 2190 @!@!@ +@!@!@STARTMSG 2109:1 @!@!@ +Successor state is not completely specified by action SkPrune of the next-state relation. The following variables are not assigned: broker_state, online, pageserver_state. + +@!@!@ENDMSG 2109 @!@!@ +@!@!@STARTMSG 2121:1 @!@!@ +The behavior up to this point is: +@!@!@ENDMSG 2121 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +1: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, b3, s1, s2, s3, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +2: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, s1, s2, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +3: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, s1, s2, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 1, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 1, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +4: +/\ pageserver_state = null +/\ broker_state = null +/\ online = null +/\ safekeeper_state = (s1 :> [commit_lsn |-> 1, prune_lsn |-> 1, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 1, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2201:0 @!@!@ +The coverage statistics at 2025-01-19 22:56:44 +@!@!@ENDMSG 2201 @!@!@ +@!@!@STARTMSG 2773:0 @!@!@ +: 2:2 +@!@!@ENDMSG 2773 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 46, col 5 to line 49, col 26 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 1:7 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 52, col 8 to line 55, col 44 of module replicated: 7 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 52, col 18 to line 55, col 44 of module replicated: 7 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 53, col 9 to line 55, col 44 of module replicated: 749 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 53, col 12 to line 53, col 48 of module replicated: 749 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 54, col 12 to line 54, col 44 of module replicated: 301 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 55, col 12 to line 55, col 44 of module replicated: 98 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 52, col 32 to line 52, col 48 of module replicated: 7 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 56, col 8 to line 56, col 67 of module replicated: 7 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 4:15 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 59, col 8 to line 59, col 32 of module replicated: 62 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 59, col 8 to line 59, col 15 of module replicated: 47:110 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 59, col 27 to line 59, col 32 of module replicated: 47 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 60, col 8 to line 60, col 14 of module replicated: 47 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 60, col 8 to line 60, col 9 of module replicated: 32 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 60, col 13 to line 60, col 14 of module replicated: 32 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 61, col 8 to line 61, col 72 of module replicated: 34 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 61, col 8 to line 61, col 38 of module replicated: 19 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 61, col 42 to line 61, col 72 of module replicated: 19 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 65, col 13 to line 67, col 50 of module replicated: 15 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 68, col 8 to line 68, col 58 of module replicated: 15 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 71, col 8 to line 71, col 32 of module replicated: 46 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 72, col 8 to line 72, col 72 of module replicated: 31 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 73, col 8 to line 73, col 71 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 74, col 8 to line 74, col 102 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 75, col 8 to line 75, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 2:30 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 78, col 8 to line 78, col 30 of module replicated: 75 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 78, col 8 to line 78, col 13 of module replicated: 45:111 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 78, col 25 to line 78, col 30 of module replicated: 45 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 79, col 8 to line 86, col 52 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 87, col 8 to line 87, col 62 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 96, col 13 to line 98, col 37 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 99, col 8 to line 99, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 5:30 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 103, col 8 to line 103, col 29 of module replicated: 75 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 103, col 8 to line 103, col 12 of module replicated: 45:111 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 103, col 24 to line 103, col 29 of module replicated: 45 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 104, col 8 to line 104, col 81 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 105, col 8 to line 105, col 57 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:5 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 108, col 8 to line 108, col 27 of module replicated: 6 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 108, col 8 to line 108, col 10 of module replicated: 5:10 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 108, col 22 to line 108, col 27 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 121, col 9 to line 121, col 80 of module replicated: 1 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 121, col 29 to line 121, col 80 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 121, col 30 to line 121, col 45 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 121, col 54 to line 121, col 79 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 121, col 71 to line 121, col 79 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 119, col 22 to line 119, col 42 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 27, col 3 to line 27, col 36 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 119, col 31 to line 119, col 41 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |||||line 118, col 24 to line 118, col 49 of module replicated: 5:15 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||line 118, col 25 to line 118, col 36 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||line 118, col 45 to line 118, col 48 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||line 111, col 13 to line 117, col 18 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||line 112, col 17 to line 114, col 84 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||||line 112, col 17 to line 112, col 37 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |||||||||line 114, col 17 to line 114, col 84 of module replicated: 5:10 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||||line 114, col 18 to line 114, col 43 of module replicated: 15 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||||line 114, col 54 to line 114, col 82 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||line 117, col 13 to line 117, col 18 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 133, col 8 to line 133, col 109 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 134, col 8 to line 134, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2774:0 @!@!@ + +@!@!@ENDMSG 2774 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 156, col 13 to line 157, col 81 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 156, col 35 to line 157, col 81 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 157, col 9 to line 157, col 81 of module replicated: 39 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 156, col 44 to line 156, col 72 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 156, col 22 to line 156, col 32 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2774:0 @!@!@ + +@!@!@ENDMSG 2774 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 160, col 5 to line 162, col 88 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 160, col 47 to line 162, col 88 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 161, col 9 to line 162, col 88 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 161, col 12 to line 162, col 88 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 161, col 13 to line 161, col 85 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 162, col 16 to line 162, col 88 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 160, col 61 to line 160, col 83 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 160, col 21 to line 160, col 43 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2202:0 @!@!@ +End of statistics. +@!@!@ENDMSG 2202 @!@!@ +@!@!@STARTMSG 2200:0 @!@!@ +Progress(4) at 2025-01-19 22:56:44: 73 states generated (1.752 s/min), 13 distinct states found (312 ds/min), 9 states left on queue. +@!@!@ENDMSG 2200 @!@!@ +@!@!@STARTMSG 2199:0 @!@!@ +73 states generated, 13 distinct states found, 9 states left on queue. +@!@!@ENDMSG 2199 @!@!@ +@!@!@STARTMSG 2194:0 @!@!@ +The depth of the complete state graph search is 4. +@!@!@ENDMSG 2194 @!@!@ +@!@!@STARTMSG 2186:0 @!@!@ +Finished in 2516ms at (2025-01-19 22:56:44) +@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307828738/MC.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737323805723/MC.tla similarity index 67% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307828738/MC.tla rename to storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737323805723/MC.tla index 0079b64427..02b378bbb1 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307828738/MC.tla +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737323805723/MC.tla @@ -22,44 +22,44 @@ az1, az2, az3 ---- \* MV CONSTANT definitions brokers -const_173730781391774000 == +const_1737323801657283000 == {b1, b2, b3} ---- \* MV CONSTANT definitions safekeepers -const_173730781391775000 == +const_1737323801657284000 == {s1, s2, s3} ---- \* MV CONSTANT definitions pageservers -const_173730781391776000 == +const_1737323801657285000 == {p1} ---- \* MV CONSTANT definitions azs -const_173730781391777000 == +const_1737323801657286000 == {az1, az2, az3} ---- \* SYMMETRY definition -symm_173730781391778000 == -Permutations(const_173730781391774000) \union Permutations(const_173730781391775000) \union Permutations(const_173730781391776000) \union Permutations(const_173730781391777000) +symm_1737323801657287000 == +Permutations(const_1737323801657283000) \union Permutations(const_1737323801657284000) \union Permutations(const_1737323801657285000) \union Permutations(const_1737323801657286000) ---- \* CONSTANT definitions @modelParameterConstants:4max_commit_lsn -const_173730781391779000 == +const_1737323801657288000 == 2 ---- \* CONSTANT definitions @modelParameterConstants:5az_mapping -const_173730781391780000 == +const_1737323801657289000 == [ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2} , az3 |-> {b3,s3}] ---- \* CONSTRAINT definition @modelParameterContraint:0 -constr_173730781391781000 == +constr_1737323801657290000 == StateConstraint ---- ============================================================================= \* Modification History -\* Created Sun Jan 19 18:30:13 CET 2025 by cs +\* Created Sun Jan 19 22:56:41 CET 2025 by cs diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737323805723/MC_TE.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737323805723/MC_TE.out new file mode 100644 index 0000000000..b9873c84f2 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737323805723/MC_TE.out @@ -0,0 +1,353 @@ +@!@!@STARTMSG 2262:0 @!@!@ +TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) +@!@!@ENDMSG 2262 @!@!@ +@!@!@STARTMSG 2187:0 @!@!@ +Running breadth-first search Model-Checking with fp 8 and seed -3590178470709523625 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 22966] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +@!@!@ENDMSG 2187 @!@!@ +@!@!@STARTMSG 2220:0 @!@!@ +Starting SANY... +@!@!@ENDMSG 2220 @!@!@ +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla +Semantic processing of module Naturals +Semantic processing of module Integers +Semantic processing of module Sequences +Semantic processing of module FiniteSets +Semantic processing of module replicated +Semantic processing of module TLC +Semantic processing of module MC +@!@!@STARTMSG 2219:0 @!@!@ +SANY finished. +@!@!@ENDMSG 2219 @!@!@ +@!@!@STARTMSG 2185:0 @!@!@ +Starting... (2025-01-19 22:56:42) +@!@!@ENDMSG 2185 @!@!@ +@!@!@STARTMSG 2279:3 @!@!@ +Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. +@!@!@ENDMSG 2279 @!@!@ +@!@!@STARTMSG 2284:3 @!@!@ +Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. +@!@!@ENDMSG 2284 @!@!@ +@!@!@STARTMSG 2212:0 @!@!@ +Implied-temporal checking--satisfiability problem has 1 branches. +@!@!@ENDMSG 2212 @!@!@ +@!@!@STARTMSG 2189:0 @!@!@ +Computing initial states... +@!@!@ENDMSG 2189 @!@!@ +@!@!@STARTMSG 2190:0 @!@!@ +Finished computing initial states: 1 distinct state generated at 2025-01-19 22:56:44. +@!@!@ENDMSG 2190 @!@!@ +@!@!@STARTMSG 2109:1 @!@!@ +Successor state is not completely specified by action SkPrune of the next-state relation. The following variables are not assigned: broker_state, online, pageserver_state. + +@!@!@ENDMSG 2109 @!@!@ +@!@!@STARTMSG 2121:1 @!@!@ +The behavior up to this point is: +@!@!@ENDMSG 2121 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +1: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, b3, s1, s2, s3, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +2: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, s1, s2, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +3: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, s1, s2, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 1, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 1, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +4: +/\ pageserver_state = null +/\ broker_state = null +/\ online = null +/\ safekeeper_state = (s1 :> [commit_lsn |-> 1, prune_lsn |-> 1, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 1, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2201:0 @!@!@ +The coverage statistics at 2025-01-19 22:56:44 +@!@!@ENDMSG 2201 @!@!@ +@!@!@STARTMSG 2773:0 @!@!@ +: 2:2 +@!@!@ENDMSG 2773 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 46, col 5 to line 49, col 26 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 1:7 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 52, col 8 to line 55, col 44 of module replicated: 7 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 52, col 18 to line 55, col 44 of module replicated: 7 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 53, col 9 to line 55, col 44 of module replicated: 749 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 53, col 12 to line 53, col 48 of module replicated: 749 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 54, col 12 to line 54, col 44 of module replicated: 301 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 55, col 12 to line 55, col 44 of module replicated: 98 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 52, col 32 to line 52, col 48 of module replicated: 7 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 56, col 8 to line 56, col 67 of module replicated: 7 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 4:15 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 59, col 8 to line 59, col 32 of module replicated: 62 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 59, col 8 to line 59, col 15 of module replicated: 47:110 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 59, col 27 to line 59, col 32 of module replicated: 47 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 60, col 8 to line 60, col 14 of module replicated: 47 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 60, col 8 to line 60, col 9 of module replicated: 32 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 60, col 13 to line 60, col 14 of module replicated: 32 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 61, col 8 to line 61, col 72 of module replicated: 34 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 61, col 8 to line 61, col 38 of module replicated: 19 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 61, col 42 to line 61, col 72 of module replicated: 19 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 65, col 13 to line 67, col 50 of module replicated: 15 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 68, col 8 to line 68, col 58 of module replicated: 15 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 71, col 8 to line 71, col 32 of module replicated: 46 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 72, col 8 to line 72, col 72 of module replicated: 31 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 73, col 8 to line 73, col 71 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 74, col 8 to line 74, col 102 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 75, col 8 to line 75, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 2:30 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 78, col 8 to line 78, col 30 of module replicated: 75 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 78, col 8 to line 78, col 13 of module replicated: 45:111 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 78, col 25 to line 78, col 30 of module replicated: 45 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 79, col 8 to line 86, col 52 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 87, col 8 to line 87, col 62 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 96, col 13 to line 98, col 37 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 99, col 8 to line 99, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 5:30 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 103, col 8 to line 103, col 29 of module replicated: 75 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 103, col 8 to line 103, col 12 of module replicated: 45:111 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 103, col 24 to line 103, col 29 of module replicated: 45 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 104, col 8 to line 104, col 81 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 105, col 8 to line 105, col 57 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:5 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 108, col 8 to line 108, col 27 of module replicated: 6 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 108, col 8 to line 108, col 10 of module replicated: 5:10 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 108, col 22 to line 108, col 27 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 121, col 9 to line 121, col 80 of module replicated: 1 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 121, col 29 to line 121, col 80 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 121, col 30 to line 121, col 45 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 121, col 54 to line 121, col 79 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 121, col 71 to line 121, col 79 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 119, col 22 to line 119, col 42 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 27, col 3 to line 27, col 36 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 119, col 31 to line 119, col 41 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |||||line 118, col 24 to line 118, col 49 of module replicated: 5:15 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||line 118, col 25 to line 118, col 36 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||line 118, col 45 to line 118, col 48 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||line 111, col 13 to line 117, col 18 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||line 112, col 17 to line 114, col 84 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||||line 112, col 17 to line 112, col 37 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |||||||||line 114, col 17 to line 114, col 84 of module replicated: 5:10 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||||line 114, col 18 to line 114, col 43 of module replicated: 15 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||||line 114, col 54 to line 114, col 82 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||line 117, col 13 to line 117, col 18 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 133, col 8 to line 133, col 109 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 134, col 8 to line 134, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2774:0 @!@!@ + +@!@!@ENDMSG 2774 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 156, col 13 to line 157, col 81 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 156, col 35 to line 157, col 81 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 157, col 9 to line 157, col 81 of module replicated: 39 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 156, col 44 to line 156, col 72 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 156, col 22 to line 156, col 32 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2774:0 @!@!@ + +@!@!@ENDMSG 2774 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 160, col 5 to line 162, col 88 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 160, col 47 to line 162, col 88 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 161, col 9 to line 162, col 88 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 161, col 12 to line 162, col 88 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 161, col 13 to line 161, col 85 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 162, col 16 to line 162, col 88 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 160, col 61 to line 160, col 83 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 160, col 21 to line 160, col 43 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2202:0 @!@!@ +End of statistics. +@!@!@ENDMSG 2202 @!@!@ +@!@!@STARTMSG 2200:0 @!@!@ +Progress(4) at 2025-01-19 22:56:44: 73 states generated (1.752 s/min), 13 distinct states found (312 ds/min), 9 states left on queue. +@!@!@ENDMSG 2200 @!@!@ +@!@!@STARTMSG 2199:0 @!@!@ +73 states generated, 13 distinct states found, 9 states left on queue. +@!@!@ENDMSG 2199 @!@!@ +@!@!@STARTMSG 2194:0 @!@!@ +The depth of the complete state graph search is 4. +@!@!@ENDMSG 2194 @!@!@ +@!@!@STARTMSG 2186:0 @!@!@ +Finished in 2516ms at (2025-01-19 22:56:44) +@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308183077/replicated.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737323805723/replicated.tla similarity index 64% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308183077/replicated.tla rename to storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737323805723/replicated.tla index 6ec5ff3f0f..79540e1c4d 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308183077/replicated.tla +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737323805723/replicated.tla @@ -17,6 +17,16 @@ CONSTANT CONSTANT max_commit_lsn + +\* HELPERS + +Max(a,b) == IF a > b THEN a ELSE b + +(* The minimum of a non-empty set of integers *) +MinOfSet(S) == + CHOOSE x \in S: \A y \in S: x <= y + +\* END HELPERS StateConstraint == /\ \A s \in safekeepers: @@ -25,9 +35,10 @@ StateConstraint == /\ \A s \in DOMAIN broker_state[b].sk: /\ broker_state[b].sk[s].commit_lsn <= max_commit_lsn + -InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0] -InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] +InitSafekeeper == [prune_lsn |-> 0, commit_lsn |-> 0, rx |-> [b \in brokers |-> NULL] ] +InitBroker == [sk |-> [s \in safekeepers |-> [prune_lsn |-> 0, commit_lsn |-> 0]]] InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] InitOnline == safekeepers \cup brokers \cup pageservers @@ -58,20 +69,21 @@ SkCommit(s1, s2) == SkPeerRecovery(s1,s2) == /\ {s1, s2} \subseteq online - /\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn + /\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn \* s2 has more WAL than s1 + /\ safekeeper_state[s2].prune_lsn < safekeeper_state[s1].commit_lsn \* s2 has not yet trimmed the WAL the WAL /\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn] /\ UNCHANGED <> SkPushToBroker(s,b) == /\ {s, b} \subseteq online - /\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn - THEN - LET - bsk == broker_state[b].sk - updbsk == [bsk EXCEPT ![s].commit_lsn = safekeeper_state[s].commit_lsn] - IN - [broker_state EXCEPT ![b].sk = updbsk] - ELSE broker_state + /\ broker_state' = LET + broker_side == broker_state[b].sk[s] + sk_side == safekeeper_state[s] + merged == [broker_side EXCEPT + !["commit_lsn"] = Max(broker_side.commit_lsn, sk_side.commit_lsn), + !["prune_lsn"] = Max(broker_side.prune_lsn, sk_side.prune_lsn)] + IN + [broker_state EXCEPT ![b].sk[s] = merged] /\ UNCHANGED <> PsRecvBroker(b,p,s) == @@ -86,6 +98,28 @@ PsRecvBroker(b,p,s) == ELSE pageserver_state /\ UNCHANGED <> + +SkRecvBroker(b,s) == + /\ {b,s} \subseteq online + /\ safekeeper_state' = [safekeeper_state EXCEPT ![s].rx[b] = broker_state[b]] + /\ UNCHANGED <> + +SkPrune(s) == + /\ {s} \subseteq online + /\ LET + info == + ( + {safekeeper_state[s]} + \cup + {safekeeper_state[s].rx[s2]: s2 \in (DOMAIN safekeeper_state[s].rx)} + ) + \ + {NULL} + commit_lsns == {i.commit_lsn: i \in info} + prune_lsn == MinOfSet(commit_lsns) + IN + safekeeper_state' = [safekeeper_state EXCEPT ![s].prune_lsn = prune_lsn] + SksWithNewerWal(p) == LET @@ -105,7 +139,11 @@ Next == \/ \E s1 \in safekeepers: \E s2 \in safekeepers: \/ SkCommit(s1, s2) \/ SkPeerRecovery(s1, s2) - \/ \E s \in safekeepers: \E b \in brokers: SkPushToBroker(s, b) + \/ \E s \in safekeepers: \E b \in brokers: + \/ SkPushToBroker(s, b) + \/ SkRecvBroker(b, s) + \/ \E s \in safekeepers: + \/ SkPrune(s) \/ \E s \in safekeepers: \E b \in brokers: \E p \in pageservers: PsRecvBroker(b,p,s) \/ \E p \in pageservers: PsChooseSk(p) @@ -116,8 +154,13 @@ Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state,onl \* invariants PsLagsSk == \A p \in pageservers: \A s \in DOMAIN pageserver_state[p].sk: - /\ pageserver_state[p].sk[s].commit_lsn < safekeeper_state[s].commit_lsn - + /\ pageserver_state[p].sk[s].commit_lsn <= safekeeper_state[s].commit_lsn + +PeerRecoveryIsPossible == + \A laggard \in (safekeepers \cap online): \E donor \in (safekeepers \cap online): + /\ (safekeeper_state[laggard].commit_lsn < safekeeper_state[donor].commit_lsn) + => safekeeper_state[donor].prune_lsn <= safekeeper_state[laggard].commit_lsn + EventuallyLaggingSkIsNotPreferredSk == <>( LET diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308183077/MC.cfg b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737323834253/MC.cfg similarity index 66% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308183077/MC.cfg rename to storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737323834253/MC.cfg index 886ee705a5..7ed78b95cd 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308183077/MC.cfg +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737323834253/MC.cfg @@ -18,36 +18,37 @@ az2 = az2 az3 = az3 \* MV CONSTANT definitions CONSTANT -brokers <- const_1737308178999123000 +brokers <- const_1737323830205294000 \* CONSTANT declarations CONSTANT NULL = NULL \* MV CONSTANT definitions CONSTANT -safekeepers <- const_1737308178999124000 +safekeepers <- const_1737323830205295000 \* MV CONSTANT definitions CONSTANT -pageservers <- const_1737308178999125000 +pageservers <- const_1737323830205296000 \* MV CONSTANT definitions CONSTANT -azs <- const_1737308178999126000 +azs <- const_1737323830205297000 \* SYMMETRY definition -SYMMETRY symm_1737308178999127000 +SYMMETRY symm_1737323830205298000 \* CONSTANT definitions CONSTANT -max_commit_lsn <- const_1737308178999128000 +max_commit_lsn <- const_1737323830205299000 \* CONSTANT definitions CONSTANT -az_mapping <- const_1737308178999129000 +az_mapping <- const_1737323830205300000 \* CONSTRAINT definition CONSTRAINT -constr_1737308178999130000 +constr_1737323830205301000 \* SPECIFICATION definition SPECIFICATION Spec \* INVARIANT definition INVARIANT PsLagsSk +PeerRecoveryIsPossible \* PROPERTY definition PROPERTY EventuallyLaggingSkIsNotPreferredSk -\* Generated on Sun Jan 19 18:36:19 CET 2025 \ No newline at end of file +\* Generated on Sun Jan 19 22:57:10 CET 2025 \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737323834253/MC.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737323834253/MC.out new file mode 100644 index 0000000000..4c5f79f791 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737323834253/MC.out @@ -0,0 +1,430 @@ +@!@!@STARTMSG 2262:0 @!@!@ +TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) +@!@!@ENDMSG 2262 @!@!@ +@!@!@STARTMSG 2187:0 @!@!@ +Running breadth-first search Model-Checking with fp 103 and seed 5725447841858367243 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 22986] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +@!@!@ENDMSG 2187 @!@!@ +@!@!@STARTMSG 2220:0 @!@!@ +Starting SANY... +@!@!@ENDMSG 2220 @!@!@ +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla +Semantic processing of module Naturals +Semantic processing of module Integers +Semantic processing of module Sequences +Semantic processing of module FiniteSets +Semantic processing of module replicated +Semantic processing of module TLC +Semantic processing of module MC +@!@!@STARTMSG 2219:0 @!@!@ +SANY finished. +@!@!@ENDMSG 2219 @!@!@ +@!@!@STARTMSG 2185:0 @!@!@ +Starting... (2025-01-19 22:57:11) +@!@!@ENDMSG 2185 @!@!@ +@!@!@STARTMSG 2279:3 @!@!@ +Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. +@!@!@ENDMSG 2279 @!@!@ +@!@!@STARTMSG 2284:3 @!@!@ +Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. +@!@!@ENDMSG 2284 @!@!@ +@!@!@STARTMSG 2212:0 @!@!@ +Implied-temporal checking--satisfiability problem has 1 branches. +@!@!@ENDMSG 2212 @!@!@ +@!@!@STARTMSG 2189:0 @!@!@ +Computing initial states... +@!@!@ENDMSG 2189 @!@!@ +@!@!@STARTMSG 2190:0 @!@!@ +Finished computing initial states: 1 distinct state generated at 2025-01-19 22:57:12. +@!@!@ENDMSG 2190 @!@!@ +@!@!@STARTMSG 1000:1 @!@!@ +TLC threw an unexpected exception. +This was probably caused by an error in the spec or model. +See the User Output or TLC Console for clues to what happened. +The exception was a java.lang.RuntimeException +: Attempted to select nonexistent field "commit_lsn" from the record +[sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] +line 118, col 25 to line 118, col 36 of module replicated +@!@!@ENDMSG 1000 @!@!@ +@!@!@STARTMSG 2121:1 @!@!@ +The behavior up to this point is: +@!@!@ENDMSG 2121 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +1: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, b3, s1, s2, s3, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +2: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, s1, s2, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +3: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, s1, s2, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 1, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 1, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +4: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, s1, s2, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 1, prune_lsn |-> 0, rx |-> (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 1, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2103:1 @!@!@ +The error occurred when TLC was evaluating the nested +expressions at the following positions: +0. Line 108, column 5 to line 122, column 57 in replicated +1. Line 108, column 8 to line 108, column 27 in replicated +2. Line 109, column 8 to line 121, column 80 in replicated +3. Line 121, column 9 to line 121, column 80 in replicated +4. Line 121, column 29 to line 121, column 80 in replicated +5. Line 121, column 71 to line 121, column 79 in replicated +6. Line 119, column 22 to line 119, column 42 in replicated +7. Line 27, column 3 to line 27, column 36 in replicated +8. Line 27, column 16 to line 27, column 16 in replicated +9. Line 119, column 31 to line 119, column 41 in replicated +10. Line 118, column 24 to line 118, column 49 in replicated +11. Line 118, column 25 to line 118, column 36 in replicated + + +@!@!@ENDMSG 2103 @!@!@ +@!@!@STARTMSG 2201:0 @!@!@ +The coverage statistics at 2025-01-19 22:57:12 +@!@!@ENDMSG 2201 @!@!@ +@!@!@STARTMSG 2773:0 @!@!@ +: 2:2 +@!@!@ENDMSG 2773 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 46, col 5 to line 49, col 26 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 1:16 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 52, col 8 to line 55, col 44 of module replicated: 16 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 52, col 18 to line 55, col 44 of module replicated: 16 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 53, col 9 to line 55, col 44 of module replicated: 1712 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 53, col 12 to line 53, col 48 of module replicated: 1712 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 54, col 12 to line 54, col 44 of module replicated: 688 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 55, col 12 to line 55, col 44 of module replicated: 224 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 52, col 32 to line 52, col 48 of module replicated: 16 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 56, col 8 to line 56, col 67 of module replicated: 16 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 6:37 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 59, col 8 to line 59, col 32 of module replicated: 165 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 59, col 8 to line 59, col 15 of module replicated: 128:301 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 59, col 27 to line 59, col 32 of module replicated: 128 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 60, col 8 to line 60, col 14 of module replicated: 125 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 60, col 8 to line 60, col 9 of module replicated: 88 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 60, col 13 to line 60, col 14 of module replicated: 88 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 61, col 8 to line 61, col 72 of module replicated: 90 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 61, col 8 to line 61, col 38 of module replicated: 53 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 61, col 42 to line 61, col 72 of module replicated: 53 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 65, col 13 to line 67, col 50 of module replicated: 37 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 68, col 8 to line 68, col 58 of module replicated: 37 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 71, col 8 to line 71, col 32 of module replicated: 127 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 72, col 8 to line 72, col 72 of module replicated: 87 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 73, col 8 to line 73, col 71 of module replicated: 8 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 74, col 8 to line 74, col 102 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 75, col 8 to line 75, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 15:83 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 78, col 8 to line 78, col 30 of module replicated: 201 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 78, col 8 to line 78, col 13 of module replicated: 118:298 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 78, col 25 to line 78, col 30 of module replicated: 118 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 79, col 8 to line 86, col 52 of module replicated: 83 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 87, col 8 to line 87, col 62 of module replicated: 83 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 2:52 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 90, col 8 to line 90, col 31 of module replicated: 124 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 90, col 8 to line 90, col 14 of module replicated: 72:236 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 90, col 26 to line 90, col 31 of module replicated: 72 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 96, col 13 to line 98, col 37 of module replicated: 52 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 96, col 33 to line 98, col 37 of module replicated: 52 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 96, col 36 to line 96, col 66 of module replicated: 52 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 97, col 22 to line 97, col 66 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 98, col 22 to line 98, col 37 of module replicated: 50 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 99, col 8 to line 99, col 58 of module replicated: 52 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 31:83 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 103, col 8 to line 103, col 29 of module replicated: 201 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 103, col 8 to line 103, col 12 of module replicated: 118:298 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 103, col 24 to line 103, col 29 of module replicated: 118 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 104, col 8 to line 104, col 81 of module replicated: 83 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 105, col 8 to line 105, col 57 of module replicated: 83 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 8:20 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 108, col 8 to line 108, col 27 of module replicated: 49 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 108, col 8 to line 108, col 10 of module replicated: 29:54 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 108, col 22 to line 108, col 27 of module replicated: 29 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 121, col 9 to line 121, col 80 of module replicated: 20 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 121, col 29 to line 121, col 80 of module replicated: 25 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 121, col 30 to line 121, col 45 of module replicated: 25 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 121, col 54 to line 121, col 79 of module replicated: 25 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 121, col 71 to line 121, col 79 of module replicated: 25 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 119, col 22 to line 119, col 42 of module replicated: 25 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 27, col 3 to line 27, col 36 of module replicated: 25 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||line 27, col 19 to line 27, col 36 of module replicated: 20 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||line 27, col 16 to line 27, col 16 of module replicated: 25 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 119, col 31 to line 119, col 41 of module replicated: 25 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |||||line 118, col 24 to line 118, col 49 of module replicated: 25:60 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||line 118, col 25 to line 118, col 36 of module replicated: 25 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||line 118, col 45 to line 118, col 48 of module replicated: 25 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||line 111, col 13 to line 117, col 18 of module replicated: 25 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||line 112, col 17 to line 114, col 84 of module replicated: 25 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||||line 112, col 17 to line 112, col 37 of module replicated: 25 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |||||||||line 114, col 17 to line 114, col 84 of module replicated: 25:55 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||||line 114, col 18 to line 114, col 43 of module replicated: 75 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||||line 114, col 54 to line 114, col 82 of module replicated: 25 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||line 117, col 13 to line 117, col 18 of module replicated: 25 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 122, col 8 to line 122, col 57 of module replicated: 20 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 132, col 8 to line 132, col 27 of module replicated: 8 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 133, col 8 to line 133, col 30 of module replicated: 8 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 133, col 8 to line 133, col 25 of module replicated: 8 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 127, col 15 to line 127, col 33 of module replicated: 8 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 129, col 5 to line 129, col 66 of module replicated: 8 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 129, col 26 to line 129, col 65 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 129, col 12 to line 129, col 23 of module replicated: 8 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 133, col 24 to line 133, col 24 of module replicated: 8 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 133, col 29 to line 133, col 30 of module replicated: 8 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 134, col 8 to line 134, col 109 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 135, col 8 to line 135, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2774:0 @!@!@ + +@!@!@ENDMSG 2774 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 157, col 13 to line 158, col 81 of module replicated: 68 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 157, col 35 to line 158, col 81 of module replicated: 68 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 158, col 9 to line 158, col 81 of module replicated: 204 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 157, col 44 to line 157, col 72 of module replicated: 68 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 157, col 22 to line 157, col 32 of module replicated: 68 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2774:0 @!@!@ + +@!@!@ENDMSG 2774 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 161, col 5 to line 163, col 88 of module replicated: 68 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 161, col 47 to line 163, col 88 of module replicated: 173 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 162, col 9 to line 163, col 88 of module replicated: 176 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 162, col 12 to line 163, col 88 of module replicated: 176 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 162, col 13 to line 162, col 85 of module replicated: 176 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 163, col 16 to line 163, col 88 of module replicated: 35 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 161, col 61 to line 161, col 83 of module replicated: 173 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 161, col 21 to line 161, col 43 of module replicated: 68 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2202:0 @!@!@ +End of statistics. +@!@!@ENDMSG 2202 @!@!@ +@!@!@STARTMSG 2200:0 @!@!@ +Progress(5) at 2025-01-19 22:57:12: 273 states generated (6.319 s/min), 64 distinct states found (1.481 ds/min), 52 states left on queue. +@!@!@ENDMSG 2200 @!@!@ +@!@!@STARTMSG 2199:0 @!@!@ +273 states generated, 64 distinct states found, 52 states left on queue. +@!@!@ENDMSG 2199 @!@!@ +@!@!@STARTMSG 2186:0 @!@!@ +Finished in 2610ms at (2025-01-19 22:57:12) +@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308024914/MC.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737323834253/MC.tla similarity index 67% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308024914/MC.tla rename to storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737323834253/MC.tla index caea6ac31c..5e43f06dc5 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308024914/MC.tla +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737323834253/MC.tla @@ -22,44 +22,44 @@ az1, az2, az3 ---- \* MV CONSTANT definitions brokers -const_1737308022622113000 == +const_1737323830205294000 == {b1, b2, b3} ---- \* MV CONSTANT definitions safekeepers -const_1737308022622114000 == +const_1737323830205295000 == {s1, s2, s3} ---- \* MV CONSTANT definitions pageservers -const_1737308022622115000 == +const_1737323830205296000 == {p1} ---- \* MV CONSTANT definitions azs -const_1737308022622116000 == +const_1737323830205297000 == {az1, az2, az3} ---- \* SYMMETRY definition -symm_1737308022622117000 == -Permutations(const_1737308022622113000) \union Permutations(const_1737308022622114000) \union Permutations(const_1737308022622115000) \union Permutations(const_1737308022622116000) +symm_1737323830205298000 == +Permutations(const_1737323830205294000) \union Permutations(const_1737323830205295000) \union Permutations(const_1737323830205296000) \union Permutations(const_1737323830205297000) ---- \* CONSTANT definitions @modelParameterConstants:4max_commit_lsn -const_1737308022622118000 == +const_1737323830205299000 == 2 ---- \* CONSTANT definitions @modelParameterConstants:5az_mapping -const_1737308022622119000 == +const_1737323830205300000 == [ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2} , az3 |-> {b3,s3}] ---- \* CONSTRAINT definition @modelParameterContraint:0 -constr_1737308022622120000 == +constr_1737323830205301000 == StateConstraint ---- ============================================================================= \* Modification History -\* Created Sun Jan 19 18:33:42 CET 2025 by cs +\* Created Sun Jan 19 22:57:10 CET 2025 by cs diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737323834253/MC_TE.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737323834253/MC_TE.out new file mode 100644 index 0000000000..4c5f79f791 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737323834253/MC_TE.out @@ -0,0 +1,430 @@ +@!@!@STARTMSG 2262:0 @!@!@ +TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) +@!@!@ENDMSG 2262 @!@!@ +@!@!@STARTMSG 2187:0 @!@!@ +Running breadth-first search Model-Checking with fp 103 and seed 5725447841858367243 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 22986] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +@!@!@ENDMSG 2187 @!@!@ +@!@!@STARTMSG 2220:0 @!@!@ +Starting SANY... +@!@!@ENDMSG 2220 @!@!@ +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla +Semantic processing of module Naturals +Semantic processing of module Integers +Semantic processing of module Sequences +Semantic processing of module FiniteSets +Semantic processing of module replicated +Semantic processing of module TLC +Semantic processing of module MC +@!@!@STARTMSG 2219:0 @!@!@ +SANY finished. +@!@!@ENDMSG 2219 @!@!@ +@!@!@STARTMSG 2185:0 @!@!@ +Starting... (2025-01-19 22:57:11) +@!@!@ENDMSG 2185 @!@!@ +@!@!@STARTMSG 2279:3 @!@!@ +Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. +@!@!@ENDMSG 2279 @!@!@ +@!@!@STARTMSG 2284:3 @!@!@ +Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. +@!@!@ENDMSG 2284 @!@!@ +@!@!@STARTMSG 2212:0 @!@!@ +Implied-temporal checking--satisfiability problem has 1 branches. +@!@!@ENDMSG 2212 @!@!@ +@!@!@STARTMSG 2189:0 @!@!@ +Computing initial states... +@!@!@ENDMSG 2189 @!@!@ +@!@!@STARTMSG 2190:0 @!@!@ +Finished computing initial states: 1 distinct state generated at 2025-01-19 22:57:12. +@!@!@ENDMSG 2190 @!@!@ +@!@!@STARTMSG 1000:1 @!@!@ +TLC threw an unexpected exception. +This was probably caused by an error in the spec or model. +See the User Output or TLC Console for clues to what happened. +The exception was a java.lang.RuntimeException +: Attempted to select nonexistent field "commit_lsn" from the record +[sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] +line 118, col 25 to line 118, col 36 of module replicated +@!@!@ENDMSG 1000 @!@!@ +@!@!@STARTMSG 2121:1 @!@!@ +The behavior up to this point is: +@!@!@ENDMSG 2121 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +1: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, b3, s1, s2, s3, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +2: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, s1, s2, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +3: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, s1, s2, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 1, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 1, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +4: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, s1, s2, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 1, prune_lsn |-> 0, rx |-> (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 1, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2103:1 @!@!@ +The error occurred when TLC was evaluating the nested +expressions at the following positions: +0. Line 108, column 5 to line 122, column 57 in replicated +1. Line 108, column 8 to line 108, column 27 in replicated +2. Line 109, column 8 to line 121, column 80 in replicated +3. Line 121, column 9 to line 121, column 80 in replicated +4. Line 121, column 29 to line 121, column 80 in replicated +5. Line 121, column 71 to line 121, column 79 in replicated +6. Line 119, column 22 to line 119, column 42 in replicated +7. Line 27, column 3 to line 27, column 36 in replicated +8. Line 27, column 16 to line 27, column 16 in replicated +9. Line 119, column 31 to line 119, column 41 in replicated +10. Line 118, column 24 to line 118, column 49 in replicated +11. Line 118, column 25 to line 118, column 36 in replicated + + +@!@!@ENDMSG 2103 @!@!@ +@!@!@STARTMSG 2201:0 @!@!@ +The coverage statistics at 2025-01-19 22:57:12 +@!@!@ENDMSG 2201 @!@!@ +@!@!@STARTMSG 2773:0 @!@!@ +: 2:2 +@!@!@ENDMSG 2773 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 46, col 5 to line 49, col 26 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 1:16 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 52, col 8 to line 55, col 44 of module replicated: 16 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 52, col 18 to line 55, col 44 of module replicated: 16 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 53, col 9 to line 55, col 44 of module replicated: 1712 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 53, col 12 to line 53, col 48 of module replicated: 1712 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 54, col 12 to line 54, col 44 of module replicated: 688 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 55, col 12 to line 55, col 44 of module replicated: 224 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 52, col 32 to line 52, col 48 of module replicated: 16 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 56, col 8 to line 56, col 67 of module replicated: 16 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 6:37 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 59, col 8 to line 59, col 32 of module replicated: 165 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 59, col 8 to line 59, col 15 of module replicated: 128:301 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 59, col 27 to line 59, col 32 of module replicated: 128 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 60, col 8 to line 60, col 14 of module replicated: 125 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 60, col 8 to line 60, col 9 of module replicated: 88 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 60, col 13 to line 60, col 14 of module replicated: 88 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 61, col 8 to line 61, col 72 of module replicated: 90 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 61, col 8 to line 61, col 38 of module replicated: 53 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 61, col 42 to line 61, col 72 of module replicated: 53 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 65, col 13 to line 67, col 50 of module replicated: 37 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 68, col 8 to line 68, col 58 of module replicated: 37 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 71, col 8 to line 71, col 32 of module replicated: 127 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 72, col 8 to line 72, col 72 of module replicated: 87 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 73, col 8 to line 73, col 71 of module replicated: 8 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 74, col 8 to line 74, col 102 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 75, col 8 to line 75, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 15:83 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 78, col 8 to line 78, col 30 of module replicated: 201 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 78, col 8 to line 78, col 13 of module replicated: 118:298 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 78, col 25 to line 78, col 30 of module replicated: 118 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 79, col 8 to line 86, col 52 of module replicated: 83 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 87, col 8 to line 87, col 62 of module replicated: 83 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 2:52 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 90, col 8 to line 90, col 31 of module replicated: 124 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 90, col 8 to line 90, col 14 of module replicated: 72:236 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 90, col 26 to line 90, col 31 of module replicated: 72 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 96, col 13 to line 98, col 37 of module replicated: 52 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 96, col 33 to line 98, col 37 of module replicated: 52 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 96, col 36 to line 96, col 66 of module replicated: 52 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 97, col 22 to line 97, col 66 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 98, col 22 to line 98, col 37 of module replicated: 50 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 99, col 8 to line 99, col 58 of module replicated: 52 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 31:83 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 103, col 8 to line 103, col 29 of module replicated: 201 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 103, col 8 to line 103, col 12 of module replicated: 118:298 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 103, col 24 to line 103, col 29 of module replicated: 118 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 104, col 8 to line 104, col 81 of module replicated: 83 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 105, col 8 to line 105, col 57 of module replicated: 83 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 8:20 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 108, col 8 to line 108, col 27 of module replicated: 49 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 108, col 8 to line 108, col 10 of module replicated: 29:54 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 108, col 22 to line 108, col 27 of module replicated: 29 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 121, col 9 to line 121, col 80 of module replicated: 20 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 121, col 29 to line 121, col 80 of module replicated: 25 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 121, col 30 to line 121, col 45 of module replicated: 25 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 121, col 54 to line 121, col 79 of module replicated: 25 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 121, col 71 to line 121, col 79 of module replicated: 25 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 119, col 22 to line 119, col 42 of module replicated: 25 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 27, col 3 to line 27, col 36 of module replicated: 25 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||line 27, col 19 to line 27, col 36 of module replicated: 20 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||line 27, col 16 to line 27, col 16 of module replicated: 25 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 119, col 31 to line 119, col 41 of module replicated: 25 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |||||line 118, col 24 to line 118, col 49 of module replicated: 25:60 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||line 118, col 25 to line 118, col 36 of module replicated: 25 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||line 118, col 45 to line 118, col 48 of module replicated: 25 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||line 111, col 13 to line 117, col 18 of module replicated: 25 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||line 112, col 17 to line 114, col 84 of module replicated: 25 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||||line 112, col 17 to line 112, col 37 of module replicated: 25 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |||||||||line 114, col 17 to line 114, col 84 of module replicated: 25:55 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||||line 114, col 18 to line 114, col 43 of module replicated: 75 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||||line 114, col 54 to line 114, col 82 of module replicated: 25 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||line 117, col 13 to line 117, col 18 of module replicated: 25 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 122, col 8 to line 122, col 57 of module replicated: 20 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 132, col 8 to line 132, col 27 of module replicated: 8 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 133, col 8 to line 133, col 30 of module replicated: 8 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 133, col 8 to line 133, col 25 of module replicated: 8 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 127, col 15 to line 127, col 33 of module replicated: 8 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 129, col 5 to line 129, col 66 of module replicated: 8 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 129, col 26 to line 129, col 65 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 129, col 12 to line 129, col 23 of module replicated: 8 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 133, col 24 to line 133, col 24 of module replicated: 8 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 133, col 29 to line 133, col 30 of module replicated: 8 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 134, col 8 to line 134, col 109 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 135, col 8 to line 135, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2774:0 @!@!@ + +@!@!@ENDMSG 2774 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 157, col 13 to line 158, col 81 of module replicated: 68 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 157, col 35 to line 158, col 81 of module replicated: 68 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 158, col 9 to line 158, col 81 of module replicated: 204 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 157, col 44 to line 157, col 72 of module replicated: 68 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 157, col 22 to line 157, col 32 of module replicated: 68 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2774:0 @!@!@ + +@!@!@ENDMSG 2774 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 161, col 5 to line 163, col 88 of module replicated: 68 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 161, col 47 to line 163, col 88 of module replicated: 173 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 162, col 9 to line 163, col 88 of module replicated: 176 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 162, col 12 to line 163, col 88 of module replicated: 176 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 162, col 13 to line 162, col 85 of module replicated: 176 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 163, col 16 to line 163, col 88 of module replicated: 35 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 161, col 61 to line 161, col 83 of module replicated: 173 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 161, col 21 to line 161, col 43 of module replicated: 68 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2202:0 @!@!@ +End of statistics. +@!@!@ENDMSG 2202 @!@!@ +@!@!@STARTMSG 2200:0 @!@!@ +Progress(5) at 2025-01-19 22:57:12: 273 states generated (6.319 s/min), 64 distinct states found (1.481 ds/min), 52 states left on queue. +@!@!@ENDMSG 2200 @!@!@ +@!@!@STARTMSG 2199:0 @!@!@ +273 states generated, 64 distinct states found, 52 states left on queue. +@!@!@ENDMSG 2199 @!@!@ +@!@!@STARTMSG 2186:0 @!@!@ +Finished in 2610ms at (2025-01-19 22:57:12) +@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308024914/replicated.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737323834253/replicated.tla similarity index 62% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308024914/replicated.tla rename to storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737323834253/replicated.tla index 36db18ecc3..f86f2ff288 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308024914/replicated.tla +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737323834253/replicated.tla @@ -17,6 +17,16 @@ CONSTANT CONSTANT max_commit_lsn + +\* HELPERS + +Max(a,b) == IF a > b THEN a ELSE b + +(* The minimum of a non-empty set of integers *) +MinOfSet(S) == + CHOOSE x \in S: \A y \in S: x <= y + +\* END HELPERS StateConstraint == /\ \A s \in safekeepers: @@ -25,9 +35,10 @@ StateConstraint == /\ \A s \in DOMAIN broker_state[b].sk: /\ broker_state[b].sk[s].commit_lsn <= max_commit_lsn + -InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0] -InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] +InitSafekeeper == [prune_lsn |-> 0, commit_lsn |-> 0, rx |-> [b \in brokers |-> NULL] ] +InitBroker == [sk |-> [s \in safekeepers |-> [prune_lsn |-> 0, commit_lsn |-> 0]]] InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] InitOnline == safekeepers \cup brokers \cup pageservers @@ -58,20 +69,21 @@ SkCommit(s1, s2) == SkPeerRecovery(s1,s2) == /\ {s1, s2} \subseteq online - /\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn + /\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn \* s2 has more WAL than s1 + /\ safekeeper_state[s2].prune_lsn < safekeeper_state[s1].commit_lsn \* s2 has not yet trimmed the WAL the WAL /\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn] /\ UNCHANGED <> SkPushToBroker(s,b) == /\ {s, b} \subseteq online - /\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn - THEN - LET - bsk == broker_state[b].sk - updbsk == [bsk EXCEPT ![s].commit_lsn = safekeeper_state[s].commit_lsn] - IN - [broker_state EXCEPT ![b].sk = updbsk] - ELSE broker_state + /\ broker_state' = LET + broker_side == broker_state[b].sk[s] + sk_side == safekeeper_state[s] + merged == [broker_side EXCEPT + !["commit_lsn"] = Max(broker_side.commit_lsn, sk_side.commit_lsn), + !["prune_lsn"] = Max(broker_side.prune_lsn, sk_side.prune_lsn)] + IN + [broker_state EXCEPT ![b].sk[s] = merged] /\ UNCHANGED <> PsRecvBroker(b,p,s) == @@ -86,6 +98,29 @@ PsRecvBroker(b,p,s) == ELSE pageserver_state /\ UNCHANGED <> + +SkRecvBroker(b,s) == + /\ {b,s} \subseteq online + /\ safekeeper_state' = [safekeeper_state EXCEPT ![s].rx[b] = broker_state[b]] + /\ UNCHANGED <> + +SkPrune(s) == + /\ {s} \subseteq online + /\ LET + info == + ( + {safekeeper_state[s]} + \cup + {safekeeper_state[s].rx[s2]: s2 \in (DOMAIN safekeeper_state[s].rx)} + ) + \ + {NULL} + commit_lsns == {i.commit_lsn: i \in info} + prune_lsn == MinOfSet(commit_lsns) + IN + safekeeper_state' = [safekeeper_state EXCEPT ![s].prune_lsn = prune_lsn] + /\ UNCHANGED <> + SksWithNewerWal(p) == LET @@ -105,7 +140,11 @@ Next == \/ \E s1 \in safekeepers: \E s2 \in safekeepers: \/ SkCommit(s1, s2) \/ SkPeerRecovery(s1, s2) - \/ \E s \in safekeepers: \E b \in brokers: SkPushToBroker(s, b) + \/ \E s \in safekeepers: \E b \in brokers: + \/ SkPushToBroker(s, b) + \/ SkRecvBroker(b, s) + \/ \E s \in safekeepers: + \/ SkPrune(s) \/ \E s \in safekeepers: \E b \in brokers: \E p \in pageservers: PsRecvBroker(b,p,s) \/ \E p \in pageservers: PsChooseSk(p) @@ -115,10 +154,14 @@ Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state,onl \* invariants -PsLagsSk == []( - \A p \in pageservers: \A s \in DOMAIN pageserver_state[p].sk: - /\ pageserver_state[p].sk[s].commit_lsn < safekeeper_state[s].commit_lsn - ) +PsLagsSk == \A p \in pageservers: \A s \in DOMAIN pageserver_state[p].sk: + /\ pageserver_state[p].sk[s].commit_lsn <= safekeeper_state[s].commit_lsn + +PeerRecoveryIsPossible == + \A laggard \in (safekeepers \cap online): \E donor \in (safekeepers \cap online): + /\ (safekeeper_state[laggard].commit_lsn < safekeeper_state[donor].commit_lsn) + => safekeeper_state[donor].prune_lsn <= safekeeper_state[laggard].commit_lsn + EventuallyLaggingSkIsNotPreferredSk == <>( LET diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308216766/MC.cfg b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324141888/MC.cfg similarity index 66% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308216766/MC.cfg rename to storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324141888/MC.cfg index a3527c1e04..7b7ca53121 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308216766/MC.cfg +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324141888/MC.cfg @@ -18,36 +18,37 @@ az2 = az2 az3 = az3 \* MV CONSTANT definitions CONSTANT -brokers <- const_1737308198937133000 +brokers <- const_1737324137833305000 \* CONSTANT declarations CONSTANT NULL = NULL \* MV CONSTANT definitions CONSTANT -safekeepers <- const_1737308198937134000 +safekeepers <- const_1737324137833306000 \* MV CONSTANT definitions CONSTANT -pageservers <- const_1737308198937135000 +pageservers <- const_1737324137833307000 \* MV CONSTANT definitions CONSTANT -azs <- const_1737308198937136000 +azs <- const_1737324137833308000 \* SYMMETRY definition -SYMMETRY symm_1737308198937137000 +SYMMETRY symm_1737324137833309000 \* CONSTANT definitions CONSTANT -max_commit_lsn <- const_1737308198937138000 +max_commit_lsn <- const_1737324137833310000 \* CONSTANT definitions CONSTANT -az_mapping <- const_1737308198937139000 +az_mapping <- const_1737324137833311000 \* CONSTRAINT definition CONSTRAINT -constr_1737308198937140000 +constr_1737324137833312000 \* SPECIFICATION definition SPECIFICATION Spec \* INVARIANT definition INVARIANT PsLagsSk +PeerRecoveryIsPossible \* PROPERTY definition PROPERTY EventuallyLaggingSkIsNotPreferredSk -\* Generated on Sun Jan 19 18:36:38 CET 2025 \ No newline at end of file +\* Generated on Sun Jan 19 23:02:17 CET 2025 \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324141888/MC.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324141888/MC.out new file mode 100644 index 0000000000..08f209eeda --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324141888/MC.out @@ -0,0 +1,368 @@ +@!@!@STARTMSG 2262:0 @!@!@ +TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) +@!@!@ENDMSG 2262 @!@!@ +@!@!@STARTMSG 2187:0 @!@!@ +Running breadth-first search Model-Checking with fp 60 and seed 1436414801931403111 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 23214] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +@!@!@ENDMSG 2187 @!@!@ +@!@!@STARTMSG 2220:0 @!@!@ +Starting SANY... +@!@!@ENDMSG 2220 @!@!@ +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla +Semantic processing of module Naturals +Semantic processing of module Integers +Semantic processing of module Sequences +Semantic processing of module FiniteSets +Semantic processing of module replicated +Semantic processing of module TLC +Semantic processing of module MC +@!@!@STARTMSG 2219:0 @!@!@ +SANY finished. +@!@!@ENDMSG 2219 @!@!@ +@!@!@STARTMSG 2185:0 @!@!@ +Starting... (2025-01-19 23:02:19) +@!@!@ENDMSG 2185 @!@!@ +@!@!@STARTMSG 2279:3 @!@!@ +Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. +@!@!@ENDMSG 2279 @!@!@ +@!@!@STARTMSG 2284:3 @!@!@ +Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. +@!@!@ENDMSG 2284 @!@!@ +@!@!@STARTMSG 2212:0 @!@!@ +Implied-temporal checking--satisfiability problem has 1 branches. +@!@!@ENDMSG 2212 @!@!@ +@!@!@STARTMSG 2189:0 @!@!@ +Computing initial states... +@!@!@ENDMSG 2189 @!@!@ +@!@!@STARTMSG 2190:0 @!@!@ +Finished computing initial states: 1 distinct state generated at 2025-01-19 23:02:20. +@!@!@ENDMSG 2190 @!@!@ +@!@!@STARTMSG 1000:1 @!@!@ +TLC threw an unexpected exception. +This was probably caused by an error in the spec or model. +See the User Output or TLC Console for clues to what happened. +The exception was a java.lang.RuntimeException +: Attempted to select field "sk" from a non-record value NULL +line 111, col 36 to line 111, col 40 of module replicated +@!@!@ENDMSG 1000 @!@!@ +@!@!@STARTMSG 2121:1 @!@!@ +The behavior up to this point is: +@!@!@ENDMSG 2121 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +1: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, b3, s1, s2, s3, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +2: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, s1, s2, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2103:1 @!@!@ +The error occurred when TLC was evaluating the nested +expressions at the following positions: +0. Line 108, column 5 to line 124, column 57 in replicated +1. Line 108, column 8 to line 108, column 27 in replicated +2. Line 109, column 8 to line 123, column 80 in replicated +3. Line 123, column 9 to line 123, column 80 in replicated +4. Line 123, column 29 to line 123, column 80 in replicated +5. Line 123, column 71 to line 123, column 79 in replicated +6. Line 121, column 22 to line 121, column 42 in replicated +7. Line 27, column 3 to line 27, column 36 in replicated +8. Line 27, column 16 to line 27, column 16 in replicated +9. Line 121, column 31 to line 121, column 41 in replicated +10. Line 120, column 24 to line 120, column 49 in replicated +11. Line 120, column 45 to line 120, column 48 in replicated +12. Line 113, column 13 to line 119, column 18 in replicated +13. Line 114, column 17 to line 116, column 32 in replicated +14. Line 116, column 17 to line 116, column 32 in replicated +15. Line 111, column 29 to line 111, column 62 in replicated +16. Line 111, column 35 to line 111, column 62 in replicated +17. Line 111, column 36 to line 111, column 40 in replicated + + +@!@!@ENDMSG 2103 @!@!@ +@!@!@STARTMSG 2201:0 @!@!@ +The coverage statistics at 2025-01-19 23:02:20 +@!@!@ENDMSG 2201 @!@!@ +@!@!@STARTMSG 2773:0 @!@!@ +: 2:2 +@!@!@ENDMSG 2773 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 46, col 5 to line 49, col 26 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 1:6 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 52, col 8 to line 55, col 44 of module replicated: 6 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 52, col 18 to line 55, col 44 of module replicated: 6 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 53, col 9 to line 55, col 44 of module replicated: 642 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 53, col 12 to line 53, col 48 of module replicated: 642 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 54, col 12 to line 54, col 44 of module replicated: 258 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 55, col 12 to line 55, col 44 of module replicated: 84 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 52, col 32 to line 52, col 48 of module replicated: 6 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 56, col 8 to line 56, col 67 of module replicated: 6 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 4:14 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 59, col 8 to line 59, col 32 of module replicated: 59 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 59, col 8 to line 59, col 15 of module replicated: 45:105 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 59, col 27 to line 59, col 32 of module replicated: 45 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 60, col 8 to line 60, col 14 of module replicated: 44 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 60, col 8 to line 60, col 9 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 60, col 13 to line 60, col 14 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 61, col 8 to line 61, col 72 of module replicated: 32 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 61, col 8 to line 61, col 38 of module replicated: 18 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 61, col 42 to line 61, col 72 of module replicated: 18 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 65, col 13 to line 67, col 50 of module replicated: 14 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 68, col 8 to line 68, col 58 of module replicated: 14 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 71, col 8 to line 71, col 32 of module replicated: 45 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 72, col 8 to line 72, col 72 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 73, col 8 to line 73, col 71 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 74, col 8 to line 74, col 102 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 75, col 8 to line 75, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 2:30 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 78, col 8 to line 78, col 30 of module replicated: 75 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 78, col 8 to line 78, col 13 of module replicated: 45:111 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 78, col 25 to line 78, col 30 of module replicated: 45 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 79, col 8 to line 86, col 52 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 87, col 8 to line 87, col 62 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 96, col 13 to line 98, col 37 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 99, col 8 to line 99, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 5:30 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 103, col 8 to line 103, col 29 of module replicated: 75 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 103, col 8 to line 103, col 12 of module replicated: 45:111 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 103, col 24 to line 103, col 29 of module replicated: 45 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 104, col 8 to line 104, col 81 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 105, col 8 to line 105, col 57 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 108, col 8 to line 108, col 27 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 123, col 9 to line 123, col 80 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 123, col 29 to line 123, col 80 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 123, col 30 to line 123, col 45 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 123, col 54 to line 123, col 79 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 123, col 71 to line 123, col 79 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 121, col 22 to line 121, col 42 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 27, col 3 to line 27, col 36 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 121, col 31 to line 121, col 41 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||line 120, col 24 to line 120, col 49 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||line 120, col 45 to line 120, col 48 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||line 113, col 13 to line 119, col 18 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||line 114, col 17 to line 116, col 32 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||||line 114, col 17 to line 114, col 37 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||||line 116, col 17 to line 116, col 32 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||||line 111, col 29 to line 111, col 62 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||||||line 111, col 35 to line 111, col 62 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||||||line 111, col 36 to line 111, col 40 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||||||line 111, col 50 to line 111, col 61 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |||||||||||||line 110, col 25 to line 110, col 90 of module replicated: 5:10 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||||||||line 110, col 26 to line 110, col 50 of module replicated: 15 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||||||||line 110, col 60 to line 110, col 88 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 124, col 8 to line 124, col 57 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 136, col 8 to line 136, col 109 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 137, col 8 to line 137, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2774:0 @!@!@ + +@!@!@ENDMSG 2774 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 159, col 13 to line 160, col 81 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 159, col 35 to line 160, col 81 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 160, col 9 to line 160, col 81 of module replicated: 39 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 159, col 44 to line 159, col 72 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 159, col 22 to line 159, col 32 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2774:0 @!@!@ + +@!@!@ENDMSG 2774 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 163, col 5 to line 165, col 88 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 163, col 47 to line 165, col 88 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 164, col 9 to line 165, col 88 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 164, col 12 to line 165, col 88 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 164, col 13 to line 164, col 85 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 165, col 16 to line 165, col 88 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 163, col 61 to line 163, col 83 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 163, col 21 to line 163, col 43 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2202:0 @!@!@ +End of statistics. +@!@!@ENDMSG 2202 @!@!@ +@!@!@STARTMSG 2200:0 @!@!@ +Progress(4) at 2025-01-19 23:02:20: 69 states generated (1.718 s/min), 13 distinct states found (323 ds/min), 9 states left on queue. +@!@!@ENDMSG 2200 @!@!@ +@!@!@STARTMSG 2199:0 @!@!@ +69 states generated, 13 distinct states found, 9 states left on queue. +@!@!@ENDMSG 2199 @!@!@ +@!@!@STARTMSG 2186:0 @!@!@ +Finished in 2426ms at (2025-01-19 23:02:20) +@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308183077/MC.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324141888/MC.tla similarity index 67% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308183077/MC.tla rename to storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324141888/MC.tla index 675b27fd4b..06ff5bfce9 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308183077/MC.tla +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324141888/MC.tla @@ -22,44 +22,44 @@ az1, az2, az3 ---- \* MV CONSTANT definitions brokers -const_1737308178999123000 == +const_1737324137833305000 == {b1, b2, b3} ---- \* MV CONSTANT definitions safekeepers -const_1737308178999124000 == +const_1737324137833306000 == {s1, s2, s3} ---- \* MV CONSTANT definitions pageservers -const_1737308178999125000 == +const_1737324137833307000 == {p1} ---- \* MV CONSTANT definitions azs -const_1737308178999126000 == +const_1737324137833308000 == {az1, az2, az3} ---- \* SYMMETRY definition -symm_1737308178999127000 == -Permutations(const_1737308178999123000) \union Permutations(const_1737308178999124000) \union Permutations(const_1737308178999125000) \union Permutations(const_1737308178999126000) +symm_1737324137833309000 == +Permutations(const_1737324137833305000) \union Permutations(const_1737324137833306000) \union Permutations(const_1737324137833307000) \union Permutations(const_1737324137833308000) ---- \* CONSTANT definitions @modelParameterConstants:4max_commit_lsn -const_1737308178999128000 == +const_1737324137833310000 == 2 ---- \* CONSTANT definitions @modelParameterConstants:5az_mapping -const_1737308178999129000 == +const_1737324137833311000 == [ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2} , az3 |-> {b3,s3}] ---- \* CONSTRAINT definition @modelParameterContraint:0 -constr_1737308178999130000 == +constr_1737324137833312000 == StateConstraint ---- ============================================================================= \* Modification History -\* Created Sun Jan 19 18:36:19 CET 2025 by cs +\* Created Sun Jan 19 23:02:17 CET 2025 by cs diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324141888/MC_TE.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324141888/MC_TE.out new file mode 100644 index 0000000000..08f209eeda --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324141888/MC_TE.out @@ -0,0 +1,368 @@ +@!@!@STARTMSG 2262:0 @!@!@ +TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) +@!@!@ENDMSG 2262 @!@!@ +@!@!@STARTMSG 2187:0 @!@!@ +Running breadth-first search Model-Checking with fp 60 and seed 1436414801931403111 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 23214] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +@!@!@ENDMSG 2187 @!@!@ +@!@!@STARTMSG 2220:0 @!@!@ +Starting SANY... +@!@!@ENDMSG 2220 @!@!@ +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla +Semantic processing of module Naturals +Semantic processing of module Integers +Semantic processing of module Sequences +Semantic processing of module FiniteSets +Semantic processing of module replicated +Semantic processing of module TLC +Semantic processing of module MC +@!@!@STARTMSG 2219:0 @!@!@ +SANY finished. +@!@!@ENDMSG 2219 @!@!@ +@!@!@STARTMSG 2185:0 @!@!@ +Starting... (2025-01-19 23:02:19) +@!@!@ENDMSG 2185 @!@!@ +@!@!@STARTMSG 2279:3 @!@!@ +Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. +@!@!@ENDMSG 2279 @!@!@ +@!@!@STARTMSG 2284:3 @!@!@ +Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. +@!@!@ENDMSG 2284 @!@!@ +@!@!@STARTMSG 2212:0 @!@!@ +Implied-temporal checking--satisfiability problem has 1 branches. +@!@!@ENDMSG 2212 @!@!@ +@!@!@STARTMSG 2189:0 @!@!@ +Computing initial states... +@!@!@ENDMSG 2189 @!@!@ +@!@!@STARTMSG 2190:0 @!@!@ +Finished computing initial states: 1 distinct state generated at 2025-01-19 23:02:20. +@!@!@ENDMSG 2190 @!@!@ +@!@!@STARTMSG 1000:1 @!@!@ +TLC threw an unexpected exception. +This was probably caused by an error in the spec or model. +See the User Output or TLC Console for clues to what happened. +The exception was a java.lang.RuntimeException +: Attempted to select field "sk" from a non-record value NULL +line 111, col 36 to line 111, col 40 of module replicated +@!@!@ENDMSG 1000 @!@!@ +@!@!@STARTMSG 2121:1 @!@!@ +The behavior up to this point is: +@!@!@ENDMSG 2121 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +1: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, b3, s1, s2, s3, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +2: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, s1, s2, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2103:1 @!@!@ +The error occurred when TLC was evaluating the nested +expressions at the following positions: +0. Line 108, column 5 to line 124, column 57 in replicated +1. Line 108, column 8 to line 108, column 27 in replicated +2. Line 109, column 8 to line 123, column 80 in replicated +3. Line 123, column 9 to line 123, column 80 in replicated +4. Line 123, column 29 to line 123, column 80 in replicated +5. Line 123, column 71 to line 123, column 79 in replicated +6. Line 121, column 22 to line 121, column 42 in replicated +7. Line 27, column 3 to line 27, column 36 in replicated +8. Line 27, column 16 to line 27, column 16 in replicated +9. Line 121, column 31 to line 121, column 41 in replicated +10. Line 120, column 24 to line 120, column 49 in replicated +11. Line 120, column 45 to line 120, column 48 in replicated +12. Line 113, column 13 to line 119, column 18 in replicated +13. Line 114, column 17 to line 116, column 32 in replicated +14. Line 116, column 17 to line 116, column 32 in replicated +15. Line 111, column 29 to line 111, column 62 in replicated +16. Line 111, column 35 to line 111, column 62 in replicated +17. Line 111, column 36 to line 111, column 40 in replicated + + +@!@!@ENDMSG 2103 @!@!@ +@!@!@STARTMSG 2201:0 @!@!@ +The coverage statistics at 2025-01-19 23:02:20 +@!@!@ENDMSG 2201 @!@!@ +@!@!@STARTMSG 2773:0 @!@!@ +: 2:2 +@!@!@ENDMSG 2773 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 46, col 5 to line 49, col 26 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 1:6 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 52, col 8 to line 55, col 44 of module replicated: 6 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 52, col 18 to line 55, col 44 of module replicated: 6 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 53, col 9 to line 55, col 44 of module replicated: 642 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 53, col 12 to line 53, col 48 of module replicated: 642 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 54, col 12 to line 54, col 44 of module replicated: 258 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 55, col 12 to line 55, col 44 of module replicated: 84 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 52, col 32 to line 52, col 48 of module replicated: 6 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 56, col 8 to line 56, col 67 of module replicated: 6 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 4:14 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 59, col 8 to line 59, col 32 of module replicated: 59 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 59, col 8 to line 59, col 15 of module replicated: 45:105 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 59, col 27 to line 59, col 32 of module replicated: 45 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 60, col 8 to line 60, col 14 of module replicated: 44 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 60, col 8 to line 60, col 9 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 60, col 13 to line 60, col 14 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 61, col 8 to line 61, col 72 of module replicated: 32 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 61, col 8 to line 61, col 38 of module replicated: 18 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 61, col 42 to line 61, col 72 of module replicated: 18 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 65, col 13 to line 67, col 50 of module replicated: 14 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 68, col 8 to line 68, col 58 of module replicated: 14 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 71, col 8 to line 71, col 32 of module replicated: 45 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 72, col 8 to line 72, col 72 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 73, col 8 to line 73, col 71 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 74, col 8 to line 74, col 102 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 75, col 8 to line 75, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 2:30 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 78, col 8 to line 78, col 30 of module replicated: 75 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 78, col 8 to line 78, col 13 of module replicated: 45:111 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 78, col 25 to line 78, col 30 of module replicated: 45 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 79, col 8 to line 86, col 52 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 87, col 8 to line 87, col 62 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 96, col 13 to line 98, col 37 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 99, col 8 to line 99, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 5:30 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 103, col 8 to line 103, col 29 of module replicated: 75 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 103, col 8 to line 103, col 12 of module replicated: 45:111 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 103, col 24 to line 103, col 29 of module replicated: 45 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 104, col 8 to line 104, col 81 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 105, col 8 to line 105, col 57 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 108, col 8 to line 108, col 27 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 123, col 9 to line 123, col 80 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 123, col 29 to line 123, col 80 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 123, col 30 to line 123, col 45 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 123, col 54 to line 123, col 79 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 123, col 71 to line 123, col 79 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 121, col 22 to line 121, col 42 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 27, col 3 to line 27, col 36 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 121, col 31 to line 121, col 41 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||line 120, col 24 to line 120, col 49 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||line 120, col 45 to line 120, col 48 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||line 113, col 13 to line 119, col 18 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||line 114, col 17 to line 116, col 32 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||||line 114, col 17 to line 114, col 37 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||||line 116, col 17 to line 116, col 32 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||||line 111, col 29 to line 111, col 62 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||||||line 111, col 35 to line 111, col 62 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||||||line 111, col 36 to line 111, col 40 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||||||line 111, col 50 to line 111, col 61 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |||||||||||||line 110, col 25 to line 110, col 90 of module replicated: 5:10 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||||||||line 110, col 26 to line 110, col 50 of module replicated: 15 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||||||||line 110, col 60 to line 110, col 88 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 124, col 8 to line 124, col 57 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 136, col 8 to line 136, col 109 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 137, col 8 to line 137, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2774:0 @!@!@ + +@!@!@ENDMSG 2774 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 159, col 13 to line 160, col 81 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 159, col 35 to line 160, col 81 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 160, col 9 to line 160, col 81 of module replicated: 39 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 159, col 44 to line 159, col 72 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 159, col 22 to line 159, col 32 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2774:0 @!@!@ + +@!@!@ENDMSG 2774 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 163, col 5 to line 165, col 88 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 163, col 47 to line 165, col 88 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 164, col 9 to line 165, col 88 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 164, col 12 to line 165, col 88 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 164, col 13 to line 164, col 85 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 165, col 16 to line 165, col 88 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 163, col 61 to line 163, col 83 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 163, col 21 to line 163, col 43 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2202:0 @!@!@ +End of statistics. +@!@!@ENDMSG 2202 @!@!@ +@!@!@STARTMSG 2200:0 @!@!@ +Progress(4) at 2025-01-19 23:02:20: 69 states generated (1.718 s/min), 13 distinct states found (323 ds/min), 9 states left on queue. +@!@!@ENDMSG 2200 @!@!@ +@!@!@STARTMSG 2199:0 @!@!@ +69 states generated, 13 distinct states found, 9 states left on queue. +@!@!@ENDMSG 2199 @!@!@ +@!@!@STARTMSG 2186:0 @!@!@ +Finished in 2426ms at (2025-01-19 23:02:20) +@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324141888/replicated.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324141888/replicated.tla new file mode 100644 index 0000000000..3862e7e0aa --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324141888/replicated.tla @@ -0,0 +1,180 @@ +---- MODULE replicated ---- + +EXTENDS Integers, FiniteSets + +VARIABLES broker_state, safekeeper_state, pageserver_state, online + + +CONSTANT + brokers, + safekeepers, + pageservers, + azs, + az_mapping + +CONSTANT + NULL + +CONSTANT + max_commit_lsn + +\* HELPERS + +Max(a,b) == IF a > b THEN a ELSE b + +(* The minimum of a non-empty set of integers *) +MinOfSet(S) == + CHOOSE x \in S: \A y \in S: x <= y + +\* END HELPERS + +StateConstraint == + /\ \A s \in safekeepers: + /\ safekeeper_state[s].commit_lsn <= max_commit_lsn + /\ \A b \in brokers: + /\ \A s \in DOMAIN broker_state[b].sk: + /\ broker_state[b].sk[s].commit_lsn <= max_commit_lsn + + + +InitSafekeeper == [prune_lsn |-> 0, commit_lsn |-> 0, rx |-> [b \in brokers |-> NULL] ] +InitBroker == [sk |-> [s \in safekeepers |-> [prune_lsn |-> 0, commit_lsn |-> 0]]] +InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] +InitOnline == safekeepers \cup brokers \cup pageservers + +Init == + /\ broker_state = [b \in brokers |-> InitBroker] + /\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper] + /\ pageserver_state = [p \in pageservers |-> InitPageserver] + /\ online = InitOnline + +NodeOnlineOffline == + /\ online' = CHOOSE ss \in SUBSET InitOnline: + /\ Cardinality(ss \cap safekeepers) >= 2 + /\ Cardinality(ss \cap brokers) >= 2 + /\ ss \cap pageservers = pageservers \* assume no PS failures for now + /\ UNCHANGED <> + +SkCommit(s1, s2) == + /\ {s1, s2} \subseteq online + /\ s1 # s2 + /\ safekeeper_state[s1].commit_lsn = safekeeper_state[s2].commit_lsn + /\ LET + new_commit_lsn == safekeeper_state[s1].commit_lsn + 1 + IN + safekeeper_state' = [safekeeper_state EXCEPT + ![s1].commit_lsn = new_commit_lsn, + ![s2].commit_lsn = new_commit_lsn] + /\ UNCHANGED <> + +SkPeerRecovery(s1,s2) == + /\ {s1, s2} \subseteq online + /\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn \* s2 has more WAL than s1 + /\ safekeeper_state[s2].prune_lsn < safekeeper_state[s1].commit_lsn \* s2 has not yet trimmed the WAL the WAL + /\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn] + /\ UNCHANGED <> + +SkPushToBroker(s,b) == + /\ {s, b} \subseteq online + /\ broker_state' = LET + broker_side == broker_state[b].sk[s] + sk_side == safekeeper_state[s] + merged == [broker_side EXCEPT + !["commit_lsn"] = Max(broker_side.commit_lsn, sk_side.commit_lsn), + !["prune_lsn"] = Max(broker_side.prune_lsn, sk_side.prune_lsn)] + IN + [broker_state EXCEPT ![b].sk[s] = merged] + /\ UNCHANGED <> + +PsRecvBroker(b,p,s) == + /\ {b,p,s} \subseteq online + /\ LET + bsk == broker_state[b].sk[s] + psk == pageserver_state[p].sk[s] + updpsk == [psk EXCEPT !["commit_lsn"] = bsk.commit_lsn] + IN + pageserver_state' = IF bsk.commit_lsn > psk.commit_lsn + THEN [pageserver_state EXCEPT ![p].sk[s] = updpsk] + ELSE pageserver_state + /\ UNCHANGED <> + + +SkRecvBroker(b,s) == + /\ {b,s} \subseteq online + /\ safekeeper_state' = [safekeeper_state EXCEPT ![s].rx[b] = broker_state[b]] + /\ UNCHANGED <> + +SkPrune(s) == + /\ {s} \subseteq online + /\ LET + broker_infos == {safekeeper_state[s].rx[b]: b \in (DOMAIN safekeeper_state[s].rx)} + broker_infos_sks == UNION {bi.sk: bi \in broker_infos} + info == + ( + {safekeeper_state[s]} + \cup + broker_infos_sks + ) + \ + {NULL} + commit_lsns == {i.commit_lsn: i \in info} + prune_lsn == MinOfSet(commit_lsns) + IN + safekeeper_state' = [safekeeper_state EXCEPT ![s].prune_lsn = prune_lsn] + /\ UNCHANGED <> + + +SksWithNewerWal(p) == + LET + ps == pageserver_state[p] + IN + {s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn} + +PsChooseSk(p) == + /\ {p} \subseteq online + /\ SksWithNewerWal(p) # {} + /\ pageserver_state' = [pageserver_state EXCEPT![p].preferred_sk = CHOOSE s \in SksWithNewerWal(p): TRUE] + /\ UNCHANGED <> + + +Next == + \/ NodeOnlineOffline + \/ \E s1 \in safekeepers: \E s2 \in safekeepers: + \/ SkCommit(s1, s2) + \/ SkPeerRecovery(s1, s2) + \/ \E s \in safekeepers: \E b \in brokers: + \/ SkPushToBroker(s, b) + \/ SkRecvBroker(b, s) + \/ \E s \in safekeepers: + \/ SkPrune(s) + \/ \E s \in safekeepers: \E b \in brokers: \E p \in pageservers: PsRecvBroker(b,p,s) + \/ \E p \in pageservers: PsChooseSk(p) + + +Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state,online>> + + +\* invariants + +PsLagsSk == \A p \in pageservers: \A s \in DOMAIN pageserver_state[p].sk: + /\ pageserver_state[p].sk[s].commit_lsn <= safekeeper_state[s].commit_lsn + +PeerRecoveryIsPossible == + \A laggard \in (safekeepers \cap online): \E donor \in (safekeepers \cap online): + /\ (safekeeper_state[laggard].commit_lsn < safekeeper_state[donor].commit_lsn) + => safekeeper_state[donor].prune_lsn <= safekeeper_state[laggard].commit_lsn + + +EventuallyLaggingSkIsNotPreferredSk == <>( + LET + sks == safekeeper_state + lagging_sks == { s \in safekeepers: \A s2 \in safekeepers: sks[s].commit_lsn <= sks[s2].commit_lsn } + preferred_sks == {pageserver_state[p].preferred_sk: p \in pageservers} + IN + preferred_sks \cap lagging_sks = {} + + ) + + + +==== \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308355472/MC.cfg b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324186169/MC.cfg similarity index 66% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308355472/MC.cfg rename to storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324186169/MC.cfg index 8159238beb..9e51a20b42 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308355472/MC.cfg +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324186169/MC.cfg @@ -18,36 +18,37 @@ az2 = az2 az3 = az3 \* MV CONSTANT definitions CONSTANT -brokers <- const_1737308284086143000 +brokers <- const_1737324182115316000 \* CONSTANT declarations CONSTANT NULL = NULL \* MV CONSTANT definitions CONSTANT -safekeepers <- const_1737308284086144000 +safekeepers <- const_1737324182115317000 \* MV CONSTANT definitions CONSTANT -pageservers <- const_1737308284086145000 +pageservers <- const_1737324182115318000 \* MV CONSTANT definitions CONSTANT -azs <- const_1737308284086146000 +azs <- const_1737324182115319000 \* SYMMETRY definition -SYMMETRY symm_1737308284086147000 +SYMMETRY symm_1737324182115320000 \* CONSTANT definitions CONSTANT -max_commit_lsn <- const_1737308284086148000 +max_commit_lsn <- const_1737324182115321000 \* CONSTANT definitions CONSTANT -az_mapping <- const_1737308284086149000 +az_mapping <- const_1737324182115322000 \* CONSTRAINT definition CONSTRAINT -constr_1737308284086150000 +constr_1737324182115323000 \* SPECIFICATION definition SPECIFICATION Spec \* INVARIANT definition INVARIANT PsLagsSk +PeerRecoveryIsPossible \* PROPERTY definition PROPERTY EventuallyLaggingSkIsNotPreferredSk -\* Generated on Sun Jan 19 18:38:04 CET 2025 \ No newline at end of file +\* Generated on Sun Jan 19 23:03:02 CET 2025 \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324186169/MC.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324186169/MC.out new file mode 100644 index 0000000000..a056909998 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324186169/MC.out @@ -0,0 +1,442 @@ +@!@!@STARTMSG 2262:0 @!@!@ +TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) +@!@!@ENDMSG 2262 @!@!@ +@!@!@STARTMSG 2187:0 @!@!@ +Running breadth-first search Model-Checking with fp 58 and seed 2509155719358048991 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 23239] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +@!@!@ENDMSG 2187 @!@!@ +@!@!@STARTMSG 2220:0 @!@!@ +Starting SANY... +@!@!@ENDMSG 2220 @!@!@ +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla +Semantic processing of module Naturals +Semantic processing of module Integers +Semantic processing of module Sequences +Semantic processing of module FiniteSets +Semantic processing of module replicated +Semantic processing of module TLC +Semantic processing of module MC +@!@!@STARTMSG 2219:0 @!@!@ +SANY finished. +@!@!@ENDMSG 2219 @!@!@ +@!@!@STARTMSG 2185:0 @!@!@ +Starting... (2025-01-19 23:03:03) +@!@!@ENDMSG 2185 @!@!@ +@!@!@STARTMSG 2279:3 @!@!@ +Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. +@!@!@ENDMSG 2279 @!@!@ +@!@!@STARTMSG 2284:3 @!@!@ +Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. +@!@!@ENDMSG 2284 @!@!@ +@!@!@STARTMSG 2212:0 @!@!@ +Implied-temporal checking--satisfiability problem has 1 branches. +@!@!@ENDMSG 2212 @!@!@ +@!@!@STARTMSG 2189:0 @!@!@ +Computing initial states... +@!@!@ENDMSG 2189 @!@!@ +@!@!@STARTMSG 2190:0 @!@!@ +Finished computing initial states: 1 distinct state generated at 2025-01-19 23:03:04. +@!@!@ENDMSG 2190 @!@!@ +@!@!@STARTMSG 1000:1 @!@!@ +TLC threw an unexpected exception. +This was probably caused by an error in the spec or model. +See the User Output or TLC Console for clues to what happened. +The exception was a java.lang.RuntimeException +: Attempted to enumerate UNION(s), but some element of s is nonenumerable. +@!@!@ENDMSG 1000 @!@!@ +@!@!@STARTMSG 2121:1 @!@!@ +The behavior up to this point is: +@!@!@ENDMSG 2121 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +1: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, b3, s1, s2, s3, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +2: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, s1, s2, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +3: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, s1, s2, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 1, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 1, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +4: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, s1, s2, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 1, prune_lsn |-> 0, rx |-> (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 1, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2147:1 @!@!@ +TLC was unable to fingerprint. + +Fingerprint Stack Trace: +2) line 111, col 29 to line 111, col 74 of module replicated +1) line 114, col 17 to line 116, col 32 of module replicated +0) line 113, col 13 to line 119, col 18 of module replicated + +Reason: +Attempted to enumerate UNION(s), but some element of s is nonenumerable. +@!@!@ENDMSG 2147 @!@!@ +@!@!@STARTMSG 2201:0 @!@!@ +The coverage statistics at 2025-01-19 23:03:04 +@!@!@ENDMSG 2201 @!@!@ +@!@!@STARTMSG 2773:0 @!@!@ +: 2:2 +@!@!@ENDMSG 2773 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 46, col 5 to line 49, col 26 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 1:15 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 52, col 8 to line 55, col 44 of module replicated: 15 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 52, col 18 to line 55, col 44 of module replicated: 15 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 53, col 9 to line 55, col 44 of module replicated: 1605 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 53, col 12 to line 53, col 48 of module replicated: 1605 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 54, col 12 to line 54, col 44 of module replicated: 645 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 55, col 12 to line 55, col 44 of module replicated: 210 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 52, col 32 to line 52, col 48 of module replicated: 15 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 56, col 8 to line 56, col 67 of module replicated: 15 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 6:31 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 59, col 8 to line 59, col 32 of module replicated: 150 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 59, col 8 to line 59, col 15 of module replicated: 119:277 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 59, col 27 to line 59, col 32 of module replicated: 119 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 60, col 8 to line 60, col 14 of module replicated: 110 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 60, col 8 to line 60, col 9 of module replicated: 79 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 60, col 13 to line 60, col 14 of module replicated: 79 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 61, col 8 to line 61, col 72 of module replicated: 78 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 61, col 8 to line 61, col 38 of module replicated: 47 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 61, col 42 to line 61, col 72 of module replicated: 47 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 65, col 13 to line 67, col 50 of module replicated: 31 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 68, col 8 to line 68, col 58 of module replicated: 31 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 71, col 8 to line 71, col 32 of module replicated: 118 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 72, col 8 to line 72, col 72 of module replicated: 78 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 73, col 8 to line 73, col 71 of module replicated: 8 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 74, col 8 to line 74, col 102 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 75, col 8 to line 75, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 16:74 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 78, col 8 to line 78, col 30 of module replicated: 183 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 78, col 8 to line 78, col 13 of module replicated: 109:271 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 78, col 25 to line 78, col 30 of module replicated: 109 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 79, col 8 to line 86, col 52 of module replicated: 74 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 87, col 8 to line 87, col 62 of module replicated: 74 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 2:52 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 90, col 8 to line 90, col 31 of module replicated: 124 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 90, col 8 to line 90, col 14 of module replicated: 72:236 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 90, col 26 to line 90, col 31 of module replicated: 72 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 96, col 13 to line 98, col 37 of module replicated: 52 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 96, col 33 to line 98, col 37 of module replicated: 52 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 96, col 36 to line 96, col 66 of module replicated: 52 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 97, col 22 to line 97, col 66 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 98, col 22 to line 98, col 37 of module replicated: 50 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 99, col 8 to line 99, col 58 of module replicated: 52 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 27:74 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 103, col 8 to line 103, col 29 of module replicated: 183 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 103, col 8 to line 103, col 12 of module replicated: 109:271 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 103, col 24 to line 103, col 29 of module replicated: 109 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 104, col 8 to line 104, col 81 of module replicated: 74 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 105, col 8 to line 105, col 57 of module replicated: 74 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 8:20 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 108, col 8 to line 108, col 27 of module replicated: 48 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 108, col 8 to line 108, col 10 of module replicated: 28:52 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 108, col 22 to line 108, col 27 of module replicated: 28 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 123, col 9 to line 123, col 80 of module replicated: 20 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 123, col 29 to line 123, col 80 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 123, col 30 to line 123, col 45 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 123, col 54 to line 123, col 79 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 123, col 71 to line 123, col 79 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 121, col 22 to line 121, col 42 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 27, col 3 to line 27, col 36 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||line 27, col 19 to line 27, col 36 of module replicated: 20 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||line 27, col 16 to line 27, col 16 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 121, col 31 to line 121, col 41 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |||||line 120, col 24 to line 120, col 49 of module replicated: 24:60 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||line 120, col 25 to line 120, col 36 of module replicated: 20 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||line 120, col 45 to line 120, col 48 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||line 113, col 13 to line 119, col 18 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||line 114, col 17 to line 116, col 32 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||||line 114, col 17 to line 114, col 37 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||||line 116, col 17 to line 116, col 32 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||||line 111, col 29 to line 111, col 74 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |||||||||||line 111, col 35 to line 111, col 74 of module replicated: 24:24 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||||||line 111, col 36 to line 111, col 40 of module replicated: 4 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||||||line 111, col 51 to line 111, col 71 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||||||||line 111, col 51 to line 111, col 62 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + ||||||||||||||line 110, col 25 to line 110, col 90 of module replicated: 24:28 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||||||||||line 110, col 26 to line 110, col 50 of module replicated: 72 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||||||||||line 110, col 60 to line 110, col 88 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||||||||line 111, col 66 to line 111, col 71 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||line 119, col 13 to line 119, col 18 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 124, col 8 to line 124, col 57 of module replicated: 20 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 134, col 8 to line 134, col 27 of module replicated: 8 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 135, col 8 to line 135, col 30 of module replicated: 8 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 135, col 8 to line 135, col 25 of module replicated: 8 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 129, col 15 to line 129, col 33 of module replicated: 8 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 131, col 5 to line 131, col 66 of module replicated: 8 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 131, col 26 to line 131, col 65 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 131, col 12 to line 131, col 23 of module replicated: 8 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 135, col 24 to line 135, col 24 of module replicated: 8 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 135, col 29 to line 135, col 30 of module replicated: 8 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 136, col 8 to line 136, col 109 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 137, col 8 to line 137, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2774:0 @!@!@ + +@!@!@ENDMSG 2774 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 159, col 13 to line 160, col 81 of module replicated: 65 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 159, col 35 to line 160, col 81 of module replicated: 65 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 160, col 9 to line 160, col 81 of module replicated: 195 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 159, col 44 to line 159, col 72 of module replicated: 65 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 159, col 22 to line 159, col 32 of module replicated: 65 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2774:0 @!@!@ + +@!@!@ENDMSG 2774 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 163, col 5 to line 165, col 88 of module replicated: 65 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 163, col 47 to line 165, col 88 of module replicated: 164 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 164, col 9 to line 165, col 88 of module replicated: 167 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 164, col 12 to line 165, col 88 of module replicated: 167 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 164, col 13 to line 164, col 85 of module replicated: 167 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 165, col 16 to line 165, col 88 of module replicated: 35 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 163, col 61 to line 163, col 83 of module replicated: 164 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 163, col 21 to line 163, col 43 of module replicated: 65 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2202:0 @!@!@ +End of statistics. +@!@!@ENDMSG 2202 @!@!@ +@!@!@STARTMSG 2200:0 @!@!@ +Progress(5) at 2025-01-19 23:03:04: 248 states generated (5.740 s/min), 61 distinct states found (1.412 ds/min), 50 states left on queue. +@!@!@ENDMSG 2200 @!@!@ +@!@!@STARTMSG 2199:0 @!@!@ +248 states generated, 61 distinct states found, 50 states left on queue. +@!@!@ENDMSG 2199 @!@!@ +@!@!@STARTMSG 2186:0 @!@!@ +Finished in 2611ms at (2025-01-19 23:03:04) +@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308216766/MC.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324186169/MC.tla similarity index 67% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308216766/MC.tla rename to storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324186169/MC.tla index 060f5935bc..df3a585d29 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308216766/MC.tla +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324186169/MC.tla @@ -22,44 +22,44 @@ az1, az2, az3 ---- \* MV CONSTANT definitions brokers -const_1737308198937133000 == +const_1737324182115316000 == {b1, b2, b3} ---- \* MV CONSTANT definitions safekeepers -const_1737308198937134000 == +const_1737324182115317000 == {s1, s2, s3} ---- \* MV CONSTANT definitions pageservers -const_1737308198937135000 == +const_1737324182115318000 == {p1} ---- \* MV CONSTANT definitions azs -const_1737308198937136000 == +const_1737324182115319000 == {az1, az2, az3} ---- \* SYMMETRY definition -symm_1737308198937137000 == -Permutations(const_1737308198937133000) \union Permutations(const_1737308198937134000) \union Permutations(const_1737308198937135000) \union Permutations(const_1737308198937136000) +symm_1737324182115320000 == +Permutations(const_1737324182115316000) \union Permutations(const_1737324182115317000) \union Permutations(const_1737324182115318000) \union Permutations(const_1737324182115319000) ---- \* CONSTANT definitions @modelParameterConstants:4max_commit_lsn -const_1737308198937138000 == +const_1737324182115321000 == 2 ---- \* CONSTANT definitions @modelParameterConstants:5az_mapping -const_1737308198937139000 == +const_1737324182115322000 == [ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2} , az3 |-> {b3,s3}] ---- \* CONSTRAINT definition @modelParameterContraint:0 -constr_1737308198937140000 == +constr_1737324182115323000 == StateConstraint ---- ============================================================================= \* Modification History -\* Created Sun Jan 19 18:36:38 CET 2025 by cs +\* Created Sun Jan 19 23:03:02 CET 2025 by cs diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324186169/MC_TE.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324186169/MC_TE.out new file mode 100644 index 0000000000..a056909998 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324186169/MC_TE.out @@ -0,0 +1,442 @@ +@!@!@STARTMSG 2262:0 @!@!@ +TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) +@!@!@ENDMSG 2262 @!@!@ +@!@!@STARTMSG 2187:0 @!@!@ +Running breadth-first search Model-Checking with fp 58 and seed 2509155719358048991 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 23239] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +@!@!@ENDMSG 2187 @!@!@ +@!@!@STARTMSG 2220:0 @!@!@ +Starting SANY... +@!@!@ENDMSG 2220 @!@!@ +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla +Semantic processing of module Naturals +Semantic processing of module Integers +Semantic processing of module Sequences +Semantic processing of module FiniteSets +Semantic processing of module replicated +Semantic processing of module TLC +Semantic processing of module MC +@!@!@STARTMSG 2219:0 @!@!@ +SANY finished. +@!@!@ENDMSG 2219 @!@!@ +@!@!@STARTMSG 2185:0 @!@!@ +Starting... (2025-01-19 23:03:03) +@!@!@ENDMSG 2185 @!@!@ +@!@!@STARTMSG 2279:3 @!@!@ +Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. +@!@!@ENDMSG 2279 @!@!@ +@!@!@STARTMSG 2284:3 @!@!@ +Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. +@!@!@ENDMSG 2284 @!@!@ +@!@!@STARTMSG 2212:0 @!@!@ +Implied-temporal checking--satisfiability problem has 1 branches. +@!@!@ENDMSG 2212 @!@!@ +@!@!@STARTMSG 2189:0 @!@!@ +Computing initial states... +@!@!@ENDMSG 2189 @!@!@ +@!@!@STARTMSG 2190:0 @!@!@ +Finished computing initial states: 1 distinct state generated at 2025-01-19 23:03:04. +@!@!@ENDMSG 2190 @!@!@ +@!@!@STARTMSG 1000:1 @!@!@ +TLC threw an unexpected exception. +This was probably caused by an error in the spec or model. +See the User Output or TLC Console for clues to what happened. +The exception was a java.lang.RuntimeException +: Attempted to enumerate UNION(s), but some element of s is nonenumerable. +@!@!@ENDMSG 1000 @!@!@ +@!@!@STARTMSG 2121:1 @!@!@ +The behavior up to this point is: +@!@!@ENDMSG 2121 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +1: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, b3, s1, s2, s3, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +2: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, s1, s2, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +3: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, s1, s2, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 1, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 1, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +4: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, s1, s2, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 1, prune_lsn |-> 0, rx |-> (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 1, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2147:1 @!@!@ +TLC was unable to fingerprint. + +Fingerprint Stack Trace: +2) line 111, col 29 to line 111, col 74 of module replicated +1) line 114, col 17 to line 116, col 32 of module replicated +0) line 113, col 13 to line 119, col 18 of module replicated + +Reason: +Attempted to enumerate UNION(s), but some element of s is nonenumerable. +@!@!@ENDMSG 2147 @!@!@ +@!@!@STARTMSG 2201:0 @!@!@ +The coverage statistics at 2025-01-19 23:03:04 +@!@!@ENDMSG 2201 @!@!@ +@!@!@STARTMSG 2773:0 @!@!@ +: 2:2 +@!@!@ENDMSG 2773 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 46, col 5 to line 49, col 26 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 1:15 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 52, col 8 to line 55, col 44 of module replicated: 15 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 52, col 18 to line 55, col 44 of module replicated: 15 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 53, col 9 to line 55, col 44 of module replicated: 1605 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 53, col 12 to line 53, col 48 of module replicated: 1605 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 54, col 12 to line 54, col 44 of module replicated: 645 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 55, col 12 to line 55, col 44 of module replicated: 210 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 52, col 32 to line 52, col 48 of module replicated: 15 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 56, col 8 to line 56, col 67 of module replicated: 15 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 6:31 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 59, col 8 to line 59, col 32 of module replicated: 150 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 59, col 8 to line 59, col 15 of module replicated: 119:277 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 59, col 27 to line 59, col 32 of module replicated: 119 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 60, col 8 to line 60, col 14 of module replicated: 110 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 60, col 8 to line 60, col 9 of module replicated: 79 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 60, col 13 to line 60, col 14 of module replicated: 79 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 61, col 8 to line 61, col 72 of module replicated: 78 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 61, col 8 to line 61, col 38 of module replicated: 47 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 61, col 42 to line 61, col 72 of module replicated: 47 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 65, col 13 to line 67, col 50 of module replicated: 31 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 68, col 8 to line 68, col 58 of module replicated: 31 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 71, col 8 to line 71, col 32 of module replicated: 118 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 72, col 8 to line 72, col 72 of module replicated: 78 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 73, col 8 to line 73, col 71 of module replicated: 8 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 74, col 8 to line 74, col 102 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 75, col 8 to line 75, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 16:74 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 78, col 8 to line 78, col 30 of module replicated: 183 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 78, col 8 to line 78, col 13 of module replicated: 109:271 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 78, col 25 to line 78, col 30 of module replicated: 109 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 79, col 8 to line 86, col 52 of module replicated: 74 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 87, col 8 to line 87, col 62 of module replicated: 74 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 2:52 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 90, col 8 to line 90, col 31 of module replicated: 124 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 90, col 8 to line 90, col 14 of module replicated: 72:236 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 90, col 26 to line 90, col 31 of module replicated: 72 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 96, col 13 to line 98, col 37 of module replicated: 52 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 96, col 33 to line 98, col 37 of module replicated: 52 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 96, col 36 to line 96, col 66 of module replicated: 52 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 97, col 22 to line 97, col 66 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 98, col 22 to line 98, col 37 of module replicated: 50 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 99, col 8 to line 99, col 58 of module replicated: 52 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 27:74 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 103, col 8 to line 103, col 29 of module replicated: 183 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 103, col 8 to line 103, col 12 of module replicated: 109:271 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 103, col 24 to line 103, col 29 of module replicated: 109 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 104, col 8 to line 104, col 81 of module replicated: 74 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 105, col 8 to line 105, col 57 of module replicated: 74 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 8:20 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 108, col 8 to line 108, col 27 of module replicated: 48 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 108, col 8 to line 108, col 10 of module replicated: 28:52 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 108, col 22 to line 108, col 27 of module replicated: 28 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 123, col 9 to line 123, col 80 of module replicated: 20 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 123, col 29 to line 123, col 80 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 123, col 30 to line 123, col 45 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 123, col 54 to line 123, col 79 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 123, col 71 to line 123, col 79 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 121, col 22 to line 121, col 42 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 27, col 3 to line 27, col 36 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||line 27, col 19 to line 27, col 36 of module replicated: 20 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||line 27, col 16 to line 27, col 16 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 121, col 31 to line 121, col 41 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |||||line 120, col 24 to line 120, col 49 of module replicated: 24:60 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||line 120, col 25 to line 120, col 36 of module replicated: 20 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||line 120, col 45 to line 120, col 48 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||line 113, col 13 to line 119, col 18 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||line 114, col 17 to line 116, col 32 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||||line 114, col 17 to line 114, col 37 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||||line 116, col 17 to line 116, col 32 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||||line 111, col 29 to line 111, col 74 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |||||||||||line 111, col 35 to line 111, col 74 of module replicated: 24:24 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||||||line 111, col 36 to line 111, col 40 of module replicated: 4 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||||||line 111, col 51 to line 111, col 71 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||||||||line 111, col 51 to line 111, col 62 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + ||||||||||||||line 110, col 25 to line 110, col 90 of module replicated: 24:28 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||||||||||line 110, col 26 to line 110, col 50 of module replicated: 72 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||||||||||line 110, col 60 to line 110, col 88 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||||||||line 111, col 66 to line 111, col 71 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||line 119, col 13 to line 119, col 18 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 124, col 8 to line 124, col 57 of module replicated: 20 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 134, col 8 to line 134, col 27 of module replicated: 8 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 135, col 8 to line 135, col 30 of module replicated: 8 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 135, col 8 to line 135, col 25 of module replicated: 8 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 129, col 15 to line 129, col 33 of module replicated: 8 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 131, col 5 to line 131, col 66 of module replicated: 8 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 131, col 26 to line 131, col 65 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 131, col 12 to line 131, col 23 of module replicated: 8 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 135, col 24 to line 135, col 24 of module replicated: 8 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 135, col 29 to line 135, col 30 of module replicated: 8 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 136, col 8 to line 136, col 109 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 137, col 8 to line 137, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2774:0 @!@!@ + +@!@!@ENDMSG 2774 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 159, col 13 to line 160, col 81 of module replicated: 65 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 159, col 35 to line 160, col 81 of module replicated: 65 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 160, col 9 to line 160, col 81 of module replicated: 195 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 159, col 44 to line 159, col 72 of module replicated: 65 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 159, col 22 to line 159, col 32 of module replicated: 65 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2774:0 @!@!@ + +@!@!@ENDMSG 2774 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 163, col 5 to line 165, col 88 of module replicated: 65 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 163, col 47 to line 165, col 88 of module replicated: 164 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 164, col 9 to line 165, col 88 of module replicated: 167 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 164, col 12 to line 165, col 88 of module replicated: 167 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 164, col 13 to line 164, col 85 of module replicated: 167 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 165, col 16 to line 165, col 88 of module replicated: 35 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 163, col 61 to line 163, col 83 of module replicated: 164 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 163, col 21 to line 163, col 43 of module replicated: 65 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2202:0 @!@!@ +End of statistics. +@!@!@ENDMSG 2202 @!@!@ +@!@!@STARTMSG 2200:0 @!@!@ +Progress(5) at 2025-01-19 23:03:04: 248 states generated (5.740 s/min), 61 distinct states found (1.412 ds/min), 50 states left on queue. +@!@!@ENDMSG 2200 @!@!@ +@!@!@STARTMSG 2199:0 @!@!@ +248 states generated, 61 distinct states found, 50 states left on queue. +@!@!@ENDMSG 2199 @!@!@ +@!@!@STARTMSG 2186:0 @!@!@ +Finished in 2611ms at (2025-01-19 23:03:04) +@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324186169/replicated.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324186169/replicated.tla new file mode 100644 index 0000000000..88031dae56 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324186169/replicated.tla @@ -0,0 +1,180 @@ +---- MODULE replicated ---- + +EXTENDS Integers, FiniteSets + +VARIABLES broker_state, safekeeper_state, pageserver_state, online + + +CONSTANT + brokers, + safekeepers, + pageservers, + azs, + az_mapping + +CONSTANT + NULL + +CONSTANT + max_commit_lsn + +\* HELPERS + +Max(a,b) == IF a > b THEN a ELSE b + +(* The minimum of a non-empty set of integers *) +MinOfSet(S) == + CHOOSE x \in S: \A y \in S: x <= y + +\* END HELPERS + +StateConstraint == + /\ \A s \in safekeepers: + /\ safekeeper_state[s].commit_lsn <= max_commit_lsn + /\ \A b \in brokers: + /\ \A s \in DOMAIN broker_state[b].sk: + /\ broker_state[b].sk[s].commit_lsn <= max_commit_lsn + + + +InitSafekeeper == [prune_lsn |-> 0, commit_lsn |-> 0, rx |-> [b \in brokers |-> NULL] ] +InitBroker == [sk |-> [s \in safekeepers |-> [prune_lsn |-> 0, commit_lsn |-> 0]]] +InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] +InitOnline == safekeepers \cup brokers \cup pageservers + +Init == + /\ broker_state = [b \in brokers |-> InitBroker] + /\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper] + /\ pageserver_state = [p \in pageservers |-> InitPageserver] + /\ online = InitOnline + +NodeOnlineOffline == + /\ online' = CHOOSE ss \in SUBSET InitOnline: + /\ Cardinality(ss \cap safekeepers) >= 2 + /\ Cardinality(ss \cap brokers) >= 2 + /\ ss \cap pageservers = pageservers \* assume no PS failures for now + /\ UNCHANGED <> + +SkCommit(s1, s2) == + /\ {s1, s2} \subseteq online + /\ s1 # s2 + /\ safekeeper_state[s1].commit_lsn = safekeeper_state[s2].commit_lsn + /\ LET + new_commit_lsn == safekeeper_state[s1].commit_lsn + 1 + IN + safekeeper_state' = [safekeeper_state EXCEPT + ![s1].commit_lsn = new_commit_lsn, + ![s2].commit_lsn = new_commit_lsn] + /\ UNCHANGED <> + +SkPeerRecovery(s1,s2) == + /\ {s1, s2} \subseteq online + /\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn \* s2 has more WAL than s1 + /\ safekeeper_state[s2].prune_lsn < safekeeper_state[s1].commit_lsn \* s2 has not yet trimmed the WAL the WAL + /\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn] + /\ UNCHANGED <> + +SkPushToBroker(s,b) == + /\ {s, b} \subseteq online + /\ broker_state' = LET + broker_side == broker_state[b].sk[s] + sk_side == safekeeper_state[s] + merged == [broker_side EXCEPT + !["commit_lsn"] = Max(broker_side.commit_lsn, sk_side.commit_lsn), + !["prune_lsn"] = Max(broker_side.prune_lsn, sk_side.prune_lsn)] + IN + [broker_state EXCEPT ![b].sk[s] = merged] + /\ UNCHANGED <> + +PsRecvBroker(b,p,s) == + /\ {b,p,s} \subseteq online + /\ LET + bsk == broker_state[b].sk[s] + psk == pageserver_state[p].sk[s] + updpsk == [psk EXCEPT !["commit_lsn"] = bsk.commit_lsn] + IN + pageserver_state' = IF bsk.commit_lsn > psk.commit_lsn + THEN [pageserver_state EXCEPT ![p].sk[s] = updpsk] + ELSE pageserver_state + /\ UNCHANGED <> + + +SkRecvBroker(b,s) == + /\ {b,s} \subseteq online + /\ safekeeper_state' = [safekeeper_state EXCEPT ![s].rx[b] = broker_state[b]] + /\ UNCHANGED <> + +SkPrune(s) == + /\ {s} \subseteq online + /\ LET + broker_infos == {safekeeper_state[s].rx[b]: b \in (DOMAIN safekeeper_state[s].rx)} + broker_infos_sks == UNION {bi.sk: bi \in (broker_infos \ {NULL}) } + info == + ( + {safekeeper_state[s]} + \cup + broker_infos_sks + ) + \ + {NULL} + commit_lsns == {i.commit_lsn: i \in info} + prune_lsn == MinOfSet(commit_lsns) + IN + safekeeper_state' = [safekeeper_state EXCEPT ![s].prune_lsn = prune_lsn] + /\ UNCHANGED <> + + +SksWithNewerWal(p) == + LET + ps == pageserver_state[p] + IN + {s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn} + +PsChooseSk(p) == + /\ {p} \subseteq online + /\ SksWithNewerWal(p) # {} + /\ pageserver_state' = [pageserver_state EXCEPT![p].preferred_sk = CHOOSE s \in SksWithNewerWal(p): TRUE] + /\ UNCHANGED <> + + +Next == + \/ NodeOnlineOffline + \/ \E s1 \in safekeepers: \E s2 \in safekeepers: + \/ SkCommit(s1, s2) + \/ SkPeerRecovery(s1, s2) + \/ \E s \in safekeepers: \E b \in brokers: + \/ SkPushToBroker(s, b) + \/ SkRecvBroker(b, s) + \/ \E s \in safekeepers: + \/ SkPrune(s) + \/ \E s \in safekeepers: \E b \in brokers: \E p \in pageservers: PsRecvBroker(b,p,s) + \/ \E p \in pageservers: PsChooseSk(p) + + +Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state,online>> + + +\* invariants + +PsLagsSk == \A p \in pageservers: \A s \in DOMAIN pageserver_state[p].sk: + /\ pageserver_state[p].sk[s].commit_lsn <= safekeeper_state[s].commit_lsn + +PeerRecoveryIsPossible == + \A laggard \in (safekeepers \cap online): \E donor \in (safekeepers \cap online): + /\ (safekeeper_state[laggard].commit_lsn < safekeeper_state[donor].commit_lsn) + => safekeeper_state[donor].prune_lsn <= safekeeper_state[laggard].commit_lsn + + +EventuallyLaggingSkIsNotPreferredSk == <>( + LET + sks == safekeeper_state + lagging_sks == { s \in safekeepers: \A s2 \in safekeepers: sks[s].commit_lsn <= sks[s2].commit_lsn } + preferred_sks == {pageserver_state[p].preferred_sk: p \in pageservers} + IN + preferred_sks \cap lagging_sks = {} + + ) + + + +==== \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324315582/MC.cfg b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324315582/MC.cfg new file mode 100644 index 0000000000..17312b22c7 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324315582/MC.cfg @@ -0,0 +1,54 @@ +\* MV CONSTANT declarations +CONSTANTS +b1 = b1 +b2 = b2 +b3 = b3 +\* MV CONSTANT declarations +CONSTANTS +s1 = s1 +s2 = s2 +s3 = s3 +\* MV CONSTANT declarations +CONSTANTS +p1 = p1 +\* MV CONSTANT declarations +CONSTANTS +az1 = az1 +az2 = az2 +az3 = az3 +\* MV CONSTANT definitions +CONSTANT +brokers <- const_1737324311514327000 +\* CONSTANT declarations +CONSTANT NULL = NULL +\* MV CONSTANT definitions +CONSTANT +safekeepers <- const_1737324311514328000 +\* MV CONSTANT definitions +CONSTANT +pageservers <- const_1737324311514329000 +\* MV CONSTANT definitions +CONSTANT +azs <- const_1737324311514330000 +\* SYMMETRY definition +SYMMETRY symm_1737324311514331000 +\* CONSTANT definitions +CONSTANT +max_commit_lsn <- const_1737324311514332000 +\* CONSTANT definitions +CONSTANT +az_mapping <- const_1737324311514333000 +\* CONSTRAINT definition +CONSTRAINT +constr_1737324311514334000 +\* SPECIFICATION definition +SPECIFICATION +Spec +\* INVARIANT definition +INVARIANT +PsLagsSk +PeerRecoveryIsPossible +\* PROPERTY definition +PROPERTY +EventuallyLaggingSkIsNotPreferredSk +\* Generated on Sun Jan 19 23:05:11 CET 2025 \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324315582/MC.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324315582/MC.out new file mode 100644 index 0000000000..03d45e4f9c --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324315582/MC.out @@ -0,0 +1,324 @@ +@!@!@STARTMSG 2262:0 @!@!@ +TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) +@!@!@ENDMSG 2262 @!@!@ +@!@!@STARTMSG 2187:0 @!@!@ +Running breadth-first search Model-Checking with fp 120 and seed -4351583933909868251 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 23327] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +@!@!@ENDMSG 2187 @!@!@ +@!@!@STARTMSG 2220:0 @!@!@ +Starting SANY... +@!@!@ENDMSG 2220 @!@!@ +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla +Semantic processing of module Naturals +Semantic processing of module Integers +Semantic processing of module Sequences +Semantic processing of module FiniteSets +Semantic processing of module replicated +Semantic processing of module TLC +Semantic processing of module MC +@!@!@STARTMSG 2219:0 @!@!@ +SANY finished. +@!@!@ENDMSG 2219 @!@!@ +@!@!@STARTMSG 2185:0 @!@!@ +Starting... (2025-01-19 23:05:12) +@!@!@ENDMSG 2185 @!@!@ +@!@!@STARTMSG 2279:3 @!@!@ +Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. +@!@!@ENDMSG 2279 @!@!@ +@!@!@STARTMSG 2284:3 @!@!@ +Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. +@!@!@ENDMSG 2284 @!@!@ +@!@!@STARTMSG 2212:0 @!@!@ +Implied-temporal checking--satisfiability problem has 1 branches. +@!@!@ENDMSG 2212 @!@!@ +@!@!@STARTMSG 2189:0 @!@!@ +Computing initial states... +@!@!@ENDMSG 2189 @!@!@ +@!@!@STARTMSG 2190:0 @!@!@ +Finished computing initial states: 1 distinct state generated at 2025-01-19 23:05:13. +@!@!@ENDMSG 2190 @!@!@ +@!@!@STARTMSG 1000:1 @!@!@ +TLC threw an unexpected exception. +This was probably caused by an error in the spec or model. +See the User Output or TLC Console for clues to what happened. +The exception was a java.lang.RuntimeException +: Attempted to select field "rx" from a non-record value s1 +line 111, col 50 to line 111, col 53 of module replicated +@!@!@ENDMSG 1000 @!@!@ +@!@!@STARTMSG 2121:1 @!@!@ +The behavior up to this point is: +@!@!@ENDMSG 2121 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +1: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, b3, s1, s2, s3, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +2: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, s1, s2, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +3: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, s1, s2, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 1, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 1, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2103:1 @!@!@ +The error occurred when TLC was evaluating the nested +expressions at the following positions: +0. Line 108, column 5 to line 125, column 57 in replicated +1. Line 108, column 8 to line 108, column 27 in replicated +2. Line 109, column 8 to line 124, column 80 in replicated +3. Line 124, column 9 to line 124, column 80 in replicated +4. Line 124, column 29 to line 124, column 80 in replicated +5. Line 124, column 71 to line 124, column 79 in replicated +6. Line 122, column 22 to line 122, column 42 in replicated +7. Line 27, column 3 to line 27, column 36 in replicated +8. Line 27, column 16 to line 27, column 16 in replicated +9. Line 122, column 31 to line 122, column 41 in replicated +10. Line 121, column 24 to line 121, column 49 in replicated +11. Line 121, column 45 to line 121, column 48 in replicated +12. Line 114, column 13 to line 120, column 18 in replicated +13. Line 115, column 17 to line 117, column 32 in replicated +14. Line 117, column 17 to line 117, column 32 in replicated +15. Line 112, column 29 to line 112, column 74 in replicated +16. Line 112, column 35 to line 112, column 74 in replicated +17. Line 112, column 51 to line 112, column 71 in replicated +18. Line 112, column 51 to line 112, column 62 in replicated +19. Line 111, column 25 to line 111, column 64 in replicated +20. Line 111, column 25 to line 111, column 55 in replicated +21. Line 111, column 43 to line 111, column 53 in replicated +22. Line 111, column 50 to line 111, column 53 in replicated + + +@!@!@ENDMSG 2103 @!@!@ +@!@!@STARTMSG 2201:0 @!@!@ +The coverage statistics at 2025-01-19 23:05:14 +@!@!@ENDMSG 2201 @!@!@ +@!@!@STARTMSG 2773:0 @!@!@ +: 2:2 +@!@!@ENDMSG 2773 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 46, col 5 to line 49, col 26 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 1:7 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 52, col 8 to line 55, col 44 of module replicated: 7 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 52, col 18 to line 55, col 44 of module replicated: 7 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 53, col 9 to line 55, col 44 of module replicated: 749 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 53, col 12 to line 53, col 48 of module replicated: 749 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 54, col 12 to line 54, col 44 of module replicated: 301 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 55, col 12 to line 55, col 44 of module replicated: 98 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 52, col 32 to line 52, col 48 of module replicated: 7 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 56, col 8 to line 56, col 67 of module replicated: 7 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 4:15 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 59, col 8 to line 59, col 32 of module replicated: 62 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 59, col 8 to line 59, col 15 of module replicated: 47:110 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 59, col 27 to line 59, col 32 of module replicated: 47 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 60, col 8 to line 60, col 14 of module replicated: 47 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 60, col 8 to line 60, col 9 of module replicated: 32 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 60, col 13 to line 60, col 14 of module replicated: 32 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 61, col 8 to line 61, col 72 of module replicated: 34 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 61, col 8 to line 61, col 38 of module replicated: 19 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 61, col 42 to line 61, col 72 of module replicated: 19 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 65, col 13 to line 67, col 50 of module replicated: 15 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 68, col 8 to line 68, col 58 of module replicated: 15 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 71, col 8 to line 71, col 32 of module replicated: 46 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 72, col 8 to line 72, col 72 of module replicated: 31 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 73, col 8 to line 73, col 71 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 74, col 8 to line 74, col 102 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 75, col 8 to line 75, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 2:30 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 78, col 8 to line 78, col 30 of module replicated: 75 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 78, col 8 to line 78, col 13 of module replicated: 45:111 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 78, col 25 to line 78, col 30 of module replicated: 45 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 79, col 8 to line 86, col 52 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 87, col 8 to line 87, col 62 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 96, col 13 to line 98, col 37 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 99, col 8 to line 99, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 5:30 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 103, col 8 to line 103, col 29 of module replicated: 75 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 103, col 8 to line 103, col 12 of module replicated: 45:111 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 103, col 24 to line 103, col 29 of module replicated: 45 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 104, col 8 to line 104, col 81 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 105, col 8 to line 105, col 57 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 108, col 8 to line 108, col 27 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 124, col 9 to line 124, col 80 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 124, col 29 to line 124, col 80 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 125, col 8 to line 125, col 57 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 137, col 8 to line 137, col 109 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 138, col 8 to line 138, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2774:0 @!@!@ + +@!@!@ENDMSG 2774 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 160, col 13 to line 161, col 81 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 160, col 35 to line 161, col 81 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 161, col 9 to line 161, col 81 of module replicated: 39 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 160, col 44 to line 160, col 72 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 160, col 22 to line 160, col 32 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2774:0 @!@!@ + +@!@!@ENDMSG 2774 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 164, col 5 to line 166, col 88 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 164, col 47 to line 166, col 88 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 165, col 9 to line 166, col 88 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 165, col 12 to line 166, col 88 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 165, col 13 to line 165, col 85 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 166, col 16 to line 166, col 88 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 164, col 61 to line 164, col 83 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 164, col 21 to line 164, col 43 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2202:0 @!@!@ +End of statistics. +@!@!@ENDMSG 2202 @!@!@ +@!@!@STARTMSG 2200:0 @!@!@ +Progress(4) at 2025-01-19 23:05:14: 69 states generated (1.732 s/min), 13 distinct states found (326 ds/min), 9 states left on queue. +@!@!@ENDMSG 2200 @!@!@ +@!@!@STARTMSG 2199:0 @!@!@ +69 states generated, 13 distinct states found, 9 states left on queue. +@!@!@ENDMSG 2199 @!@!@ +@!@!@STARTMSG 2186:0 @!@!@ +Finished in 2406ms at (2025-01-19 23:05:14) +@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324315582/MC.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324315582/MC.tla new file mode 100644 index 0000000000..19f485fc1e --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324315582/MC.tla @@ -0,0 +1,65 @@ +---- MODULE MC ---- +EXTENDS replicated, TLC + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +b1, b2, b3 +---- + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +s1, s2, s3 +---- + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +p1 +---- + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +az1, az2, az3 +---- + +\* MV CONSTANT definitions brokers +const_1737324311514327000 == +{b1, b2, b3} +---- + +\* MV CONSTANT definitions safekeepers +const_1737324311514328000 == +{s1, s2, s3} +---- + +\* MV CONSTANT definitions pageservers +const_1737324311514329000 == +{p1} +---- + +\* MV CONSTANT definitions azs +const_1737324311514330000 == +{az1, az2, az3} +---- + +\* SYMMETRY definition +symm_1737324311514331000 == +Permutations(const_1737324311514327000) \union Permutations(const_1737324311514328000) \union Permutations(const_1737324311514329000) \union Permutations(const_1737324311514330000) +---- + +\* CONSTANT definitions @modelParameterConstants:4max_commit_lsn +const_1737324311514332000 == +2 +---- + +\* CONSTANT definitions @modelParameterConstants:5az_mapping +const_1737324311514333000 == +[ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2} , az3 |-> {b3,s3}] +---- + +\* CONSTRAINT definition @modelParameterContraint:0 +constr_1737324311514334000 == +StateConstraint +---- +============================================================================= +\* Modification History +\* Created Sun Jan 19 23:05:11 CET 2025 by cs diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324315582/MC_TE.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324315582/MC_TE.out new file mode 100644 index 0000000000..03d45e4f9c --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324315582/MC_TE.out @@ -0,0 +1,324 @@ +@!@!@STARTMSG 2262:0 @!@!@ +TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) +@!@!@ENDMSG 2262 @!@!@ +@!@!@STARTMSG 2187:0 @!@!@ +Running breadth-first search Model-Checking with fp 120 and seed -4351583933909868251 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 23327] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +@!@!@ENDMSG 2187 @!@!@ +@!@!@STARTMSG 2220:0 @!@!@ +Starting SANY... +@!@!@ENDMSG 2220 @!@!@ +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla +Semantic processing of module Naturals +Semantic processing of module Integers +Semantic processing of module Sequences +Semantic processing of module FiniteSets +Semantic processing of module replicated +Semantic processing of module TLC +Semantic processing of module MC +@!@!@STARTMSG 2219:0 @!@!@ +SANY finished. +@!@!@ENDMSG 2219 @!@!@ +@!@!@STARTMSG 2185:0 @!@!@ +Starting... (2025-01-19 23:05:12) +@!@!@ENDMSG 2185 @!@!@ +@!@!@STARTMSG 2279:3 @!@!@ +Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. +@!@!@ENDMSG 2279 @!@!@ +@!@!@STARTMSG 2284:3 @!@!@ +Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. +@!@!@ENDMSG 2284 @!@!@ +@!@!@STARTMSG 2212:0 @!@!@ +Implied-temporal checking--satisfiability problem has 1 branches. +@!@!@ENDMSG 2212 @!@!@ +@!@!@STARTMSG 2189:0 @!@!@ +Computing initial states... +@!@!@ENDMSG 2189 @!@!@ +@!@!@STARTMSG 2190:0 @!@!@ +Finished computing initial states: 1 distinct state generated at 2025-01-19 23:05:13. +@!@!@ENDMSG 2190 @!@!@ +@!@!@STARTMSG 1000:1 @!@!@ +TLC threw an unexpected exception. +This was probably caused by an error in the spec or model. +See the User Output or TLC Console for clues to what happened. +The exception was a java.lang.RuntimeException +: Attempted to select field "rx" from a non-record value s1 +line 111, col 50 to line 111, col 53 of module replicated +@!@!@ENDMSG 1000 @!@!@ +@!@!@STARTMSG 2121:1 @!@!@ +The behavior up to this point is: +@!@!@ENDMSG 2121 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +1: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, b3, s1, s2, s3, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +2: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, s1, s2, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +3: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, s1, s2, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 1, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 1, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2103:1 @!@!@ +The error occurred when TLC was evaluating the nested +expressions at the following positions: +0. Line 108, column 5 to line 125, column 57 in replicated +1. Line 108, column 8 to line 108, column 27 in replicated +2. Line 109, column 8 to line 124, column 80 in replicated +3. Line 124, column 9 to line 124, column 80 in replicated +4. Line 124, column 29 to line 124, column 80 in replicated +5. Line 124, column 71 to line 124, column 79 in replicated +6. Line 122, column 22 to line 122, column 42 in replicated +7. Line 27, column 3 to line 27, column 36 in replicated +8. Line 27, column 16 to line 27, column 16 in replicated +9. Line 122, column 31 to line 122, column 41 in replicated +10. Line 121, column 24 to line 121, column 49 in replicated +11. Line 121, column 45 to line 121, column 48 in replicated +12. Line 114, column 13 to line 120, column 18 in replicated +13. Line 115, column 17 to line 117, column 32 in replicated +14. Line 117, column 17 to line 117, column 32 in replicated +15. Line 112, column 29 to line 112, column 74 in replicated +16. Line 112, column 35 to line 112, column 74 in replicated +17. Line 112, column 51 to line 112, column 71 in replicated +18. Line 112, column 51 to line 112, column 62 in replicated +19. Line 111, column 25 to line 111, column 64 in replicated +20. Line 111, column 25 to line 111, column 55 in replicated +21. Line 111, column 43 to line 111, column 53 in replicated +22. Line 111, column 50 to line 111, column 53 in replicated + + +@!@!@ENDMSG 2103 @!@!@ +@!@!@STARTMSG 2201:0 @!@!@ +The coverage statistics at 2025-01-19 23:05:14 +@!@!@ENDMSG 2201 @!@!@ +@!@!@STARTMSG 2773:0 @!@!@ +: 2:2 +@!@!@ENDMSG 2773 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 46, col 5 to line 49, col 26 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 1:7 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 52, col 8 to line 55, col 44 of module replicated: 7 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 52, col 18 to line 55, col 44 of module replicated: 7 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 53, col 9 to line 55, col 44 of module replicated: 749 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 53, col 12 to line 53, col 48 of module replicated: 749 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 54, col 12 to line 54, col 44 of module replicated: 301 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 55, col 12 to line 55, col 44 of module replicated: 98 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 52, col 32 to line 52, col 48 of module replicated: 7 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 56, col 8 to line 56, col 67 of module replicated: 7 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 4:15 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 59, col 8 to line 59, col 32 of module replicated: 62 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 59, col 8 to line 59, col 15 of module replicated: 47:110 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 59, col 27 to line 59, col 32 of module replicated: 47 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 60, col 8 to line 60, col 14 of module replicated: 47 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 60, col 8 to line 60, col 9 of module replicated: 32 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 60, col 13 to line 60, col 14 of module replicated: 32 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 61, col 8 to line 61, col 72 of module replicated: 34 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 61, col 8 to line 61, col 38 of module replicated: 19 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 61, col 42 to line 61, col 72 of module replicated: 19 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 65, col 13 to line 67, col 50 of module replicated: 15 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 68, col 8 to line 68, col 58 of module replicated: 15 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 71, col 8 to line 71, col 32 of module replicated: 46 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 72, col 8 to line 72, col 72 of module replicated: 31 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 73, col 8 to line 73, col 71 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 74, col 8 to line 74, col 102 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 75, col 8 to line 75, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 2:30 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 78, col 8 to line 78, col 30 of module replicated: 75 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 78, col 8 to line 78, col 13 of module replicated: 45:111 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 78, col 25 to line 78, col 30 of module replicated: 45 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 79, col 8 to line 86, col 52 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 87, col 8 to line 87, col 62 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 96, col 13 to line 98, col 37 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 99, col 8 to line 99, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 5:30 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 103, col 8 to line 103, col 29 of module replicated: 75 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 103, col 8 to line 103, col 12 of module replicated: 45:111 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 103, col 24 to line 103, col 29 of module replicated: 45 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 104, col 8 to line 104, col 81 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 105, col 8 to line 105, col 57 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 108, col 8 to line 108, col 27 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 124, col 9 to line 124, col 80 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 124, col 29 to line 124, col 80 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 125, col 8 to line 125, col 57 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 137, col 8 to line 137, col 109 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 138, col 8 to line 138, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2774:0 @!@!@ + +@!@!@ENDMSG 2774 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 160, col 13 to line 161, col 81 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 160, col 35 to line 161, col 81 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 161, col 9 to line 161, col 81 of module replicated: 39 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 160, col 44 to line 160, col 72 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 160, col 22 to line 160, col 32 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2774:0 @!@!@ + +@!@!@ENDMSG 2774 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 164, col 5 to line 166, col 88 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 164, col 47 to line 166, col 88 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 165, col 9 to line 166, col 88 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 165, col 12 to line 166, col 88 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 165, col 13 to line 165, col 85 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 166, col 16 to line 166, col 88 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 164, col 61 to line 164, col 83 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 164, col 21 to line 164, col 43 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2202:0 @!@!@ +End of statistics. +@!@!@ENDMSG 2202 @!@!@ +@!@!@STARTMSG 2200:0 @!@!@ +Progress(4) at 2025-01-19 23:05:14: 69 states generated (1.732 s/min), 13 distinct states found (326 ds/min), 9 states left on queue. +@!@!@ENDMSG 2200 @!@!@ +@!@!@STARTMSG 2199:0 @!@!@ +69 states generated, 13 distinct states found, 9 states left on queue. +@!@!@ENDMSG 2199 @!@!@ +@!@!@STARTMSG 2186:0 @!@!@ +Finished in 2406ms at (2025-01-19 23:05:14) +@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324315582/replicated.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324315582/replicated.tla new file mode 100644 index 0000000000..cab5c1023b --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737324315582/replicated.tla @@ -0,0 +1,181 @@ +---- MODULE replicated ---- + +EXTENDS Integers, FiniteSets + +VARIABLES broker_state, safekeeper_state, pageserver_state, online + + +CONSTANT + brokers, + safekeepers, + pageservers, + azs, + az_mapping + +CONSTANT + NULL + +CONSTANT + max_commit_lsn + +\* HELPERS + +Max(a,b) == IF a > b THEN a ELSE b + +(* The minimum of a non-empty set of integers *) +MinOfSet(S) == + CHOOSE x \in S: \A y \in S: x <= y + +\* END HELPERS + +StateConstraint == + /\ \A s \in safekeepers: + /\ safekeeper_state[s].commit_lsn <= max_commit_lsn + /\ \A b \in brokers: + /\ \A s \in DOMAIN broker_state[b].sk: + /\ broker_state[b].sk[s].commit_lsn <= max_commit_lsn + + + +InitSafekeeper == [prune_lsn |-> 0, commit_lsn |-> 0, rx |-> [b \in brokers |-> NULL] ] +InitBroker == [sk |-> [s \in safekeepers |-> [prune_lsn |-> 0, commit_lsn |-> 0]]] +InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] +InitOnline == safekeepers \cup brokers \cup pageservers + +Init == + /\ broker_state = [b \in brokers |-> InitBroker] + /\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper] + /\ pageserver_state = [p \in pageservers |-> InitPageserver] + /\ online = InitOnline + +NodeOnlineOffline == + /\ online' = CHOOSE ss \in SUBSET InitOnline: + /\ Cardinality(ss \cap safekeepers) >= 2 + /\ Cardinality(ss \cap brokers) >= 2 + /\ ss \cap pageservers = pageservers \* assume no PS failures for now + /\ UNCHANGED <> + +SkCommit(s1, s2) == + /\ {s1, s2} \subseteq online + /\ s1 # s2 + /\ safekeeper_state[s1].commit_lsn = safekeeper_state[s2].commit_lsn + /\ LET + new_commit_lsn == safekeeper_state[s1].commit_lsn + 1 + IN + safekeeper_state' = [safekeeper_state EXCEPT + ![s1].commit_lsn = new_commit_lsn, + ![s2].commit_lsn = new_commit_lsn] + /\ UNCHANGED <> + +SkPeerRecovery(s1,s2) == + /\ {s1, s2} \subseteq online + /\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn \* s2 has more WAL than s1 + /\ safekeeper_state[s2].prune_lsn < safekeeper_state[s1].commit_lsn \* s2 has not yet trimmed the WAL the WAL + /\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn] + /\ UNCHANGED <> + +SkPushToBroker(s,b) == + /\ {s, b} \subseteq online + /\ broker_state' = LET + broker_side == broker_state[b].sk[s] + sk_side == safekeeper_state[s] + merged == [broker_side EXCEPT + !["commit_lsn"] = Max(broker_side.commit_lsn, sk_side.commit_lsn), + !["prune_lsn"] = Max(broker_side.prune_lsn, sk_side.prune_lsn)] + IN + [broker_state EXCEPT ![b].sk[s] = merged] + /\ UNCHANGED <> + +PsRecvBroker(b,p,s) == + /\ {b,p,s} \subseteq online + /\ LET + bsk == broker_state[b].sk[s] + psk == pageserver_state[p].sk[s] + updpsk == [psk EXCEPT !["commit_lsn"] = bsk.commit_lsn] + IN + pageserver_state' = IF bsk.commit_lsn > psk.commit_lsn + THEN [pageserver_state EXCEPT ![p].sk[s] = updpsk] + ELSE pageserver_state + /\ UNCHANGED <> + + +SkRecvBroker(b,s) == + /\ {b,s} \subseteq online + /\ safekeeper_state' = [safekeeper_state EXCEPT ![s].rx[b] = broker_state[b]] + /\ UNCHANGED <> + +SkPrune(s) == + /\ {s} \subseteq online + /\ LET + sk == safekeeper_state[s] + broker_infos == {sk.rx[b]: b \in (DOMAIN s.rx)} \ {NULL} + broker_infos_sks == UNION {bi.sk: bi \in (broker_infos \ {NULL}) } + info == + ( + {safekeeper_state[s]} + \cup + broker_infos_sks + ) + \ + {NULL} + commit_lsns == {i.commit_lsn: i \in info} + prune_lsn == MinOfSet(commit_lsns) + IN + safekeeper_state' = [safekeeper_state EXCEPT ![s].prune_lsn = prune_lsn] + /\ UNCHANGED <> + + +SksWithNewerWal(p) == + LET + ps == pageserver_state[p] + IN + {s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn} + +PsChooseSk(p) == + /\ {p} \subseteq online + /\ SksWithNewerWal(p) # {} + /\ pageserver_state' = [pageserver_state EXCEPT![p].preferred_sk = CHOOSE s \in SksWithNewerWal(p): TRUE] + /\ UNCHANGED <> + + +Next == + \/ NodeOnlineOffline + \/ \E s1 \in safekeepers: \E s2 \in safekeepers: + \/ SkCommit(s1, s2) + \/ SkPeerRecovery(s1, s2) + \/ \E s \in safekeepers: \E b \in brokers: + \/ SkPushToBroker(s, b) + \/ SkRecvBroker(b, s) + \/ \E s \in safekeepers: + \/ SkPrune(s) + \/ \E s \in safekeepers: \E b \in brokers: \E p \in pageservers: PsRecvBroker(b,p,s) + \/ \E p \in pageservers: PsChooseSk(p) + + +Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state,online>> + + +\* invariants + +PsLagsSk == \A p \in pageservers: \A s \in DOMAIN pageserver_state[p].sk: + /\ pageserver_state[p].sk[s].commit_lsn <= safekeeper_state[s].commit_lsn + +PeerRecoveryIsPossible == + \A laggard \in (safekeepers \cap online): \E donor \in (safekeepers \cap online): + /\ (safekeeper_state[laggard].commit_lsn < safekeeper_state[donor].commit_lsn) + => safekeeper_state[donor].prune_lsn <= safekeeper_state[laggard].commit_lsn + + +EventuallyLaggingSkIsNotPreferredSk == <>( + LET + sks == safekeeper_state + lagging_sks == { s \in safekeepers: \A s2 \in safekeepers: sks[s].commit_lsn <= sks[s2].commit_lsn } + preferred_sks == {pageserver_state[p].preferred_sk: p \in pageservers} + IN + preferred_sks \cap lagging_sks = {} + + ) + + + +==== \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326115252/MC.cfg b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326115252/MC.cfg new file mode 100644 index 0000000000..b73f653f76 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326115252/MC.cfg @@ -0,0 +1,54 @@ +\* MV CONSTANT declarations +CONSTANTS +b1 = b1 +b2 = b2 +b3 = b3 +\* MV CONSTANT declarations +CONSTANTS +s1 = s1 +s2 = s2 +s3 = s3 +\* MV CONSTANT declarations +CONSTANTS +p1 = p1 +\* MV CONSTANT declarations +CONSTANTS +az1 = az1 +az2 = az2 +az3 = az3 +\* MV CONSTANT definitions +CONSTANT +brokers <- const_1737326111193338000 +\* CONSTANT declarations +CONSTANT NULL = NULL +\* MV CONSTANT definitions +CONSTANT +safekeepers <- const_1737326111193339000 +\* MV CONSTANT definitions +CONSTANT +pageservers <- const_1737326111193340000 +\* MV CONSTANT definitions +CONSTANT +azs <- const_1737326111193341000 +\* SYMMETRY definition +SYMMETRY symm_1737326111193342000 +\* CONSTANT definitions +CONSTANT +max_commit_lsn <- const_1737326111193343000 +\* CONSTANT definitions +CONSTANT +az_mapping <- const_1737326111193344000 +\* CONSTRAINT definition +CONSTRAINT +constr_1737326111193345000 +\* SPECIFICATION definition +SPECIFICATION +Spec +\* INVARIANT definition +INVARIANT +PsLagsSk +PeerRecoveryIsPossible +\* PROPERTY definition +PROPERTY +EventuallyLaggingSkIsNotPreferredSk +\* Generated on Sun Jan 19 23:35:11 CET 2025 \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326115252/MC.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326115252/MC.out new file mode 100644 index 0000000000..32eb0a04a9 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326115252/MC.out @@ -0,0 +1,312 @@ +@!@!@STARTMSG 2262:0 @!@!@ +TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) +@!@!@ENDMSG 2262 @!@!@ +@!@!@STARTMSG 2187:0 @!@!@ +Running breadth-first search Model-Checking with fp 75 and seed 8173044349253312442 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 24585] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +@!@!@ENDMSG 2187 @!@!@ +@!@!@STARTMSG 2220:0 @!@!@ +Starting SANY... +@!@!@ENDMSG 2220 @!@!@ +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla +Semantic processing of module Naturals +Semantic processing of module Integers +Semantic processing of module Sequences +Semantic processing of module FiniteSets +Semantic processing of module replicated +Semantic processing of module TLC +Semantic processing of module MC +@!@!@STARTMSG 2219:0 @!@!@ +SANY finished. +@!@!@ENDMSG 2219 @!@!@ +@!@!@STARTMSG 2185:0 @!@!@ +Starting... (2025-01-19 23:35:12) +@!@!@ENDMSG 2185 @!@!@ +@!@!@STARTMSG 2279:3 @!@!@ +Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. +@!@!@ENDMSG 2279 @!@!@ +@!@!@STARTMSG 2284:3 @!@!@ +Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. +@!@!@ENDMSG 2284 @!@!@ +@!@!@STARTMSG 2212:0 @!@!@ +Implied-temporal checking--satisfiability problem has 1 branches. +@!@!@ENDMSG 2212 @!@!@ +@!@!@STARTMSG 2189:0 @!@!@ +Computing initial states... +@!@!@ENDMSG 2189 @!@!@ +@!@!@STARTMSG 2190:0 @!@!@ +Finished computing initial states: 1 distinct state generated at 2025-01-19 23:35:13. +@!@!@ENDMSG 2190 @!@!@ +@!@!@STARTMSG 1000:1 @!@!@ +TLC threw an unexpected exception. +This was probably caused by an error in the spec or model. +See the User Output or TLC Console for clues to what happened. +The exception was a java.lang.RuntimeException +: Attempted to select field "rx" from a non-record value s1 +line 116, col 50 to line 116, col 53 of module replicated +@!@!@ENDMSG 1000 @!@!@ +@!@!@STARTMSG 2121:1 @!@!@ +The behavior up to this point is: +@!@!@ENDMSG 2121 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +1: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, b3, s1, s2, s3, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +2: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, s1, s2, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2103:1 @!@!@ +The error occurred when TLC was evaluating the nested +expressions at the following positions: +0. Line 112, column 5 to line 128, column 57 in replicated +1. Line 112, column 8 to line 112, column 27 in replicated +2. Line 113, column 8 to line 127, column 80 in replicated +3. Line 127, column 9 to line 127, column 80 in replicated +4. Line 127, column 29 to line 127, column 80 in replicated +5. Line 127, column 71 to line 127, column 79 in replicated +6. Line 125, column 22 to line 125, column 46 in replicated +7. Line 27, column 3 to line 27, column 36 in replicated +8. Line 27, column 16 to line 27, column 16 in replicated +9. Line 125, column 31 to line 125, column 45 in replicated +10. Line 118, column 28 to line 124, column 13 in replicated +11. Line 123, column 27 to line 123, column 35 in replicated +12. Line 117, column 22 to line 117, column 64 in replicated +13. Line 117, column 29 to line 117, column 63 in replicated +14. Line 117, column 51 to line 117, column 62 in replicated +15. Line 116, column 25 to line 116, column 64 in replicated +16. Line 116, column 25 to line 116, column 55 in replicated +17. Line 116, column 43 to line 116, column 53 in replicated +18. Line 116, column 50 to line 116, column 53 in replicated + + +@!@!@ENDMSG 2103 @!@!@ +@!@!@STARTMSG 2201:0 @!@!@ +The coverage statistics at 2025-01-19 23:35:14 +@!@!@ENDMSG 2201 @!@!@ +@!@!@STARTMSG 2773:0 @!@!@ +: 2:2 +@!@!@ENDMSG 2773 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 50, col 5 to line 53, col 26 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 1:6 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 56, col 8 to line 59, col 44 of module replicated: 6 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 56, col 18 to line 59, col 44 of module replicated: 6 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 57, col 9 to line 59, col 44 of module replicated: 642 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 57, col 12 to line 57, col 48 of module replicated: 642 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 58, col 12 to line 58, col 44 of module replicated: 258 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 59, col 12 to line 59, col 44 of module replicated: 84 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 56, col 32 to line 56, col 48 of module replicated: 6 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 60, col 8 to line 60, col 67 of module replicated: 6 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 4:14 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 63, col 8 to line 63, col 32 of module replicated: 59 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 63, col 8 to line 63, col 15 of module replicated: 45:105 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 63, col 27 to line 63, col 32 of module replicated: 45 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 64, col 8 to line 64, col 14 of module replicated: 44 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 64, col 8 to line 64, col 9 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 64, col 13 to line 64, col 14 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 65, col 8 to line 65, col 72 of module replicated: 32 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 65, col 8 to line 65, col 38 of module replicated: 18 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 65, col 42 to line 65, col 72 of module replicated: 18 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 69, col 13 to line 71, col 50 of module replicated: 14 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 72, col 8 to line 72, col 58 of module replicated: 14 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 75, col 8 to line 75, col 32 of module replicated: 45 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 76, col 8 to line 76, col 72 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 77, col 8 to line 77, col 71 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 78, col 8 to line 78, col 102 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 79, col 8 to line 79, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 2:30 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 82, col 8 to line 82, col 30 of module replicated: 75 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 82, col 8 to line 82, col 13 of module replicated: 45:111 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 82, col 25 to line 82, col 30 of module replicated: 45 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 83, col 8 to line 90, col 52 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 91, col 8 to line 91, col 62 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 100, col 13 to line 102, col 37 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 103, col 8 to line 103, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 5:30 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 107, col 8 to line 107, col 29 of module replicated: 75 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 107, col 8 to line 107, col 12 of module replicated: 45:111 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 107, col 24 to line 107, col 29 of module replicated: 45 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 108, col 8 to line 108, col 81 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 109, col 8 to line 109, col 57 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 112, col 8 to line 112, col 27 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 127, col 9 to line 127, col 80 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 127, col 29 to line 127, col 80 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 128, col 8 to line 128, col 57 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 140, col 8 to line 140, col 109 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 141, col 8 to line 141, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2774:0 @!@!@ + +@!@!@ENDMSG 2774 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 163, col 13 to line 164, col 81 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 163, col 35 to line 164, col 81 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 164, col 9 to line 164, col 81 of module replicated: 39 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 163, col 44 to line 163, col 72 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 163, col 22 to line 163, col 32 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2774:0 @!@!@ + +@!@!@ENDMSG 2774 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 167, col 5 to line 169, col 88 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 167, col 47 to line 169, col 88 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 168, col 9 to line 169, col 88 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 168, col 12 to line 169, col 88 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 168, col 13 to line 168, col 85 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 169, col 16 to line 169, col 88 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 167, col 61 to line 167, col 83 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 167, col 21 to line 167, col 43 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2202:0 @!@!@ +End of statistics. +@!@!@ENDMSG 2202 @!@!@ +@!@!@STARTMSG 2200:0 @!@!@ +Progress(4) at 2025-01-19 23:35:14: 69 states generated (1.538 s/min), 13 distinct states found (289 ds/min), 9 states left on queue. +@!@!@ENDMSG 2200 @!@!@ +@!@!@STARTMSG 2199:0 @!@!@ +69 states generated, 13 distinct states found, 9 states left on queue. +@!@!@ENDMSG 2199 @!@!@ +@!@!@STARTMSG 2186:0 @!@!@ +Finished in 2708ms at (2025-01-19 23:35:14) +@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326115252/MC.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326115252/MC.tla new file mode 100644 index 0000000000..00d9fe44a4 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326115252/MC.tla @@ -0,0 +1,65 @@ +---- MODULE MC ---- +EXTENDS replicated, TLC + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +b1, b2, b3 +---- + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +s1, s2, s3 +---- + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +p1 +---- + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +az1, az2, az3 +---- + +\* MV CONSTANT definitions brokers +const_1737326111193338000 == +{b1, b2, b3} +---- + +\* MV CONSTANT definitions safekeepers +const_1737326111193339000 == +{s1, s2, s3} +---- + +\* MV CONSTANT definitions pageservers +const_1737326111193340000 == +{p1} +---- + +\* MV CONSTANT definitions azs +const_1737326111193341000 == +{az1, az2, az3} +---- + +\* SYMMETRY definition +symm_1737326111193342000 == +Permutations(const_1737326111193338000) \union Permutations(const_1737326111193339000) \union Permutations(const_1737326111193340000) \union Permutations(const_1737326111193341000) +---- + +\* CONSTANT definitions @modelParameterConstants:4max_commit_lsn +const_1737326111193343000 == +2 +---- + +\* CONSTANT definitions @modelParameterConstants:5az_mapping +const_1737326111193344000 == +[ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2} , az3 |-> {b3,s3}] +---- + +\* CONSTRAINT definition @modelParameterContraint:0 +constr_1737326111193345000 == +StateConstraint +---- +============================================================================= +\* Modification History +\* Created Sun Jan 19 23:35:11 CET 2025 by cs diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326115252/MC_TE.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326115252/MC_TE.out new file mode 100644 index 0000000000..32eb0a04a9 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326115252/MC_TE.out @@ -0,0 +1,312 @@ +@!@!@STARTMSG 2262:0 @!@!@ +TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) +@!@!@ENDMSG 2262 @!@!@ +@!@!@STARTMSG 2187:0 @!@!@ +Running breadth-first search Model-Checking with fp 75 and seed 8173044349253312442 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 24585] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +@!@!@ENDMSG 2187 @!@!@ +@!@!@STARTMSG 2220:0 @!@!@ +Starting SANY... +@!@!@ENDMSG 2220 @!@!@ +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla +Semantic processing of module Naturals +Semantic processing of module Integers +Semantic processing of module Sequences +Semantic processing of module FiniteSets +Semantic processing of module replicated +Semantic processing of module TLC +Semantic processing of module MC +@!@!@STARTMSG 2219:0 @!@!@ +SANY finished. +@!@!@ENDMSG 2219 @!@!@ +@!@!@STARTMSG 2185:0 @!@!@ +Starting... (2025-01-19 23:35:12) +@!@!@ENDMSG 2185 @!@!@ +@!@!@STARTMSG 2279:3 @!@!@ +Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. +@!@!@ENDMSG 2279 @!@!@ +@!@!@STARTMSG 2284:3 @!@!@ +Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. +@!@!@ENDMSG 2284 @!@!@ +@!@!@STARTMSG 2212:0 @!@!@ +Implied-temporal checking--satisfiability problem has 1 branches. +@!@!@ENDMSG 2212 @!@!@ +@!@!@STARTMSG 2189:0 @!@!@ +Computing initial states... +@!@!@ENDMSG 2189 @!@!@ +@!@!@STARTMSG 2190:0 @!@!@ +Finished computing initial states: 1 distinct state generated at 2025-01-19 23:35:13. +@!@!@ENDMSG 2190 @!@!@ +@!@!@STARTMSG 1000:1 @!@!@ +TLC threw an unexpected exception. +This was probably caused by an error in the spec or model. +See the User Output or TLC Console for clues to what happened. +The exception was a java.lang.RuntimeException +: Attempted to select field "rx" from a non-record value s1 +line 116, col 50 to line 116, col 53 of module replicated +@!@!@ENDMSG 1000 @!@!@ +@!@!@STARTMSG 2121:1 @!@!@ +The behavior up to this point is: +@!@!@ENDMSG 2121 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +1: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, b3, s1, s2, s3, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +2: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, s1, s2, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2103:1 @!@!@ +The error occurred when TLC was evaluating the nested +expressions at the following positions: +0. Line 112, column 5 to line 128, column 57 in replicated +1. Line 112, column 8 to line 112, column 27 in replicated +2. Line 113, column 8 to line 127, column 80 in replicated +3. Line 127, column 9 to line 127, column 80 in replicated +4. Line 127, column 29 to line 127, column 80 in replicated +5. Line 127, column 71 to line 127, column 79 in replicated +6. Line 125, column 22 to line 125, column 46 in replicated +7. Line 27, column 3 to line 27, column 36 in replicated +8. Line 27, column 16 to line 27, column 16 in replicated +9. Line 125, column 31 to line 125, column 45 in replicated +10. Line 118, column 28 to line 124, column 13 in replicated +11. Line 123, column 27 to line 123, column 35 in replicated +12. Line 117, column 22 to line 117, column 64 in replicated +13. Line 117, column 29 to line 117, column 63 in replicated +14. Line 117, column 51 to line 117, column 62 in replicated +15. Line 116, column 25 to line 116, column 64 in replicated +16. Line 116, column 25 to line 116, column 55 in replicated +17. Line 116, column 43 to line 116, column 53 in replicated +18. Line 116, column 50 to line 116, column 53 in replicated + + +@!@!@ENDMSG 2103 @!@!@ +@!@!@STARTMSG 2201:0 @!@!@ +The coverage statistics at 2025-01-19 23:35:14 +@!@!@ENDMSG 2201 @!@!@ +@!@!@STARTMSG 2773:0 @!@!@ +: 2:2 +@!@!@ENDMSG 2773 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 50, col 5 to line 53, col 26 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 1:6 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 56, col 8 to line 59, col 44 of module replicated: 6 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 56, col 18 to line 59, col 44 of module replicated: 6 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 57, col 9 to line 59, col 44 of module replicated: 642 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 57, col 12 to line 57, col 48 of module replicated: 642 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 58, col 12 to line 58, col 44 of module replicated: 258 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 59, col 12 to line 59, col 44 of module replicated: 84 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 56, col 32 to line 56, col 48 of module replicated: 6 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 60, col 8 to line 60, col 67 of module replicated: 6 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 4:14 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 63, col 8 to line 63, col 32 of module replicated: 59 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 63, col 8 to line 63, col 15 of module replicated: 45:105 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 63, col 27 to line 63, col 32 of module replicated: 45 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 64, col 8 to line 64, col 14 of module replicated: 44 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 64, col 8 to line 64, col 9 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 64, col 13 to line 64, col 14 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 65, col 8 to line 65, col 72 of module replicated: 32 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 65, col 8 to line 65, col 38 of module replicated: 18 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 65, col 42 to line 65, col 72 of module replicated: 18 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 69, col 13 to line 71, col 50 of module replicated: 14 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 72, col 8 to line 72, col 58 of module replicated: 14 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 75, col 8 to line 75, col 32 of module replicated: 45 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 76, col 8 to line 76, col 72 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 77, col 8 to line 77, col 71 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 78, col 8 to line 78, col 102 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 79, col 8 to line 79, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 2:30 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 82, col 8 to line 82, col 30 of module replicated: 75 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 82, col 8 to line 82, col 13 of module replicated: 45:111 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 82, col 25 to line 82, col 30 of module replicated: 45 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 83, col 8 to line 90, col 52 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 91, col 8 to line 91, col 62 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 100, col 13 to line 102, col 37 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 103, col 8 to line 103, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 5:30 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 107, col 8 to line 107, col 29 of module replicated: 75 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 107, col 8 to line 107, col 12 of module replicated: 45:111 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 107, col 24 to line 107, col 29 of module replicated: 45 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 108, col 8 to line 108, col 81 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 109, col 8 to line 109, col 57 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 112, col 8 to line 112, col 27 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 127, col 9 to line 127, col 80 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 127, col 29 to line 127, col 80 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 128, col 8 to line 128, col 57 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 140, col 8 to line 140, col 109 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 141, col 8 to line 141, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2774:0 @!@!@ + +@!@!@ENDMSG 2774 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 163, col 13 to line 164, col 81 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 163, col 35 to line 164, col 81 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 164, col 9 to line 164, col 81 of module replicated: 39 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 163, col 44 to line 163, col 72 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 163, col 22 to line 163, col 32 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2774:0 @!@!@ + +@!@!@ENDMSG 2774 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 167, col 5 to line 169, col 88 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 167, col 47 to line 169, col 88 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 168, col 9 to line 169, col 88 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 168, col 12 to line 169, col 88 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 168, col 13 to line 168, col 85 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 169, col 16 to line 169, col 88 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 167, col 61 to line 167, col 83 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 167, col 21 to line 167, col 43 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2202:0 @!@!@ +End of statistics. +@!@!@ENDMSG 2202 @!@!@ +@!@!@STARTMSG 2200:0 @!@!@ +Progress(4) at 2025-01-19 23:35:14: 69 states generated (1.538 s/min), 13 distinct states found (289 ds/min), 9 states left on queue. +@!@!@ENDMSG 2200 @!@!@ +@!@!@STARTMSG 2199:0 @!@!@ +69 states generated, 13 distinct states found, 9 states left on queue. +@!@!@ENDMSG 2199 @!@!@ +@!@!@STARTMSG 2186:0 @!@!@ +Finished in 2708ms at (2025-01-19 23:35:14) +@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326115252/replicated.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326115252/replicated.tla new file mode 100644 index 0000000000..0f91f2abba --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326115252/replicated.tla @@ -0,0 +1,184 @@ +---- MODULE replicated ---- + +EXTENDS Integers, FiniteSets + +VARIABLES broker_state, safekeeper_state, pageserver_state, online + + +CONSTANT + brokers, + safekeepers, + pageservers, + azs, + az_mapping + +CONSTANT + NULL + +CONSTANT + max_commit_lsn + +\* HELPERS + +Max(a,b) == IF a > b THEN a ELSE b + +(* The minimum of a non-empty set of integers *) +MinOfSet(S) == + CHOOSE x \in S: \A y \in S: x <= y + +(* The minimum of a non-empty set of integers *) +MaxOfSet(S) == + CHOOSE x \in S: \A y \in S: x >= y + +\* END HELPERS + +StateConstraint == + /\ \A s \in safekeepers: + /\ safekeeper_state[s].commit_lsn <= max_commit_lsn + /\ \A b \in brokers: + /\ \A s \in DOMAIN broker_state[b].sk: + /\ broker_state[b].sk[s].commit_lsn <= max_commit_lsn + + + +InitSafekeeper == [prune_lsn |-> 0, commit_lsn |-> 0, rx |-> [b \in brokers |-> NULL] ] +InitBroker == [sk |-> [s \in safekeepers |-> [prune_lsn |-> 0, commit_lsn |-> 0]]] +InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] +InitOnline == safekeepers \cup brokers \cup pageservers + +Init == + /\ broker_state = [b \in brokers |-> InitBroker] + /\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper] + /\ pageserver_state = [p \in pageservers |-> InitPageserver] + /\ online = InitOnline + +NodeOnlineOffline == + /\ online' = CHOOSE ss \in SUBSET InitOnline: + /\ Cardinality(ss \cap safekeepers) >= 2 + /\ Cardinality(ss \cap brokers) >= 2 + /\ ss \cap pageservers = pageservers \* assume no PS failures for now + /\ UNCHANGED <> + +SkCommit(s1, s2) == + /\ {s1, s2} \subseteq online + /\ s1 # s2 + /\ safekeeper_state[s1].commit_lsn = safekeeper_state[s2].commit_lsn + /\ LET + new_commit_lsn == safekeeper_state[s1].commit_lsn + 1 + IN + safekeeper_state' = [safekeeper_state EXCEPT + ![s1].commit_lsn = new_commit_lsn, + ![s2].commit_lsn = new_commit_lsn] + /\ UNCHANGED <> + +SkPeerRecovery(s1,s2) == + /\ {s1, s2} \subseteq online + /\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn \* s2 has more WAL than s1 + /\ safekeeper_state[s2].prune_lsn < safekeeper_state[s1].commit_lsn \* s2 has not yet trimmed the WAL the WAL + /\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn] + /\ UNCHANGED <> + +SkPushToBroker(s,b) == + /\ {s, b} \subseteq online + /\ broker_state' = LET + broker_side == broker_state[b].sk[s] + sk_side == safekeeper_state[s] + merged == [broker_side EXCEPT + !["commit_lsn"] = Max(broker_side.commit_lsn, sk_side.commit_lsn), + !["prune_lsn"] = Max(broker_side.prune_lsn, sk_side.prune_lsn)] + IN + [broker_state EXCEPT ![b].sk[s] = merged] + /\ UNCHANGED <> + +PsRecvBroker(b,p,s) == + /\ {b,p,s} \subseteq online + /\ LET + bsk == broker_state[b].sk[s] + psk == pageserver_state[p].sk[s] + updpsk == [psk EXCEPT !["commit_lsn"] = bsk.commit_lsn] + IN + pageserver_state' = IF bsk.commit_lsn > psk.commit_lsn + THEN [pageserver_state EXCEPT ![p].sk[s] = updpsk] + ELSE pageserver_state + /\ UNCHANGED <> + + +SkRecvBroker(b,s) == + /\ {b,s} \subseteq online + /\ safekeeper_state' = [safekeeper_state EXCEPT ![s].rx[b] = broker_state[b]] + /\ UNCHANGED <> + +SkPrune(s) == + /\ {s} \subseteq online + /\ LET + sk == safekeeper_state[s] + + broker_infos == {sk.rx[b]: b \in (DOMAIN s.rx)} \ {NULL} + known_sks == UNION ({DOMAIN bi.sk: bi \in broker_infos}) + max_commit_lsns == { + MaxOfSet( + { + sk.rx[b].sk[s2].commit_lsn: b \in DOMAIN sk.rx + } + ): s2 \in known_sks + } + prune_lsn == MinOfSet(max_commit_lsns) + IN + safekeeper_state' = [safekeeper_state EXCEPT ![s].prune_lsn = prune_lsn] + /\ UNCHANGED <> + + +SksWithNewerWal(p) == + LET + ps == pageserver_state[p] + IN + {s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn} + +PsChooseSk(p) == + /\ {p} \subseteq online + /\ SksWithNewerWal(p) # {} + /\ pageserver_state' = [pageserver_state EXCEPT![p].preferred_sk = CHOOSE s \in SksWithNewerWal(p): TRUE] + /\ UNCHANGED <> + + +Next == + \/ NodeOnlineOffline + \/ \E s1 \in safekeepers: \E s2 \in safekeepers: + \/ SkCommit(s1, s2) + \/ SkPeerRecovery(s1, s2) + \/ \E s \in safekeepers: \E b \in brokers: + \/ SkPushToBroker(s, b) + \/ SkRecvBroker(b, s) + \/ \E s \in safekeepers: + \/ SkPrune(s) + \/ \E s \in safekeepers: \E b \in brokers: \E p \in pageservers: PsRecvBroker(b,p,s) + \/ \E p \in pageservers: PsChooseSk(p) + + +Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state,online>> + + +\* invariants + +PsLagsSk == \A p \in pageservers: \A s \in DOMAIN pageserver_state[p].sk: + /\ pageserver_state[p].sk[s].commit_lsn <= safekeeper_state[s].commit_lsn + +PeerRecoveryIsPossible == + \A laggard \in (safekeepers \cap online): \E donor \in (safekeepers \cap online): + /\ (safekeeper_state[laggard].commit_lsn < safekeeper_state[donor].commit_lsn) + => safekeeper_state[donor].prune_lsn <= safekeeper_state[laggard].commit_lsn + + +EventuallyLaggingSkIsNotPreferredSk == <>( + LET + sks == safekeeper_state + lagging_sks == { s \in safekeepers: \A s2 \in safekeepers: sks[s].commit_lsn <= sks[s2].commit_lsn } + preferred_sks == {pageserver_state[p].preferred_sk: p \in pageservers} + IN + preferred_sks \cap lagging_sks = {} + + ) + + + +==== \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326135419/MC.cfg b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326135419/MC.cfg new file mode 100644 index 0000000000..8c3ce0b94d --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326135419/MC.cfg @@ -0,0 +1,54 @@ +\* MV CONSTANT declarations +CONSTANTS +b1 = b1 +b2 = b2 +b3 = b3 +\* MV CONSTANT declarations +CONSTANTS +s1 = s1 +s2 = s2 +s3 = s3 +\* MV CONSTANT declarations +CONSTANTS +p1 = p1 +\* MV CONSTANT declarations +CONSTANTS +az1 = az1 +az2 = az2 +az3 = az3 +\* MV CONSTANT definitions +CONSTANT +brokers <- const_1737326131354349000 +\* CONSTANT declarations +CONSTANT NULL = NULL +\* MV CONSTANT definitions +CONSTANT +safekeepers <- const_1737326131354350000 +\* MV CONSTANT definitions +CONSTANT +pageservers <- const_1737326131354351000 +\* MV CONSTANT definitions +CONSTANT +azs <- const_1737326131354352000 +\* SYMMETRY definition +SYMMETRY symm_1737326131354353000 +\* CONSTANT definitions +CONSTANT +max_commit_lsn <- const_1737326131354354000 +\* CONSTANT definitions +CONSTANT +az_mapping <- const_1737326131354355000 +\* CONSTRAINT definition +CONSTRAINT +constr_1737326131354356000 +\* SPECIFICATION definition +SPECIFICATION +Spec +\* INVARIANT definition +INVARIANT +PsLagsSk +PeerRecoveryIsPossible +\* PROPERTY definition +PROPERTY +EventuallyLaggingSkIsNotPreferredSk +\* Generated on Sun Jan 19 23:35:31 CET 2025 \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326135419/MC.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326135419/MC.out new file mode 100644 index 0000000000..8faf336b8d --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326135419/MC.out @@ -0,0 +1,358 @@ +@!@!@STARTMSG 2262:0 @!@!@ +TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) +@!@!@ENDMSG 2262 @!@!@ +@!@!@STARTMSG 2187:0 @!@!@ +Running breadth-first search Model-Checking with fp 0 and seed 849358144369345749 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 24597] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +@!@!@ENDMSG 2187 @!@!@ +@!@!@STARTMSG 2220:0 @!@!@ +Starting SANY... +@!@!@ENDMSG 2220 @!@!@ +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla +Semantic processing of module Naturals +Semantic processing of module Integers +Semantic processing of module Sequences +Semantic processing of module FiniteSets +Semantic processing of module replicated +Semantic processing of module TLC +Semantic processing of module MC +@!@!@STARTMSG 2219:0 @!@!@ +SANY finished. +@!@!@ENDMSG 2219 @!@!@ +@!@!@STARTMSG 2185:0 @!@!@ +Starting... (2025-01-19 23:35:32) +@!@!@ENDMSG 2185 @!@!@ +@!@!@STARTMSG 2279:3 @!@!@ +Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. +@!@!@ENDMSG 2279 @!@!@ +@!@!@STARTMSG 2284:3 @!@!@ +Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. +@!@!@ENDMSG 2284 @!@!@ +@!@!@STARTMSG 2212:0 @!@!@ +Implied-temporal checking--satisfiability problem has 1 branches. +@!@!@ENDMSG 2212 @!@!@ +@!@!@STARTMSG 2189:0 @!@!@ +Computing initial states... +@!@!@ENDMSG 2189 @!@!@ +@!@!@STARTMSG 2190:0 @!@!@ +Finished computing initial states: 1 distinct state generated at 2025-01-19 23:35:33. +@!@!@ENDMSG 2190 @!@!@ +@!@!@STARTMSG 1000:1 @!@!@ +TLC threw an unexpected exception. +This was probably caused by an error in the spec or model. +See the User Output or TLC Console for clues to what happened. +The exception was a java.lang.RuntimeException +: Attempted to compute the value of an expression of form +CHOOSE x \in S: P, but no element of S satisfied P. +line 27, col 3 to line 27, col 36 of module replicated +@!@!@ENDMSG 1000 @!@!@ +@!@!@STARTMSG 2121:1 @!@!@ +The behavior up to this point is: +@!@!@ENDMSG 2121 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +1: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, b3, s1, s2, s3, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +2: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, s1, s2, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +3: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, s1, s2, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 1, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 1, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2103:1 @!@!@ +The error occurred when TLC was evaluating the nested +expressions at the following positions: +0. Line 112, column 5 to line 128, column 57 in replicated +1. Line 112, column 8 to line 112, column 27 in replicated +2. Line 113, column 8 to line 127, column 80 in replicated +3. Line 127, column 9 to line 127, column 80 in replicated +4. Line 127, column 29 to line 127, column 80 in replicated +5. Line 127, column 71 to line 127, column 79 in replicated +6. Line 125, column 22 to line 125, column 46 in replicated +7. Line 27, column 3 to line 27, column 36 in replicated + + +@!@!@ENDMSG 2103 @!@!@ +@!@!@STARTMSG 2201:0 @!@!@ +The coverage statistics at 2025-01-19 23:35:33 +@!@!@ENDMSG 2201 @!@!@ +@!@!@STARTMSG 2773:0 @!@!@ +: 2:2 +@!@!@ENDMSG 2773 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 50, col 5 to line 53, col 26 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 1:7 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 56, col 8 to line 59, col 44 of module replicated: 7 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 56, col 18 to line 59, col 44 of module replicated: 7 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 57, col 9 to line 59, col 44 of module replicated: 749 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 57, col 12 to line 57, col 48 of module replicated: 749 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 58, col 12 to line 58, col 44 of module replicated: 301 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 59, col 12 to line 59, col 44 of module replicated: 98 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 56, col 32 to line 56, col 48 of module replicated: 7 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 60, col 8 to line 60, col 67 of module replicated: 7 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 4:15 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 63, col 8 to line 63, col 32 of module replicated: 62 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 63, col 8 to line 63, col 15 of module replicated: 47:110 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 63, col 27 to line 63, col 32 of module replicated: 47 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 64, col 8 to line 64, col 14 of module replicated: 47 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 64, col 8 to line 64, col 9 of module replicated: 32 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 64, col 13 to line 64, col 14 of module replicated: 32 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 65, col 8 to line 65, col 72 of module replicated: 34 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 65, col 8 to line 65, col 38 of module replicated: 19 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 65, col 42 to line 65, col 72 of module replicated: 19 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 69, col 13 to line 71, col 50 of module replicated: 15 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 72, col 8 to line 72, col 58 of module replicated: 15 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 75, col 8 to line 75, col 32 of module replicated: 46 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 76, col 8 to line 76, col 72 of module replicated: 31 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 77, col 8 to line 77, col 71 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 78, col 8 to line 78, col 102 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 79, col 8 to line 79, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 2:30 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 82, col 8 to line 82, col 30 of module replicated: 75 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 82, col 8 to line 82, col 13 of module replicated: 45:111 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 82, col 25 to line 82, col 30 of module replicated: 45 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 83, col 8 to line 90, col 52 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 91, col 8 to line 91, col 62 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 100, col 13 to line 102, col 37 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 103, col 8 to line 103, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 5:30 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 107, col 8 to line 107, col 29 of module replicated: 75 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 107, col 8 to line 107, col 12 of module replicated: 45:111 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 107, col 24 to line 107, col 29 of module replicated: 45 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 108, col 8 to line 108, col 81 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 109, col 8 to line 109, col 57 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 112, col 8 to line 112, col 27 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 127, col 9 to line 127, col 80 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 127, col 29 to line 127, col 80 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 127, col 30 to line 127, col 45 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 127, col 54 to line 127, col 79 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 127, col 71 to line 127, col 79 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 125, col 22 to line 125, col 46 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 27, col 3 to line 27, col 36 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 125, col 31 to line 125, col 45 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |||||line 118, col 28 to line 124, col 13 of module replicated: 5:5 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||line 123, col 27 to line 123, col 35 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||line 117, col 22 to line 117, col 64 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + ||||||||line 117, col 29 to line 117, col 63 of module replicated: 5:5 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||||line 117, col 51 to line 117, col 62 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||||line 116, col 25 to line 116, col 65 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |||||||||||line 116, col 25 to line 116, col 56 of module replicated: 5:5 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||||||line 116, col 26 to line 116, col 33 of module replicated: 15 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||||||line 116, col 43 to line 116, col 54 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||||||line 116, col 60 to line 116, col 65 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 128, col 8 to line 128, col 57 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 140, col 8 to line 140, col 109 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 141, col 8 to line 141, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2774:0 @!@!@ + +@!@!@ENDMSG 2774 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 163, col 13 to line 164, col 81 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 163, col 35 to line 164, col 81 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 164, col 9 to line 164, col 81 of module replicated: 39 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 163, col 44 to line 163, col 72 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 163, col 22 to line 163, col 32 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2774:0 @!@!@ + +@!@!@ENDMSG 2774 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 167, col 5 to line 169, col 88 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 167, col 47 to line 169, col 88 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 168, col 9 to line 169, col 88 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 168, col 12 to line 169, col 88 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 168, col 13 to line 168, col 85 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 169, col 16 to line 169, col 88 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 167, col 61 to line 167, col 83 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 167, col 21 to line 167, col 43 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2202:0 @!@!@ +End of statistics. +@!@!@ENDMSG 2202 @!@!@ +@!@!@STARTMSG 2200:0 @!@!@ +Progress(4) at 2025-01-19 23:35:33: 69 states generated (1.712 s/min), 13 distinct states found (322 ds/min), 9 states left on queue. +@!@!@ENDMSG 2200 @!@!@ +@!@!@STARTMSG 2199:0 @!@!@ +69 states generated, 13 distinct states found, 9 states left on queue. +@!@!@ENDMSG 2199 @!@!@ +@!@!@STARTMSG 2186:0 @!@!@ +Finished in 2433ms at (2025-01-19 23:35:33) +@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326135419/MC.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326135419/MC.tla new file mode 100644 index 0000000000..0fea15b859 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326135419/MC.tla @@ -0,0 +1,65 @@ +---- MODULE MC ---- +EXTENDS replicated, TLC + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +b1, b2, b3 +---- + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +s1, s2, s3 +---- + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +p1 +---- + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +az1, az2, az3 +---- + +\* MV CONSTANT definitions brokers +const_1737326131354349000 == +{b1, b2, b3} +---- + +\* MV CONSTANT definitions safekeepers +const_1737326131354350000 == +{s1, s2, s3} +---- + +\* MV CONSTANT definitions pageservers +const_1737326131354351000 == +{p1} +---- + +\* MV CONSTANT definitions azs +const_1737326131354352000 == +{az1, az2, az3} +---- + +\* SYMMETRY definition +symm_1737326131354353000 == +Permutations(const_1737326131354349000) \union Permutations(const_1737326131354350000) \union Permutations(const_1737326131354351000) \union Permutations(const_1737326131354352000) +---- + +\* CONSTANT definitions @modelParameterConstants:4max_commit_lsn +const_1737326131354354000 == +2 +---- + +\* CONSTANT definitions @modelParameterConstants:5az_mapping +const_1737326131354355000 == +[ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2} , az3 |-> {b3,s3}] +---- + +\* CONSTRAINT definition @modelParameterContraint:0 +constr_1737326131354356000 == +StateConstraint +---- +============================================================================= +\* Modification History +\* Created Sun Jan 19 23:35:31 CET 2025 by cs diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326135419/MC_TE.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326135419/MC_TE.out new file mode 100644 index 0000000000..8faf336b8d --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326135419/MC_TE.out @@ -0,0 +1,358 @@ +@!@!@STARTMSG 2262:0 @!@!@ +TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) +@!@!@ENDMSG 2262 @!@!@ +@!@!@STARTMSG 2187:0 @!@!@ +Running breadth-first search Model-Checking with fp 0 and seed 849358144369345749 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 24597] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +@!@!@ENDMSG 2187 @!@!@ +@!@!@STARTMSG 2220:0 @!@!@ +Starting SANY... +@!@!@ENDMSG 2220 @!@!@ +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla +Semantic processing of module Naturals +Semantic processing of module Integers +Semantic processing of module Sequences +Semantic processing of module FiniteSets +Semantic processing of module replicated +Semantic processing of module TLC +Semantic processing of module MC +@!@!@STARTMSG 2219:0 @!@!@ +SANY finished. +@!@!@ENDMSG 2219 @!@!@ +@!@!@STARTMSG 2185:0 @!@!@ +Starting... (2025-01-19 23:35:32) +@!@!@ENDMSG 2185 @!@!@ +@!@!@STARTMSG 2279:3 @!@!@ +Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. +@!@!@ENDMSG 2279 @!@!@ +@!@!@STARTMSG 2284:3 @!@!@ +Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. +@!@!@ENDMSG 2284 @!@!@ +@!@!@STARTMSG 2212:0 @!@!@ +Implied-temporal checking--satisfiability problem has 1 branches. +@!@!@ENDMSG 2212 @!@!@ +@!@!@STARTMSG 2189:0 @!@!@ +Computing initial states... +@!@!@ENDMSG 2189 @!@!@ +@!@!@STARTMSG 2190:0 @!@!@ +Finished computing initial states: 1 distinct state generated at 2025-01-19 23:35:33. +@!@!@ENDMSG 2190 @!@!@ +@!@!@STARTMSG 1000:1 @!@!@ +TLC threw an unexpected exception. +This was probably caused by an error in the spec or model. +See the User Output or TLC Console for clues to what happened. +The exception was a java.lang.RuntimeException +: Attempted to compute the value of an expression of form +CHOOSE x \in S: P, but no element of S satisfied P. +line 27, col 3 to line 27, col 36 of module replicated +@!@!@ENDMSG 1000 @!@!@ +@!@!@STARTMSG 2121:1 @!@!@ +The behavior up to this point is: +@!@!@ENDMSG 2121 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +1: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, b3, s1, s2, s3, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +2: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, s1, s2, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +3: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, s1, s2, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 1, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 1, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2103:1 @!@!@ +The error occurred when TLC was evaluating the nested +expressions at the following positions: +0. Line 112, column 5 to line 128, column 57 in replicated +1. Line 112, column 8 to line 112, column 27 in replicated +2. Line 113, column 8 to line 127, column 80 in replicated +3. Line 127, column 9 to line 127, column 80 in replicated +4. Line 127, column 29 to line 127, column 80 in replicated +5. Line 127, column 71 to line 127, column 79 in replicated +6. Line 125, column 22 to line 125, column 46 in replicated +7. Line 27, column 3 to line 27, column 36 in replicated + + +@!@!@ENDMSG 2103 @!@!@ +@!@!@STARTMSG 2201:0 @!@!@ +The coverage statistics at 2025-01-19 23:35:33 +@!@!@ENDMSG 2201 @!@!@ +@!@!@STARTMSG 2773:0 @!@!@ +: 2:2 +@!@!@ENDMSG 2773 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 50, col 5 to line 53, col 26 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 1:7 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 56, col 8 to line 59, col 44 of module replicated: 7 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 56, col 18 to line 59, col 44 of module replicated: 7 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 57, col 9 to line 59, col 44 of module replicated: 749 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 57, col 12 to line 57, col 48 of module replicated: 749 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 58, col 12 to line 58, col 44 of module replicated: 301 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 59, col 12 to line 59, col 44 of module replicated: 98 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 56, col 32 to line 56, col 48 of module replicated: 7 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 60, col 8 to line 60, col 67 of module replicated: 7 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 4:15 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 63, col 8 to line 63, col 32 of module replicated: 62 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 63, col 8 to line 63, col 15 of module replicated: 47:110 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 63, col 27 to line 63, col 32 of module replicated: 47 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 64, col 8 to line 64, col 14 of module replicated: 47 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 64, col 8 to line 64, col 9 of module replicated: 32 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 64, col 13 to line 64, col 14 of module replicated: 32 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 65, col 8 to line 65, col 72 of module replicated: 34 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 65, col 8 to line 65, col 38 of module replicated: 19 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 65, col 42 to line 65, col 72 of module replicated: 19 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 69, col 13 to line 71, col 50 of module replicated: 15 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 72, col 8 to line 72, col 58 of module replicated: 15 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 75, col 8 to line 75, col 32 of module replicated: 46 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 76, col 8 to line 76, col 72 of module replicated: 31 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 77, col 8 to line 77, col 71 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 78, col 8 to line 78, col 102 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 79, col 8 to line 79, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 2:30 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 82, col 8 to line 82, col 30 of module replicated: 75 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 82, col 8 to line 82, col 13 of module replicated: 45:111 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 82, col 25 to line 82, col 30 of module replicated: 45 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 83, col 8 to line 90, col 52 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 91, col 8 to line 91, col 62 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 100, col 13 to line 102, col 37 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 103, col 8 to line 103, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 5:30 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 107, col 8 to line 107, col 29 of module replicated: 75 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 107, col 8 to line 107, col 12 of module replicated: 45:111 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 107, col 24 to line 107, col 29 of module replicated: 45 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 108, col 8 to line 108, col 81 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 109, col 8 to line 109, col 57 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 112, col 8 to line 112, col 27 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 127, col 9 to line 127, col 80 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 127, col 29 to line 127, col 80 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 127, col 30 to line 127, col 45 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 127, col 54 to line 127, col 79 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 127, col 71 to line 127, col 79 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 125, col 22 to line 125, col 46 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 27, col 3 to line 27, col 36 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 125, col 31 to line 125, col 45 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |||||line 118, col 28 to line 124, col 13 of module replicated: 5:5 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||line 123, col 27 to line 123, col 35 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||line 117, col 22 to line 117, col 64 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + ||||||||line 117, col 29 to line 117, col 63 of module replicated: 5:5 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||||line 117, col 51 to line 117, col 62 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||||line 116, col 25 to line 116, col 65 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |||||||||||line 116, col 25 to line 116, col 56 of module replicated: 5:5 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||||||line 116, col 26 to line 116, col 33 of module replicated: 15 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||||||line 116, col 43 to line 116, col 54 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||||||line 116, col 60 to line 116, col 65 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 128, col 8 to line 128, col 57 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 140, col 8 to line 140, col 109 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 141, col 8 to line 141, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2774:0 @!@!@ + +@!@!@ENDMSG 2774 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 163, col 13 to line 164, col 81 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 163, col 35 to line 164, col 81 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 164, col 9 to line 164, col 81 of module replicated: 39 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 163, col 44 to line 163, col 72 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 163, col 22 to line 163, col 32 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2774:0 @!@!@ + +@!@!@ENDMSG 2774 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 167, col 5 to line 169, col 88 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 167, col 47 to line 169, col 88 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 168, col 9 to line 169, col 88 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 168, col 12 to line 169, col 88 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 168, col 13 to line 168, col 85 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 169, col 16 to line 169, col 88 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 167, col 61 to line 167, col 83 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 167, col 21 to line 167, col 43 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2202:0 @!@!@ +End of statistics. +@!@!@ENDMSG 2202 @!@!@ +@!@!@STARTMSG 2200:0 @!@!@ +Progress(4) at 2025-01-19 23:35:33: 69 states generated (1.712 s/min), 13 distinct states found (322 ds/min), 9 states left on queue. +@!@!@ENDMSG 2200 @!@!@ +@!@!@STARTMSG 2199:0 @!@!@ +69 states generated, 13 distinct states found, 9 states left on queue. +@!@!@ENDMSG 2199 @!@!@ +@!@!@STARTMSG 2186:0 @!@!@ +Finished in 2433ms at (2025-01-19 23:35:33) +@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326135419/replicated.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326135419/replicated.tla new file mode 100644 index 0000000000..122e04e235 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326135419/replicated.tla @@ -0,0 +1,184 @@ +---- MODULE replicated ---- + +EXTENDS Integers, FiniteSets + +VARIABLES broker_state, safekeeper_state, pageserver_state, online + + +CONSTANT + brokers, + safekeepers, + pageservers, + azs, + az_mapping + +CONSTANT + NULL + +CONSTANT + max_commit_lsn + +\* HELPERS + +Max(a,b) == IF a > b THEN a ELSE b + +(* The minimum of a non-empty set of integers *) +MinOfSet(S) == + CHOOSE x \in S: \A y \in S: x <= y + +(* The minimum of a non-empty set of integers *) +MaxOfSet(S) == + CHOOSE x \in S: \A y \in S: x >= y + +\* END HELPERS + +StateConstraint == + /\ \A s \in safekeepers: + /\ safekeeper_state[s].commit_lsn <= max_commit_lsn + /\ \A b \in brokers: + /\ \A s \in DOMAIN broker_state[b].sk: + /\ broker_state[b].sk[s].commit_lsn <= max_commit_lsn + + + +InitSafekeeper == [prune_lsn |-> 0, commit_lsn |-> 0, rx |-> [b \in brokers |-> NULL] ] +InitBroker == [sk |-> [s \in safekeepers |-> [prune_lsn |-> 0, commit_lsn |-> 0]]] +InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] +InitOnline == safekeepers \cup brokers \cup pageservers + +Init == + /\ broker_state = [b \in brokers |-> InitBroker] + /\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper] + /\ pageserver_state = [p \in pageservers |-> InitPageserver] + /\ online = InitOnline + +NodeOnlineOffline == + /\ online' = CHOOSE ss \in SUBSET InitOnline: + /\ Cardinality(ss \cap safekeepers) >= 2 + /\ Cardinality(ss \cap brokers) >= 2 + /\ ss \cap pageservers = pageservers \* assume no PS failures for now + /\ UNCHANGED <> + +SkCommit(s1, s2) == + /\ {s1, s2} \subseteq online + /\ s1 # s2 + /\ safekeeper_state[s1].commit_lsn = safekeeper_state[s2].commit_lsn + /\ LET + new_commit_lsn == safekeeper_state[s1].commit_lsn + 1 + IN + safekeeper_state' = [safekeeper_state EXCEPT + ![s1].commit_lsn = new_commit_lsn, + ![s2].commit_lsn = new_commit_lsn] + /\ UNCHANGED <> + +SkPeerRecovery(s1,s2) == + /\ {s1, s2} \subseteq online + /\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn \* s2 has more WAL than s1 + /\ safekeeper_state[s2].prune_lsn < safekeeper_state[s1].commit_lsn \* s2 has not yet trimmed the WAL the WAL + /\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn] + /\ UNCHANGED <> + +SkPushToBroker(s,b) == + /\ {s, b} \subseteq online + /\ broker_state' = LET + broker_side == broker_state[b].sk[s] + sk_side == safekeeper_state[s] + merged == [broker_side EXCEPT + !["commit_lsn"] = Max(broker_side.commit_lsn, sk_side.commit_lsn), + !["prune_lsn"] = Max(broker_side.prune_lsn, sk_side.prune_lsn)] + IN + [broker_state EXCEPT ![b].sk[s] = merged] + /\ UNCHANGED <> + +PsRecvBroker(b,p,s) == + /\ {b,p,s} \subseteq online + /\ LET + bsk == broker_state[b].sk[s] + psk == pageserver_state[p].sk[s] + updpsk == [psk EXCEPT !["commit_lsn"] = bsk.commit_lsn] + IN + pageserver_state' = IF bsk.commit_lsn > psk.commit_lsn + THEN [pageserver_state EXCEPT ![p].sk[s] = updpsk] + ELSE pageserver_state + /\ UNCHANGED <> + + +SkRecvBroker(b,s) == + /\ {b,s} \subseteq online + /\ safekeeper_state' = [safekeeper_state EXCEPT ![s].rx[b] = broker_state[b]] + /\ UNCHANGED <> + +SkPrune(s) == + /\ {s} \subseteq online + /\ LET + sk == safekeeper_state[s] + + broker_infos == {sk.rx[b]: b \in (DOMAIN sk.rx)} \ {NULL} + known_sks == UNION ({DOMAIN bi.sk: bi \in broker_infos}) + max_commit_lsns == { + MaxOfSet( + { + sk.rx[b].sk[s2].commit_lsn: b \in DOMAIN sk.rx + } + ): s2 \in known_sks + } + prune_lsn == MinOfSet(max_commit_lsns) + IN + safekeeper_state' = [safekeeper_state EXCEPT ![s].prune_lsn = prune_lsn] + /\ UNCHANGED <> + + +SksWithNewerWal(p) == + LET + ps == pageserver_state[p] + IN + {s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn} + +PsChooseSk(p) == + /\ {p} \subseteq online + /\ SksWithNewerWal(p) # {} + /\ pageserver_state' = [pageserver_state EXCEPT![p].preferred_sk = CHOOSE s \in SksWithNewerWal(p): TRUE] + /\ UNCHANGED <> + + +Next == + \/ NodeOnlineOffline + \/ \E s1 \in safekeepers: \E s2 \in safekeepers: + \/ SkCommit(s1, s2) + \/ SkPeerRecovery(s1, s2) + \/ \E s \in safekeepers: \E b \in brokers: + \/ SkPushToBroker(s, b) + \/ SkRecvBroker(b, s) + \/ \E s \in safekeepers: + \/ SkPrune(s) + \/ \E s \in safekeepers: \E b \in brokers: \E p \in pageservers: PsRecvBroker(b,p,s) + \/ \E p \in pageservers: PsChooseSk(p) + + +Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state,online>> + + +\* invariants + +PsLagsSk == \A p \in pageservers: \A s \in DOMAIN pageserver_state[p].sk: + /\ pageserver_state[p].sk[s].commit_lsn <= safekeeper_state[s].commit_lsn + +PeerRecoveryIsPossible == + \A laggard \in (safekeepers \cap online): \E donor \in (safekeepers \cap online): + /\ (safekeeper_state[laggard].commit_lsn < safekeeper_state[donor].commit_lsn) + => safekeeper_state[donor].prune_lsn <= safekeeper_state[laggard].commit_lsn + + +EventuallyLaggingSkIsNotPreferredSk == <>( + LET + sks == safekeeper_state + lagging_sks == { s \in safekeepers: \A s2 \in safekeepers: sks[s].commit_lsn <= sks[s2].commit_lsn } + preferred_sks == {pageserver_state[p].preferred_sk: p \in pageservers} + IN + preferred_sks \cap lagging_sks = {} + + ) + + + +==== \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326274268/MC.cfg b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326274268/MC.cfg new file mode 100644 index 0000000000..0e18809f3a --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326274268/MC.cfg @@ -0,0 +1,54 @@ +\* MV CONSTANT declarations +CONSTANTS +b1 = b1 +b2 = b2 +b3 = b3 +\* MV CONSTANT declarations +CONSTANTS +s1 = s1 +s2 = s2 +s3 = s3 +\* MV CONSTANT declarations +CONSTANTS +p1 = p1 +\* MV CONSTANT declarations +CONSTANTS +az1 = az1 +az2 = az2 +az3 = az3 +\* MV CONSTANT definitions +CONSTANT +brokers <- const_1737326270219360000 +\* CONSTANT declarations +CONSTANT NULL = NULL +\* MV CONSTANT definitions +CONSTANT +safekeepers <- const_1737326270219361000 +\* MV CONSTANT definitions +CONSTANT +pageservers <- const_1737326270219362000 +\* MV CONSTANT definitions +CONSTANT +azs <- const_1737326270219363000 +\* SYMMETRY definition +SYMMETRY symm_1737326270219364000 +\* CONSTANT definitions +CONSTANT +max_commit_lsn <- const_1737326270219365000 +\* CONSTANT definitions +CONSTANT +az_mapping <- const_1737326270219366000 +\* CONSTRAINT definition +CONSTRAINT +constr_1737326270219367000 +\* SPECIFICATION definition +SPECIFICATION +Spec +\* INVARIANT definition +INVARIANT +PsLagsSk +PeerRecoveryIsPossible +\* PROPERTY definition +PROPERTY +EventuallyLaggingSkIsNotPreferredSk +\* Generated on Sun Jan 19 23:37:50 CET 2025 \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326274268/MC.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326274268/MC.out new file mode 100644 index 0000000000..c00d69a3e2 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326274268/MC.out @@ -0,0 +1,450 @@ +@!@!@STARTMSG 2262:0 @!@!@ +TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) +@!@!@ENDMSG 2262 @!@!@ +@!@!@STARTMSG 2187:0 @!@!@ +Running breadth-first search Model-Checking with fp 125 and seed -2645522394156634911 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 24715] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +@!@!@ENDMSG 2187 @!@!@ +@!@!@STARTMSG 2220:0 @!@!@ +Starting SANY... +@!@!@ENDMSG 2220 @!@!@ +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla +Semantic processing of module Naturals +Semantic processing of module Integers +Semantic processing of module Sequences +Semantic processing of module FiniteSets +Semantic processing of module replicated +Semantic processing of module TLC +Semantic processing of module MC +@!@!@STARTMSG 2219:0 @!@!@ +SANY finished. +@!@!@ENDMSG 2219 @!@!@ +@!@!@STARTMSG 2185:0 @!@!@ +Starting... (2025-01-19 23:37:51) +@!@!@ENDMSG 2185 @!@!@ +@!@!@STARTMSG 2279:3 @!@!@ +Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. +@!@!@ENDMSG 2279 @!@!@ +@!@!@STARTMSG 2284:3 @!@!@ +Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. +@!@!@ENDMSG 2284 @!@!@ +@!@!@STARTMSG 2212:0 @!@!@ +Implied-temporal checking--satisfiability problem has 1 branches. +@!@!@ENDMSG 2212 @!@!@ +@!@!@STARTMSG 2189:0 @!@!@ +Computing initial states... +@!@!@ENDMSG 2189 @!@!@ +@!@!@STARTMSG 2190:0 @!@!@ +Finished computing initial states: 1 distinct state generated at 2025-01-19 23:37:52. +@!@!@ENDMSG 2190 @!@!@ +@!@!@STARTMSG 1000:1 @!@!@ +TLC threw an unexpected exception. +This was probably caused by an error in the spec or model. +See the User Output or TLC Console for clues to what happened. +The exception was a java.lang.RuntimeException +: Attempted to select field "sk" from a non-record value NULL +line 121, col 25 to line 121, col 35 of module replicated +@!@!@ENDMSG 1000 @!@!@ +@!@!@STARTMSG 2121:1 @!@!@ +The behavior up to this point is: +@!@!@ENDMSG 2121 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +1: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, b3, s1, s2, s3, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +2: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, s1, s2, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +3: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, s1, s2, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2103:1 @!@!@ +The error occurred when TLC was evaluating the nested +expressions at the following positions: +0. Line 112, column 5 to line 128, column 57 in replicated +1. Line 112, column 8 to line 112, column 27 in replicated +2. Line 113, column 8 to line 127, column 80 in replicated +3. Line 127, column 9 to line 127, column 80 in replicated +4. Line 127, column 29 to line 127, column 80 in replicated +5. Line 127, column 71 to line 127, column 79 in replicated +6. Line 125, column 22 to line 125, column 82 in replicated +7. Line 125, column 25 to line 125, column 44 in replicated +8. Line 125, column 25 to line 125, column 39 in replicated +9. Line 118, column 28 to line 124, column 13 in replicated +10. Line 119, column 17 to line 123, column 17 in replicated +11. Line 31, column 3 to line 31, column 36 in replicated +12. Line 31, column 16 to line 31, column 16 in replicated +13. Line 120, column 21 to line 122, column 21 in replicated +14. Line 121, column 25 to line 121, column 50 in replicated +15. Line 121, column 25 to line 121, column 39 in replicated +16. Line 121, column 25 to line 121, column 35 in replicated + + +@!@!@ENDMSG 2103 @!@!@ +@!@!@STARTMSG 2201:0 @!@!@ +The coverage statistics at 2025-01-19 23:37:53 +@!@!@ENDMSG 2201 @!@!@ +@!@!@STARTMSG 2773:0 @!@!@ +: 2:2 +@!@!@ENDMSG 2773 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 50, col 5 to line 53, col 26 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 1:12 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 56, col 8 to line 59, col 44 of module replicated: 12 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 56, col 18 to line 59, col 44 of module replicated: 12 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 57, col 9 to line 59, col 44 of module replicated: 1284 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 57, col 12 to line 57, col 48 of module replicated: 1284 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 58, col 12 to line 58, col 44 of module replicated: 516 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 59, col 12 to line 59, col 44 of module replicated: 168 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 56, col 32 to line 56, col 48 of module replicated: 12 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 60, col 8 to line 60, col 67 of module replicated: 12 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 5:26 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 63, col 8 to line 63, col 32 of module replicated: 125 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 63, col 8 to line 63, col 15 of module replicated: 99:234 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 63, col 27 to line 63, col 32 of module replicated: 99 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 64, col 8 to line 64, col 14 of module replicated: 95 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 64, col 8 to line 64, col 9 of module replicated: 69 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 64, col 13 to line 64, col 14 of module replicated: 69 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 65, col 8 to line 65, col 72 of module replicated: 68 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 65, col 8 to line 65, col 38 of module replicated: 42 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 65, col 42 to line 65, col 72 of module replicated: 42 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 69, col 13 to line 71, col 50 of module replicated: 26 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 72, col 8 to line 72, col 58 of module replicated: 26 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 75, col 8 to line 75, col 32 of module replicated: 99 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 76, col 8 to line 76, col 72 of module replicated: 69 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 77, col 8 to line 77, col 71 of module replicated: 8 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 78, col 8 to line 78, col 102 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 79, col 8 to line 79, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 9:66 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 82, col 8 to line 82, col 30 of module replicated: 157 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 82, col 8 to line 82, col 13 of module replicated: 91:233 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 82, col 25 to line 82, col 30 of module replicated: 91 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 83, col 8 to line 90, col 52 of module replicated: 66 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 91, col 8 to line 91, col 62 of module replicated: 66 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 1:48 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 94, col 8 to line 94, col 31 of module replicated: 111 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 94, col 8 to line 94, col 14 of module replicated: 63:213 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 94, col 26 to line 94, col 31 of module replicated: 63 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 100, col 13 to line 102, col 37 of module replicated: 48 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 100, col 33 to line 102, col 37 of module replicated: 48 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 100, col 36 to line 100, col 66 of module replicated: 48 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 101, col 22 to line 101, col 66 of module replicated: 1 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 102, col 22 to line 102, col 37 of module replicated: 47 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 103, col 8 to line 103, col 58 of module replicated: 48 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 22:66 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 107, col 8 to line 107, col 29 of module replicated: 157 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 107, col 8 to line 107, col 12 of module replicated: 91:233 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 107, col 24 to line 107, col 29 of module replicated: 91 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 108, col 8 to line 108, col 81 of module replicated: 66 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 109, col 8 to line 109, col 57 of module replicated: 66 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:18 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 112, col 8 to line 112, col 27 of module replicated: 42 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 112, col 8 to line 112, col 10 of module replicated: 24:45 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 112, col 22 to line 112, col 27 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 127, col 9 to line 127, col 80 of module replicated: 18 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 127, col 29 to line 127, col 80 of module replicated: 21 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 127, col 30 to line 127, col 45 of module replicated: 21 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 127, col 54 to line 127, col 79 of module replicated: 21 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 127, col 71 to line 127, col 79 of module replicated: 21 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 125, col 22 to line 125, col 82 of module replicated: 21 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 125, col 25 to line 125, col 44 of module replicated: 21 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||line 125, col 25 to line 125, col 39 of module replicated: 21 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||line 118, col 28 to line 124, col 13 of module replicated: 21 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||line 119, col 17 to line 123, col 17 of module replicated: 3 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||line 31, col 3 to line 31, col 36 of module replicated: 3 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||line 120, col 21 to line 122, col 21 of module replicated: 3 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||||line 121, col 25 to line 121, col 50 of module replicated: 6 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||||line 121, col 25 to line 121, col 39 of module replicated: 6 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||||||line 121, col 25 to line 121, col 35 of module replicated: 6 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||||||line 121, col 37 to line 121, col 38 of module replicated: 3 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||||line 121, col 59 to line 121, col 70 of module replicated: 3 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||line 123, col 27 to line 123, col 35 of module replicated: 21 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||line 117, col 22 to line 117, col 64 of module replicated: 21 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |||||||||line 117, col 29 to line 117, col 63 of module replicated: 21:24 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||||line 117, col 30 to line 117, col 41 of module replicated: 3 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||||line 117, col 51 to line 117, col 62 of module replicated: 21 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||||||line 116, col 25 to line 116, col 65 of module replicated: 21 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + ||||||||||||line 116, col 25 to line 116, col 56 of module replicated: 21:24 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||||||||line 116, col 26 to line 116, col 33 of module replicated: 63 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||||||||line 116, col 43 to line 116, col 54 of module replicated: 21 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||||||line 116, col 60 to line 116, col 65 of module replicated: 21 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||line 125, col 43 to line 125, col 44 of module replicated: 18 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 128, col 8 to line 128, col 57 of module replicated: 18 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 138, col 8 to line 138, col 27 of module replicated: 7 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 139, col 8 to line 139, col 30 of module replicated: 7 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 139, col 8 to line 139, col 25 of module replicated: 7 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 133, col 15 to line 133, col 33 of module replicated: 7 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 135, col 5 to line 135, col 66 of module replicated: 7 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 135, col 26 to line 135, col 65 of module replicated: 21 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 135, col 12 to line 135, col 23 of module replicated: 7 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 139, col 24 to line 139, col 24 of module replicated: 7 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 139, col 29 to line 139, col 30 of module replicated: 7 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 140, col 8 to line 140, col 109 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 141, col 8 to line 141, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2774:0 @!@!@ + +@!@!@ENDMSG 2774 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 163, col 13 to line 164, col 81 of module replicated: 43 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 163, col 35 to line 164, col 81 of module replicated: 43 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 164, col 9 to line 164, col 81 of module replicated: 129 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 163, col 44 to line 163, col 72 of module replicated: 43 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 163, col 22 to line 163, col 32 of module replicated: 43 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2774:0 @!@!@ + +@!@!@ENDMSG 2774 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 167, col 5 to line 169, col 88 of module replicated: 43 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 167, col 47 to line 169, col 88 of module replicated: 116 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 168, col 9 to line 169, col 88 of module replicated: 116 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 168, col 12 to line 169, col 88 of module replicated: 116 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 168, col 13 to line 168, col 85 of module replicated: 116 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 169, col 16 to line 169, col 88 of module replicated: 28 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 167, col 61 to line 167, col 83 of module replicated: 116 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 167, col 21 to line 167, col 43 of module replicated: 43 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2202:0 @!@!@ +End of statistics. +@!@!@ENDMSG 2202 @!@!@ +@!@!@STARTMSG 2200:0 @!@!@ +Progress(5) at 2025-01-19 23:37:53: 220 states generated (4.929 s/min), 39 distinct states found (873 ds/min), 30 states left on queue. +@!@!@ENDMSG 2200 @!@!@ +@!@!@STARTMSG 2199:0 @!@!@ +220 states generated, 39 distinct states found, 30 states left on queue. +@!@!@ENDMSG 2199 @!@!@ +@!@!@STARTMSG 2186:0 @!@!@ +Finished in 2693ms at (2025-01-19 23:37:53) +@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326274268/MC.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326274268/MC.tla new file mode 100644 index 0000000000..e344ee6da8 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326274268/MC.tla @@ -0,0 +1,65 @@ +---- MODULE MC ---- +EXTENDS replicated, TLC + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +b1, b2, b3 +---- + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +s1, s2, s3 +---- + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +p1 +---- + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +az1, az2, az3 +---- + +\* MV CONSTANT definitions brokers +const_1737326270219360000 == +{b1, b2, b3} +---- + +\* MV CONSTANT definitions safekeepers +const_1737326270219361000 == +{s1, s2, s3} +---- + +\* MV CONSTANT definitions pageservers +const_1737326270219362000 == +{p1} +---- + +\* MV CONSTANT definitions azs +const_1737326270219363000 == +{az1, az2, az3} +---- + +\* SYMMETRY definition +symm_1737326270219364000 == +Permutations(const_1737326270219360000) \union Permutations(const_1737326270219361000) \union Permutations(const_1737326270219362000) \union Permutations(const_1737326270219363000) +---- + +\* CONSTANT definitions @modelParameterConstants:4max_commit_lsn +const_1737326270219365000 == +2 +---- + +\* CONSTANT definitions @modelParameterConstants:5az_mapping +const_1737326270219366000 == +[ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2} , az3 |-> {b3,s3}] +---- + +\* CONSTRAINT definition @modelParameterContraint:0 +constr_1737326270219367000 == +StateConstraint +---- +============================================================================= +\* Modification History +\* Created Sun Jan 19 23:37:50 CET 2025 by cs diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326274268/MC_TE.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326274268/MC_TE.out new file mode 100644 index 0000000000..c00d69a3e2 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326274268/MC_TE.out @@ -0,0 +1,450 @@ +@!@!@STARTMSG 2262:0 @!@!@ +TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) +@!@!@ENDMSG 2262 @!@!@ +@!@!@STARTMSG 2187:0 @!@!@ +Running breadth-first search Model-Checking with fp 125 and seed -2645522394156634911 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 24715] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +@!@!@ENDMSG 2187 @!@!@ +@!@!@STARTMSG 2220:0 @!@!@ +Starting SANY... +@!@!@ENDMSG 2220 @!@!@ +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla +Semantic processing of module Naturals +Semantic processing of module Integers +Semantic processing of module Sequences +Semantic processing of module FiniteSets +Semantic processing of module replicated +Semantic processing of module TLC +Semantic processing of module MC +@!@!@STARTMSG 2219:0 @!@!@ +SANY finished. +@!@!@ENDMSG 2219 @!@!@ +@!@!@STARTMSG 2185:0 @!@!@ +Starting... (2025-01-19 23:37:51) +@!@!@ENDMSG 2185 @!@!@ +@!@!@STARTMSG 2279:3 @!@!@ +Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. +@!@!@ENDMSG 2279 @!@!@ +@!@!@STARTMSG 2284:3 @!@!@ +Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. +@!@!@ENDMSG 2284 @!@!@ +@!@!@STARTMSG 2212:0 @!@!@ +Implied-temporal checking--satisfiability problem has 1 branches. +@!@!@ENDMSG 2212 @!@!@ +@!@!@STARTMSG 2189:0 @!@!@ +Computing initial states... +@!@!@ENDMSG 2189 @!@!@ +@!@!@STARTMSG 2190:0 @!@!@ +Finished computing initial states: 1 distinct state generated at 2025-01-19 23:37:52. +@!@!@ENDMSG 2190 @!@!@ +@!@!@STARTMSG 1000:1 @!@!@ +TLC threw an unexpected exception. +This was probably caused by an error in the spec or model. +See the User Output or TLC Console for clues to what happened. +The exception was a java.lang.RuntimeException +: Attempted to select field "sk" from a non-record value NULL +line 121, col 25 to line 121, col 35 of module replicated +@!@!@ENDMSG 1000 @!@!@ +@!@!@STARTMSG 2121:1 @!@!@ +The behavior up to this point is: +@!@!@ENDMSG 2121 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +1: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, b3, s1, s2, s3, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +2: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, s1, s2, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +3: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, s1, s2, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2103:1 @!@!@ +The error occurred when TLC was evaluating the nested +expressions at the following positions: +0. Line 112, column 5 to line 128, column 57 in replicated +1. Line 112, column 8 to line 112, column 27 in replicated +2. Line 113, column 8 to line 127, column 80 in replicated +3. Line 127, column 9 to line 127, column 80 in replicated +4. Line 127, column 29 to line 127, column 80 in replicated +5. Line 127, column 71 to line 127, column 79 in replicated +6. Line 125, column 22 to line 125, column 82 in replicated +7. Line 125, column 25 to line 125, column 44 in replicated +8. Line 125, column 25 to line 125, column 39 in replicated +9. Line 118, column 28 to line 124, column 13 in replicated +10. Line 119, column 17 to line 123, column 17 in replicated +11. Line 31, column 3 to line 31, column 36 in replicated +12. Line 31, column 16 to line 31, column 16 in replicated +13. Line 120, column 21 to line 122, column 21 in replicated +14. Line 121, column 25 to line 121, column 50 in replicated +15. Line 121, column 25 to line 121, column 39 in replicated +16. Line 121, column 25 to line 121, column 35 in replicated + + +@!@!@ENDMSG 2103 @!@!@ +@!@!@STARTMSG 2201:0 @!@!@ +The coverage statistics at 2025-01-19 23:37:53 +@!@!@ENDMSG 2201 @!@!@ +@!@!@STARTMSG 2773:0 @!@!@ +: 2:2 +@!@!@ENDMSG 2773 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 50, col 5 to line 53, col 26 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 1:12 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 56, col 8 to line 59, col 44 of module replicated: 12 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 56, col 18 to line 59, col 44 of module replicated: 12 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 57, col 9 to line 59, col 44 of module replicated: 1284 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 57, col 12 to line 57, col 48 of module replicated: 1284 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 58, col 12 to line 58, col 44 of module replicated: 516 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 59, col 12 to line 59, col 44 of module replicated: 168 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 56, col 32 to line 56, col 48 of module replicated: 12 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 60, col 8 to line 60, col 67 of module replicated: 12 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 5:26 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 63, col 8 to line 63, col 32 of module replicated: 125 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 63, col 8 to line 63, col 15 of module replicated: 99:234 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 63, col 27 to line 63, col 32 of module replicated: 99 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 64, col 8 to line 64, col 14 of module replicated: 95 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 64, col 8 to line 64, col 9 of module replicated: 69 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 64, col 13 to line 64, col 14 of module replicated: 69 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 65, col 8 to line 65, col 72 of module replicated: 68 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 65, col 8 to line 65, col 38 of module replicated: 42 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 65, col 42 to line 65, col 72 of module replicated: 42 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 69, col 13 to line 71, col 50 of module replicated: 26 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 72, col 8 to line 72, col 58 of module replicated: 26 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 75, col 8 to line 75, col 32 of module replicated: 99 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 76, col 8 to line 76, col 72 of module replicated: 69 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 77, col 8 to line 77, col 71 of module replicated: 8 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 78, col 8 to line 78, col 102 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 79, col 8 to line 79, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 9:66 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 82, col 8 to line 82, col 30 of module replicated: 157 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 82, col 8 to line 82, col 13 of module replicated: 91:233 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 82, col 25 to line 82, col 30 of module replicated: 91 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 83, col 8 to line 90, col 52 of module replicated: 66 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 91, col 8 to line 91, col 62 of module replicated: 66 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 1:48 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 94, col 8 to line 94, col 31 of module replicated: 111 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 94, col 8 to line 94, col 14 of module replicated: 63:213 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 94, col 26 to line 94, col 31 of module replicated: 63 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 100, col 13 to line 102, col 37 of module replicated: 48 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 100, col 33 to line 102, col 37 of module replicated: 48 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 100, col 36 to line 100, col 66 of module replicated: 48 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 101, col 22 to line 101, col 66 of module replicated: 1 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 102, col 22 to line 102, col 37 of module replicated: 47 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 103, col 8 to line 103, col 58 of module replicated: 48 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 22:66 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 107, col 8 to line 107, col 29 of module replicated: 157 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 107, col 8 to line 107, col 12 of module replicated: 91:233 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 107, col 24 to line 107, col 29 of module replicated: 91 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 108, col 8 to line 108, col 81 of module replicated: 66 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 109, col 8 to line 109, col 57 of module replicated: 66 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:18 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 112, col 8 to line 112, col 27 of module replicated: 42 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 112, col 8 to line 112, col 10 of module replicated: 24:45 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 112, col 22 to line 112, col 27 of module replicated: 24 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 127, col 9 to line 127, col 80 of module replicated: 18 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 127, col 29 to line 127, col 80 of module replicated: 21 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 127, col 30 to line 127, col 45 of module replicated: 21 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 127, col 54 to line 127, col 79 of module replicated: 21 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 127, col 71 to line 127, col 79 of module replicated: 21 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 125, col 22 to line 125, col 82 of module replicated: 21 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 125, col 25 to line 125, col 44 of module replicated: 21 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||line 125, col 25 to line 125, col 39 of module replicated: 21 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||line 118, col 28 to line 124, col 13 of module replicated: 21 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||line 119, col 17 to line 123, col 17 of module replicated: 3 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||line 31, col 3 to line 31, col 36 of module replicated: 3 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||line 120, col 21 to line 122, col 21 of module replicated: 3 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||||line 121, col 25 to line 121, col 50 of module replicated: 6 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||||line 121, col 25 to line 121, col 39 of module replicated: 6 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||||||line 121, col 25 to line 121, col 35 of module replicated: 6 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||||||line 121, col 37 to line 121, col 38 of module replicated: 3 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||||line 121, col 59 to line 121, col 70 of module replicated: 3 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||line 123, col 27 to line 123, col 35 of module replicated: 21 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||line 117, col 22 to line 117, col 64 of module replicated: 21 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |||||||||line 117, col 29 to line 117, col 63 of module replicated: 21:24 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||||line 117, col 30 to line 117, col 41 of module replicated: 3 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||||line 117, col 51 to line 117, col 62 of module replicated: 21 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||||||line 116, col 25 to line 116, col 65 of module replicated: 21 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + ||||||||||||line 116, col 25 to line 116, col 56 of module replicated: 21:24 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||||||||line 116, col 26 to line 116, col 33 of module replicated: 63 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||||||||||line 116, col 43 to line 116, col 54 of module replicated: 21 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||||||||||line 116, col 60 to line 116, col 65 of module replicated: 21 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||||line 125, col 43 to line 125, col 44 of module replicated: 18 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 128, col 8 to line 128, col 57 of module replicated: 18 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 138, col 8 to line 138, col 27 of module replicated: 7 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 139, col 8 to line 139, col 30 of module replicated: 7 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 139, col 8 to line 139, col 25 of module replicated: 7 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 133, col 15 to line 133, col 33 of module replicated: 7 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 135, col 5 to line 135, col 66 of module replicated: 7 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 135, col 26 to line 135, col 65 of module replicated: 21 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 135, col 12 to line 135, col 23 of module replicated: 7 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 139, col 24 to line 139, col 24 of module replicated: 7 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 139, col 29 to line 139, col 30 of module replicated: 7 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 140, col 8 to line 140, col 109 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 141, col 8 to line 141, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2774:0 @!@!@ + +@!@!@ENDMSG 2774 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 163, col 13 to line 164, col 81 of module replicated: 43 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 163, col 35 to line 164, col 81 of module replicated: 43 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 164, col 9 to line 164, col 81 of module replicated: 129 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 163, col 44 to line 163, col 72 of module replicated: 43 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 163, col 22 to line 163, col 32 of module replicated: 43 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2774:0 @!@!@ + +@!@!@ENDMSG 2774 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 167, col 5 to line 169, col 88 of module replicated: 43 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 167, col 47 to line 169, col 88 of module replicated: 116 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 168, col 9 to line 169, col 88 of module replicated: 116 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 168, col 12 to line 169, col 88 of module replicated: 116 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 168, col 13 to line 168, col 85 of module replicated: 116 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 169, col 16 to line 169, col 88 of module replicated: 28 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 167, col 61 to line 167, col 83 of module replicated: 116 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 167, col 21 to line 167, col 43 of module replicated: 43 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2202:0 @!@!@ +End of statistics. +@!@!@ENDMSG 2202 @!@!@ +@!@!@STARTMSG 2200:0 @!@!@ +Progress(5) at 2025-01-19 23:37:53: 220 states generated (4.929 s/min), 39 distinct states found (873 ds/min), 30 states left on queue. +@!@!@ENDMSG 2200 @!@!@ +@!@!@STARTMSG 2199:0 @!@!@ +220 states generated, 39 distinct states found, 30 states left on queue. +@!@!@ENDMSG 2199 @!@!@ +@!@!@STARTMSG 2186:0 @!@!@ +Finished in 2693ms at (2025-01-19 23:37:53) +@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326274268/replicated.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326274268/replicated.tla new file mode 100644 index 0000000000..210d322139 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737326274268/replicated.tla @@ -0,0 +1,184 @@ +---- MODULE replicated ---- + +EXTENDS Integers, FiniteSets + +VARIABLES broker_state, safekeeper_state, pageserver_state, online + + +CONSTANT + brokers, + safekeepers, + pageservers, + azs, + az_mapping + +CONSTANT + NULL + +CONSTANT + max_commit_lsn + +\* HELPERS + +Max(a,b) == IF a > b THEN a ELSE b + +(* The minimum of a non-empty set of integers *) +MinOfSet(S) == + CHOOSE x \in S: \A y \in S: x <= y + +(* The minimum of a non-empty set of integers *) +MaxOfSet(S) == + CHOOSE x \in S: \A y \in S: x >= y + +\* END HELPERS + +StateConstraint == + /\ \A s \in safekeepers: + /\ safekeeper_state[s].commit_lsn <= max_commit_lsn + /\ \A b \in brokers: + /\ \A s \in DOMAIN broker_state[b].sk: + /\ broker_state[b].sk[s].commit_lsn <= max_commit_lsn + + + +InitSafekeeper == [prune_lsn |-> 0, commit_lsn |-> 0, rx |-> [b \in brokers |-> NULL] ] +InitBroker == [sk |-> [s \in safekeepers |-> [prune_lsn |-> 0, commit_lsn |-> 0]]] +InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] +InitOnline == safekeepers \cup brokers \cup pageservers + +Init == + /\ broker_state = [b \in brokers |-> InitBroker] + /\ safekeeper_state = [s \in safekeepers |-> InitSafekeeper] + /\ pageserver_state = [p \in pageservers |-> InitPageserver] + /\ online = InitOnline + +NodeOnlineOffline == + /\ online' = CHOOSE ss \in SUBSET InitOnline: + /\ Cardinality(ss \cap safekeepers) >= 2 + /\ Cardinality(ss \cap brokers) >= 2 + /\ ss \cap pageservers = pageservers \* assume no PS failures for now + /\ UNCHANGED <> + +SkCommit(s1, s2) == + /\ {s1, s2} \subseteq online + /\ s1 # s2 + /\ safekeeper_state[s1].commit_lsn = safekeeper_state[s2].commit_lsn + /\ LET + new_commit_lsn == safekeeper_state[s1].commit_lsn + 1 + IN + safekeeper_state' = [safekeeper_state EXCEPT + ![s1].commit_lsn = new_commit_lsn, + ![s2].commit_lsn = new_commit_lsn] + /\ UNCHANGED <> + +SkPeerRecovery(s1,s2) == + /\ {s1, s2} \subseteq online + /\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn \* s2 has more WAL than s1 + /\ safekeeper_state[s2].prune_lsn < safekeeper_state[s1].commit_lsn \* s2 has not yet trimmed the WAL the WAL + /\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn] + /\ UNCHANGED <> + +SkPushToBroker(s,b) == + /\ {s, b} \subseteq online + /\ broker_state' = LET + broker_side == broker_state[b].sk[s] + sk_side == safekeeper_state[s] + merged == [broker_side EXCEPT + !["commit_lsn"] = Max(broker_side.commit_lsn, sk_side.commit_lsn), + !["prune_lsn"] = Max(broker_side.prune_lsn, sk_side.prune_lsn)] + IN + [broker_state EXCEPT ![b].sk[s] = merged] + /\ UNCHANGED <> + +PsRecvBroker(b,p,s) == + /\ {b,p,s} \subseteq online + /\ LET + bsk == broker_state[b].sk[s] + psk == pageserver_state[p].sk[s] + updpsk == [psk EXCEPT !["commit_lsn"] = bsk.commit_lsn] + IN + pageserver_state' = IF bsk.commit_lsn > psk.commit_lsn + THEN [pageserver_state EXCEPT ![p].sk[s] = updpsk] + ELSE pageserver_state + /\ UNCHANGED <> + + +SkRecvBroker(b,s) == + /\ {b,s} \subseteq online + /\ safekeeper_state' = [safekeeper_state EXCEPT ![s].rx[b] = broker_state[b]] + /\ UNCHANGED <> + +SkPrune(s) == + /\ {s} \subseteq online + /\ LET + sk == safekeeper_state[s] + + broker_infos == {sk.rx[b]: b \in (DOMAIN sk.rx)} \ {NULL} + known_sks == UNION ({DOMAIN bi.sk: bi \in broker_infos}) + max_commit_lsns == { + MaxOfSet( + { + sk.rx[b].sk[s2].commit_lsn: b \in DOMAIN sk.rx + } + ): s2 \in known_sks + } + prune_lsn == IF max_commit_lsns # {} THEN MinOfSet(max_commit_lsns) ELSE 0 + IN + safekeeper_state' = [safekeeper_state EXCEPT ![s].prune_lsn = prune_lsn] + /\ UNCHANGED <> + + +SksWithNewerWal(p) == + LET + ps == pageserver_state[p] + IN + {s \in DOMAIN ps.sk: ps.sk[s].commit_lsn > ps.last_record_lsn} + +PsChooseSk(p) == + /\ {p} \subseteq online + /\ SksWithNewerWal(p) # {} + /\ pageserver_state' = [pageserver_state EXCEPT![p].preferred_sk = CHOOSE s \in SksWithNewerWal(p): TRUE] + /\ UNCHANGED <> + + +Next == + \/ NodeOnlineOffline + \/ \E s1 \in safekeepers: \E s2 \in safekeepers: + \/ SkCommit(s1, s2) + \/ SkPeerRecovery(s1, s2) + \/ \E s \in safekeepers: \E b \in brokers: + \/ SkPushToBroker(s, b) + \/ SkRecvBroker(b, s) + \/ \E s \in safekeepers: + \/ SkPrune(s) + \/ \E s \in safekeepers: \E b \in brokers: \E p \in pageservers: PsRecvBroker(b,p,s) + \/ \E p \in pageservers: PsChooseSk(p) + + +Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state,online>> + + +\* invariants + +PsLagsSk == \A p \in pageservers: \A s \in DOMAIN pageserver_state[p].sk: + /\ pageserver_state[p].sk[s].commit_lsn <= safekeeper_state[s].commit_lsn + +PeerRecoveryIsPossible == + \A laggard \in (safekeepers \cap online): \E donor \in (safekeepers \cap online): + /\ (safekeeper_state[laggard].commit_lsn < safekeeper_state[donor].commit_lsn) + => safekeeper_state[donor].prune_lsn <= safekeeper_state[laggard].commit_lsn + + +EventuallyLaggingSkIsNotPreferredSk == <>( + LET + sks == safekeeper_state + lagging_sks == { s \in safekeepers: \A s2 \in safekeepers: sks[s].commit_lsn <= sks[s2].commit_lsn } + preferred_sks == {pageserver_state[p].preferred_sk: p \in pageservers} + IN + preferred_sks \cap lagging_sks = {} + + ) + + + +==== \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737327144010/MC.cfg b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737327144010/MC.cfg new file mode 100644 index 0000000000..bdb96f6768 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737327144010/MC.cfg @@ -0,0 +1,54 @@ +\* MV CONSTANT declarations +CONSTANTS +b1 = b1 +b2 = b2 +b3 = b3 +\* MV CONSTANT declarations +CONSTANTS +s1 = s1 +s2 = s2 +s3 = s3 +\* MV CONSTANT declarations +CONSTANTS +p1 = p1 +\* MV CONSTANT declarations +CONSTANTS +az1 = az1 +az2 = az2 +az3 = az3 +\* MV CONSTANT definitions +CONSTANT +brokers <- const_1737327139928371000 +\* CONSTANT declarations +CONSTANT NULL = NULL +\* MV CONSTANT definitions +CONSTANT +safekeepers <- const_1737327139928372000 +\* MV CONSTANT definitions +CONSTANT +pageservers <- const_1737327139928373000 +\* MV CONSTANT definitions +CONSTANT +azs <- const_1737327139928374000 +\* SYMMETRY definition +SYMMETRY symm_1737327139928375000 +\* CONSTANT definitions +CONSTANT +max_commit_lsn <- const_1737327139928376000 +\* CONSTANT definitions +CONSTANT +az_mapping <- const_1737327139928377000 +\* CONSTRAINT definition +CONSTRAINT +constr_1737327139928378000 +\* SPECIFICATION definition +SPECIFICATION +Spec +\* INVARIANT definition +INVARIANT +PsLagsSk +PeerRecoveryIsPossible +\* PROPERTY definition +PROPERTY +EventuallyLaggingSkIsNotPreferredSk +\* Generated on Sun Jan 19 23:52:19 CET 2025 \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737327144010/MC.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737327144010/MC.out new file mode 100644 index 0000000000..8dc89d4c05 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737327144010/MC.out @@ -0,0 +1,297 @@ +@!@!@STARTMSG 2262:0 @!@!@ +TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) +@!@!@ENDMSG 2262 @!@!@ +@!@!@STARTMSG 2187:0 @!@!@ +Running breadth-first search Model-Checking with fp 19 and seed -4531850586577240157 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 25317] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +@!@!@ENDMSG 2187 @!@!@ +@!@!@STARTMSG 2220:0 @!@!@ +Starting SANY... +@!@!@ENDMSG 2220 @!@!@ +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla +Semantic processing of module Naturals +Semantic processing of module Integers +Semantic processing of module Sequences +Semantic processing of module FiniteSets +Semantic processing of module replicated +Semantic processing of module TLC +Semantic processing of module MC +@!@!@STARTMSG 2219:0 @!@!@ +SANY finished. +@!@!@ENDMSG 2219 @!@!@ +@!@!@STARTMSG 2185:0 @!@!@ +Starting... (2025-01-19 23:52:21) +@!@!@ENDMSG 2185 @!@!@ +@!@!@STARTMSG 2279:3 @!@!@ +Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. +@!@!@ENDMSG 2279 @!@!@ +@!@!@STARTMSG 2284:3 @!@!@ +Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. +@!@!@ENDMSG 2284 @!@!@ +@!@!@STARTMSG 2212:0 @!@!@ +Implied-temporal checking--satisfiability problem has 1 branches. +@!@!@ENDMSG 2212 @!@!@ +@!@!@STARTMSG 2189:0 @!@!@ +Computing initial states... +@!@!@ENDMSG 2189 @!@!@ +@!@!@STARTMSG 2190:0 @!@!@ +Finished computing initial states: 1 distinct state generated at 2025-01-19 23:52:22. +@!@!@ENDMSG 2190 @!@!@ +@!@!@STARTMSG 2109:1 @!@!@ +Successor state is not completely specified by action SkPrune of the next-state relation. The following variable is not assigned: safekeeper_state. + +@!@!@ENDMSG 2109 @!@!@ +@!@!@STARTMSG 2121:1 @!@!@ +The behavior up to this point is: +@!@!@ENDMSG 2121 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +1: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, b3, s1, s2, s3, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +2: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, s1, s2, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +3: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, s1, s2, p1} +/\ safekeeper_state = null + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2201:0 @!@!@ +The coverage statistics at 2025-01-19 23:52:22 +@!@!@ENDMSG 2201 @!@!@ +@!@!@STARTMSG 2773:0 @!@!@ +: 2:2 +@!@!@ENDMSG 2773 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 50, col 5 to line 53, col 26 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 1:6 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 56, col 8 to line 59, col 44 of module replicated: 6 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 56, col 18 to line 59, col 44 of module replicated: 6 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 57, col 9 to line 59, col 44 of module replicated: 642 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 57, col 12 to line 57, col 48 of module replicated: 642 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 58, col 12 to line 58, col 44 of module replicated: 258 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 59, col 12 to line 59, col 44 of module replicated: 84 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 56, col 32 to line 56, col 48 of module replicated: 6 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 60, col 8 to line 60, col 67 of module replicated: 6 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 4:14 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 63, col 8 to line 63, col 32 of module replicated: 59 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 63, col 8 to line 63, col 15 of module replicated: 45:105 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 63, col 27 to line 63, col 32 of module replicated: 45 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 64, col 8 to line 64, col 14 of module replicated: 44 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 64, col 8 to line 64, col 9 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 64, col 13 to line 64, col 14 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 65, col 8 to line 65, col 72 of module replicated: 32 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 65, col 8 to line 65, col 38 of module replicated: 18 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 65, col 42 to line 65, col 72 of module replicated: 18 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 69, col 13 to line 71, col 50 of module replicated: 14 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 72, col 8 to line 72, col 58 of module replicated: 14 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 75, col 8 to line 75, col 32 of module replicated: 45 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 76, col 8 to line 76, col 72 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 77, col 8 to line 77, col 71 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 78, col 8 to line 78, col 102 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 79, col 8 to line 79, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 2:30 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 82, col 8 to line 82, col 30 of module replicated: 75 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 82, col 8 to line 82, col 13 of module replicated: 45:111 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 82, col 25 to line 82, col 30 of module replicated: 45 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 83, col 8 to line 90, col 52 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 91, col 8 to line 91, col 62 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 100, col 13 to line 102, col 37 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 103, col 8 to line 103, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 5:30 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 107, col 8 to line 107, col 29 of module replicated: 75 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 107, col 8 to line 107, col 12 of module replicated: 45:111 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 107, col 24 to line 107, col 29 of module replicated: 45 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 108, col 8 to line 108, col 81 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 109, col 8 to line 109, col 57 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:5 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 112, col 8 to line 112, col 27 of module replicated: 6 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 112, col 8 to line 112, col 10 of module replicated: 5:10 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 112, col 22 to line 112, col 27 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 117, col 9 to line 117, col 12 of module replicated: 1 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 118, col 8 to line 118, col 57 of module replicated: 1 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 130, col 8 to line 130, col 109 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 131, col 8 to line 131, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2774:0 @!@!@ + +@!@!@ENDMSG 2774 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 153, col 13 to line 154, col 81 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 153, col 35 to line 154, col 81 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 154, col 9 to line 154, col 81 of module replicated: 39 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 153, col 44 to line 153, col 72 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 153, col 22 to line 153, col 32 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2774:0 @!@!@ + +@!@!@ENDMSG 2774 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 157, col 5 to line 159, col 88 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 157, col 47 to line 159, col 88 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 158, col 9 to line 159, col 88 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 158, col 12 to line 159, col 88 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 158, col 13 to line 158, col 85 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 159, col 16 to line 159, col 88 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 157, col 61 to line 157, col 83 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 157, col 21 to line 157, col 43 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2202:0 @!@!@ +End of statistics. +@!@!@ENDMSG 2202 @!@!@ +@!@!@STARTMSG 2200:0 @!@!@ +Progress(4) at 2025-01-19 23:52:22: 73 states generated (1.649 s/min), 13 distinct states found (293 ds/min), 9 states left on queue. +@!@!@ENDMSG 2200 @!@!@ +@!@!@STARTMSG 2199:0 @!@!@ +73 states generated, 13 distinct states found, 9 states left on queue. +@!@!@ENDMSG 2199 @!@!@ +@!@!@STARTMSG 2194:0 @!@!@ +The depth of the complete state graph search is 4. +@!@!@ENDMSG 2194 @!@!@ +@!@!@STARTMSG 2186:0 @!@!@ +Finished in 2670ms at (2025-01-19 23:52:22) +@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737327144010/MC.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737327144010/MC.tla new file mode 100644 index 0000000000..a512c4d9d5 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737327144010/MC.tla @@ -0,0 +1,65 @@ +---- MODULE MC ---- +EXTENDS replicated, TLC + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +b1, b2, b3 +---- + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +s1, s2, s3 +---- + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +p1 +---- + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +az1, az2, az3 +---- + +\* MV CONSTANT definitions brokers +const_1737327139928371000 == +{b1, b2, b3} +---- + +\* MV CONSTANT definitions safekeepers +const_1737327139928372000 == +{s1, s2, s3} +---- + +\* MV CONSTANT definitions pageservers +const_1737327139928373000 == +{p1} +---- + +\* MV CONSTANT definitions azs +const_1737327139928374000 == +{az1, az2, az3} +---- + +\* SYMMETRY definition +symm_1737327139928375000 == +Permutations(const_1737327139928371000) \union Permutations(const_1737327139928372000) \union Permutations(const_1737327139928373000) \union Permutations(const_1737327139928374000) +---- + +\* CONSTANT definitions @modelParameterConstants:4max_commit_lsn +const_1737327139928376000 == +2 +---- + +\* CONSTANT definitions @modelParameterConstants:5az_mapping +const_1737327139928377000 == +[ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2} , az3 |-> {b3,s3}] +---- + +\* CONSTRAINT definition @modelParameterContraint:0 +constr_1737327139928378000 == +StateConstraint +---- +============================================================================= +\* Modification History +\* Created Sun Jan 19 23:52:19 CET 2025 by cs diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737327144010/MC_TE.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737327144010/MC_TE.out new file mode 100644 index 0000000000..8dc89d4c05 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737327144010/MC_TE.out @@ -0,0 +1,297 @@ +@!@!@STARTMSG 2262:0 @!@!@ +TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) +@!@!@ENDMSG 2262 @!@!@ +@!@!@STARTMSG 2187:0 @!@!@ +Running breadth-first search Model-Checking with fp 19 and seed -4531850586577240157 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 25317] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +@!@!@ENDMSG 2187 @!@!@ +@!@!@STARTMSG 2220:0 @!@!@ +Starting SANY... +@!@!@ENDMSG 2220 @!@!@ +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/MC.tla +Parsing file /Users/cs/src/neon/storage_broker/spec/replicated/replicated.toolbox/Model_1/replicated.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/TLC.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Integers.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/FiniteSets.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Naturals.tla +Parsing file /Applications/TLA+ Toolbox.app/Contents/Eclipse/plugins/org.lamport.tlatools_1.0.0.202408081326/tla2sany/StandardModules/Sequences.tla +Semantic processing of module Naturals +Semantic processing of module Integers +Semantic processing of module Sequences +Semantic processing of module FiniteSets +Semantic processing of module replicated +Semantic processing of module TLC +Semantic processing of module MC +@!@!@STARTMSG 2219:0 @!@!@ +SANY finished. +@!@!@ENDMSG 2219 @!@!@ +@!@!@STARTMSG 2185:0 @!@!@ +Starting... (2025-01-19 23:52:21) +@!@!@ENDMSG 2185 @!@!@ +@!@!@STARTMSG 2279:3 @!@!@ +Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. +@!@!@ENDMSG 2279 @!@!@ +@!@!@STARTMSG 2284:3 @!@!@ +Declaring state or action constraints during liveness checking is dangerous: Please read section 14.3.5 on page 247 of Specifying Systems (https://lamport.azurewebsites.net/tla/book.html) and optionally the discussion at https://discuss.tlapl.us/msg00994.html for more details. +@!@!@ENDMSG 2284 @!@!@ +@!@!@STARTMSG 2212:0 @!@!@ +Implied-temporal checking--satisfiability problem has 1 branches. +@!@!@ENDMSG 2212 @!@!@ +@!@!@STARTMSG 2189:0 @!@!@ +Computing initial states... +@!@!@ENDMSG 2189 @!@!@ +@!@!@STARTMSG 2190:0 @!@!@ +Finished computing initial states: 1 distinct state generated at 2025-01-19 23:52:22. +@!@!@ENDMSG 2190 @!@!@ +@!@!@STARTMSG 2109:1 @!@!@ +Successor state is not completely specified by action SkPrune of the next-state relation. The following variable is not assigned: safekeeper_state. + +@!@!@ENDMSG 2109 @!@!@ +@!@!@STARTMSG 2121:1 @!@!@ +The behavior up to this point is: +@!@!@ENDMSG 2121 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +1: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, b3, s1, s2, s3, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +2: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, s1, s2, p1} +/\ safekeeper_state = (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0, rx |-> (b1 :> NULL @@ b2 :> NULL @@ b3 :> NULL)]) + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2217:4 @!@!@ +3: +/\ pageserver_state = (p1 :> [sk |-> (s1 :> [commit_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0]), last_record_lsn |-> 0, preferred_sk |-> NULL]) +/\ broker_state = (b1 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b2 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])] @@ b3 :> [sk |-> (s1 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s2 :> [commit_lsn |-> 0, prune_lsn |-> 0] @@ s3 :> [commit_lsn |-> 0, prune_lsn |-> 0])]) +/\ online = {b1, b2, s1, s2, p1} +/\ safekeeper_state = null + +@!@!@ENDMSG 2217 @!@!@ +@!@!@STARTMSG 2201:0 @!@!@ +The coverage statistics at 2025-01-19 23:52:22 +@!@!@ENDMSG 2201 @!@!@ +@!@!@STARTMSG 2773:0 @!@!@ +: 2:2 +@!@!@ENDMSG 2773 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 50, col 5 to line 53, col 26 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 1:6 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 56, col 8 to line 59, col 44 of module replicated: 6 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 56, col 18 to line 59, col 44 of module replicated: 6 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 57, col 9 to line 59, col 44 of module replicated: 642 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 57, col 12 to line 57, col 48 of module replicated: 642 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 58, col 12 to line 58, col 44 of module replicated: 258 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 59, col 12 to line 59, col 44 of module replicated: 84 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 56, col 32 to line 56, col 48 of module replicated: 6 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 60, col 8 to line 60, col 67 of module replicated: 6 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 4:14 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 63, col 8 to line 63, col 32 of module replicated: 59 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 63, col 8 to line 63, col 15 of module replicated: 45:105 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 63, col 27 to line 63, col 32 of module replicated: 45 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 64, col 8 to line 64, col 14 of module replicated: 44 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 64, col 8 to line 64, col 9 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 64, col 13 to line 64, col 14 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 65, col 8 to line 65, col 72 of module replicated: 32 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 65, col 8 to line 65, col 38 of module replicated: 18 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 65, col 42 to line 65, col 72 of module replicated: 18 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 69, col 13 to line 71, col 50 of module replicated: 14 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 72, col 8 to line 72, col 58 of module replicated: 14 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 75, col 8 to line 75, col 32 of module replicated: 45 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 76, col 8 to line 76, col 72 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 77, col 8 to line 77, col 71 of module replicated: 2 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 78, col 8 to line 78, col 102 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 79, col 8 to line 79, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 2:30 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 82, col 8 to line 82, col 30 of module replicated: 75 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 82, col 8 to line 82, col 13 of module replicated: 45:111 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 82, col 25 to line 82, col 30 of module replicated: 45 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 83, col 8 to line 90, col 52 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 91, col 8 to line 91, col 62 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 100, col 13 to line 102, col 37 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 103, col 8 to line 103, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 5:30 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 107, col 8 to line 107, col 29 of module replicated: 75 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 107, col 8 to line 107, col 12 of module replicated: 45:111 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 107, col 24 to line 107, col 29 of module replicated: 45 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 108, col 8 to line 108, col 81 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 109, col 8 to line 109, col 57 of module replicated: 30 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:5 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 112, col 8 to line 112, col 27 of module replicated: 6 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2775:0 @!@!@ + |line 112, col 8 to line 112, col 10 of module replicated: 5:10 +@!@!@ENDMSG 2775 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 112, col 22 to line 112, col 27 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 117, col 9 to line 117, col 12 of module replicated: 1 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 118, col 8 to line 118, col 57 of module replicated: 1 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2772:0 @!@!@ +: 0:0 +@!@!@ENDMSG 2772 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 130, col 8 to line 130, col 109 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 131, col 8 to line 131, col 58 of module replicated: 0 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2774:0 @!@!@ + +@!@!@ENDMSG 2774 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 153, col 13 to line 154, col 81 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 153, col 35 to line 154, col 81 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 154, col 9 to line 154, col 81 of module replicated: 39 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 153, col 44 to line 153, col 72 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 153, col 22 to line 153, col 32 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2774:0 @!@!@ + +@!@!@ENDMSG 2774 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + line 157, col 5 to line 159, col 88 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 157, col 47 to line 159, col 88 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 158, col 9 to line 159, col 88 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |||line 158, col 12 to line 159, col 88 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 158, col 13 to line 158, col 85 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||||line 159, col 16 to line 159, col 88 of module replicated: 5 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + ||line 157, col 61 to line 157, col 83 of module replicated: 33 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2221:0 @!@!@ + |line 157, col 21 to line 157, col 43 of module replicated: 13 +@!@!@ENDMSG 2221 @!@!@ +@!@!@STARTMSG 2202:0 @!@!@ +End of statistics. +@!@!@ENDMSG 2202 @!@!@ +@!@!@STARTMSG 2200:0 @!@!@ +Progress(4) at 2025-01-19 23:52:22: 73 states generated (1.649 s/min), 13 distinct states found (293 ds/min), 9 states left on queue. +@!@!@ENDMSG 2200 @!@!@ +@!@!@STARTMSG 2199:0 @!@!@ +73 states generated, 13 distinct states found, 9 states left on queue. +@!@!@ENDMSG 2199 @!@!@ +@!@!@STARTMSG 2194:0 @!@!@ +The depth of the complete state graph search is 4. +@!@!@ENDMSG 2194 @!@!@ +@!@!@STARTMSG 2186:0 @!@!@ +Finished in 2670ms at (2025-01-19 23:52:22) +@!@!@ENDMSG 2186 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308216766/replicated.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737327144010/replicated.tla similarity index 66% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308216766/replicated.tla rename to storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737327144010/replicated.tla index 33971e3071..ba1484f85f 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308216766/replicated.tla +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737327144010/replicated.tla @@ -17,6 +17,20 @@ CONSTANT CONSTANT max_commit_lsn + +\* HELPERS + +Max(a,b) == IF a > b THEN a ELSE b + +(* The minimum of a non-empty set of integers *) +MinOfSet(S) == + CHOOSE x \in S: \A y \in S: x <= y + +(* The minimum of a non-empty set of integers *) +MaxOfSet(S) == + CHOOSE x \in S: \A y \in S: x >= y + +\* END HELPERS StateConstraint == /\ \A s \in safekeepers: @@ -25,9 +39,10 @@ StateConstraint == /\ \A s \in DOMAIN broker_state[b].sk: /\ broker_state[b].sk[s].commit_lsn <= max_commit_lsn + -InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0] -InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] +InitSafekeeper == [prune_lsn |-> 0, commit_lsn |-> 0, rx |-> [b \in brokers |-> NULL] ] +InitBroker == [sk |-> [s \in safekeepers |-> [prune_lsn |-> 0, commit_lsn |-> 0]]] InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] InitOnline == safekeepers \cup brokers \cup pageservers @@ -58,20 +73,21 @@ SkCommit(s1, s2) == SkPeerRecovery(s1,s2) == /\ {s1, s2} \subseteq online - /\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn + /\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn \* s2 has more WAL than s1 + /\ safekeeper_state[s2].prune_lsn < safekeeper_state[s1].commit_lsn \* s2 has not yet trimmed the WAL the WAL /\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn] /\ UNCHANGED <> SkPushToBroker(s,b) == /\ {s, b} \subseteq online - /\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn - THEN - LET - bsk == broker_state[b].sk - updbsk == [bsk EXCEPT ![s].commit_lsn = safekeeper_state[s].commit_lsn] - IN - [broker_state EXCEPT ![b].sk = updbsk] - ELSE broker_state + /\ broker_state' = LET + broker_side == broker_state[b].sk[s] + sk_side == safekeeper_state[s] + merged == [broker_side EXCEPT + !["commit_lsn"] = Max(broker_side.commit_lsn, sk_side.commit_lsn), + !["prune_lsn"] = Max(broker_side.prune_lsn, sk_side.prune_lsn)] + IN + [broker_state EXCEPT ![b].sk[s] = merged] /\ UNCHANGED <> PsRecvBroker(b,p,s) == @@ -86,6 +102,21 @@ PsRecvBroker(b,p,s) == ELSE pageserver_state /\ UNCHANGED <> + +SkRecvBroker(b,s) == + /\ {b,s} \subseteq online + /\ safekeeper_state' = [safekeeper_state EXCEPT ![s].rx[b] = broker_state[b]] + /\ UNCHANGED <> + +SkPrune(s) == + /\ {s} \subseteq online + /\ LET + sk == safekeeper_state[s] + skis == {<>: <> \in {<> \in { <>: b \in sk.rx }: bi # NULL} } + IN + TRUE + /\ UNCHANGED <> + SksWithNewerWal(p) == LET @@ -105,7 +136,11 @@ Next == \/ \E s1 \in safekeepers: \E s2 \in safekeepers: \/ SkCommit(s1, s2) \/ SkPeerRecovery(s1, s2) - \/ \E s \in safekeepers: \E b \in brokers: SkPushToBroker(s, b) + \/ \E s \in safekeepers: \E b \in brokers: + \/ SkPushToBroker(s, b) + \/ SkRecvBroker(b, s) + \/ \E s \in safekeepers: + \/ SkPrune(s) \/ \E s \in safekeepers: \E b \in brokers: \E p \in pageservers: PsRecvBroker(b,p,s) \/ \E p \in pageservers: PsChooseSk(p) @@ -117,7 +152,12 @@ Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state,onl PsLagsSk == \A p \in pageservers: \A s \in DOMAIN pageserver_state[p].sk: /\ pageserver_state[p].sk[s].commit_lsn <= safekeeper_state[s].commit_lsn - + +PeerRecoveryIsPossible == + \A laggard \in (safekeepers \cap online): \E donor \in (safekeepers \cap online): + /\ (safekeeper_state[laggard].commit_lsn < safekeeper_state[donor].commit_lsn) + => safekeeper_state[donor].prune_lsn <= safekeeper_state[laggard].commit_lsn + EventuallyLaggingSkIsNotPreferredSk == <>( LET diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737327172537/MC.cfg b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737327172537/MC.cfg new file mode 100644 index 0000000000..f1c0cf2115 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737327172537/MC.cfg @@ -0,0 +1,54 @@ +\* MV CONSTANT declarations +CONSTANTS +b1 = b1 +b2 = b2 +b3 = b3 +\* MV CONSTANT declarations +CONSTANTS +s1 = s1 +s2 = s2 +s3 = s3 +\* MV CONSTANT declarations +CONSTANTS +p1 = p1 +\* MV CONSTANT declarations +CONSTANTS +az1 = az1 +az2 = az2 +az3 = az3 +\* MV CONSTANT definitions +CONSTANT +brokers <- const_1737327160682382000 +\* CONSTANT declarations +CONSTANT NULL = NULL +\* MV CONSTANT definitions +CONSTANT +safekeepers <- const_1737327160682383000 +\* MV CONSTANT definitions +CONSTANT +pageservers <- const_1737327160682384000 +\* MV CONSTANT definitions +CONSTANT +azs <- const_1737327160682385000 +\* SYMMETRY definition +SYMMETRY symm_1737327160682386000 +\* CONSTANT definitions +CONSTANT +max_commit_lsn <- const_1737327160682387000 +\* CONSTANT definitions +CONSTANT +az_mapping <- const_1737327160682388000 +\* CONSTRAINT definition +CONSTRAINT +constr_1737327160682389000 +\* SPECIFICATION definition +SPECIFICATION +Spec +\* INVARIANT definition +INVARIANT +PsLagsSk +PeerRecoveryIsPossible +\* PROPERTY definition +PROPERTY +EventuallyLaggingSkIsNotPreferredSk +\* Generated on Sun Jan 19 23:52:40 CET 2025 \ No newline at end of file diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307769810/MC.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737327172537/MC.out similarity index 79% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307769810/MC.out rename to storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737327172537/MC.out index 21638f26fe..9996d5301e 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737307769810/MC.out +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737327172537/MC.out @@ -2,7 +2,7 @@ TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) @!@!@ENDMSG 2262 @!@!@ @!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 19 and seed -4959290627086969114 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11541] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +Running breadth-first search Model-Checking with fp 121 and seed -1130553646976177579 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 25330] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). @!@!@ENDMSG 2187 @!@!@ @!@!@STARTMSG 2220:0 @!@!@ Starting SANY... @@ -25,7 +25,7 @@ Semantic processing of module MC SANY finished. @!@!@ENDMSG 2219 @!@!@ @!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 18:29:15) +Starting... (2025-01-19 23:52:41) @!@!@ENDMSG 2185 @!@!@ @!@!@STARTMSG 2279:3 @!@!@ Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. @@ -40,14 +40,14 @@ Implied-temporal checking--satisfiability problem has 1 branches. Computing initial states... @!@!@ENDMSG 2189 @!@!@ @!@!@STARTMSG 2190:0 @!@!@ -Finished computing initial states: 1 distinct state generated at 2025-01-19 18:29:16. +Finished computing initial states: 1 distinct state generated at 2025-01-19 23:52:43. @!@!@ENDMSG 2190 @!@!@ @!@!@STARTMSG 2192:0 @!@!@ -Checking temporal properties for the current state space with 1431 total distinct states at (2025-01-19 18:29:19) +Checking temporal properties for the current state space with 1627 total distinct states at (2025-01-19 23:52:46) @!@!@ENDMSG 2192 @!@!@ @!@!@STARTMSG 2267:0 @!@!@ -Finished checking temporal properties in 00s at 2025-01-19 18:29:19 +Finished checking temporal properties in 00s at 2025-01-19 23:52:46 @!@!@ENDMSG 2267 @!@!@ @!@!@STARTMSG 2200:0 @!@!@ -Progress(10) at 2025-01-19 18:29:19: 38.274 states generated (38.274 s/min), 4.060 distinct states found (4.060 ds/min), 2.625 states left on queue. +Progress(9) at 2025-01-19 23:52:46: 45.678 states generated (45.678 s/min), 7.117 distinct states found (7.117 ds/min), 5.486 states left on queue. @!@!@ENDMSG 2200 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737327172537/MC.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737327172537/MC.tla new file mode 100644 index 0000000000..62ff97b5e7 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737327172537/MC.tla @@ -0,0 +1,65 @@ +---- MODULE MC ---- +EXTENDS replicated, TLC + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +b1, b2, b3 +---- + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +s1, s2, s3 +---- + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +p1 +---- + +\* MV CONSTANT declarations@modelParameterConstants +CONSTANTS +az1, az2, az3 +---- + +\* MV CONSTANT definitions brokers +const_1737327160682382000 == +{b1, b2, b3} +---- + +\* MV CONSTANT definitions safekeepers +const_1737327160682383000 == +{s1, s2, s3} +---- + +\* MV CONSTANT definitions pageservers +const_1737327160682384000 == +{p1} +---- + +\* MV CONSTANT definitions azs +const_1737327160682385000 == +{az1, az2, az3} +---- + +\* SYMMETRY definition +symm_1737327160682386000 == +Permutations(const_1737327160682382000) \union Permutations(const_1737327160682383000) \union Permutations(const_1737327160682384000) \union Permutations(const_1737327160682385000) +---- + +\* CONSTANT definitions @modelParameterConstants:4max_commit_lsn +const_1737327160682387000 == +2 +---- + +\* CONSTANT definitions @modelParameterConstants:5az_mapping +const_1737327160682388000 == +[ az1 |-> {b1,s1,p1} , az2 |-> {b2,s2} , az3 |-> {b3,s3}] +---- + +\* CONSTRAINT definition @modelParameterContraint:0 +constr_1737327160682389000 == +StateConstraint +---- +============================================================================= +\* Modification History +\* Created Sun Jan 19 23:52:40 CET 2025 by cs diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308216766/MC_TE.out b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737327172537/MC_TE.out similarity index 79% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308216766/MC_TE.out rename to storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737327172537/MC_TE.out index 366883d749..9996d5301e 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308216766/MC_TE.out +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737327172537/MC_TE.out @@ -2,7 +2,7 @@ TLC2 Version 2.19 of 08 August 2024 (rev: 5a47802) @!@!@ENDMSG 2262 @!@!@ @!@!@STARTMSG 2187:0 @!@!@ -Running breadth-first search Model-Checking with fp 39 and seed -9180611051874563891 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 11941] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). +Running breadth-first search Model-Checking with fp 121 and seed -1130553646976177579 with 4 workers on 8 cores with 2428MB heap and 5460MB offheap memory [pid: 25330] (Mac OS X 10.16 x86_64, AdoptOpenJDK 14.0.1 x86_64, OffHeapDiskFPSet, DiskStateQueue). @!@!@ENDMSG 2187 @!@!@ @!@!@STARTMSG 2220:0 @!@!@ Starting SANY... @@ -25,7 +25,7 @@ Semantic processing of module MC SANY finished. @!@!@ENDMSG 2219 @!@!@ @!@!@STARTMSG 2185:0 @!@!@ -Starting... (2025-01-19 18:36:40) +Starting... (2025-01-19 23:52:41) @!@!@ENDMSG 2185 @!@!@ @!@!@STARTMSG 2279:3 @!@!@ Declaring symmetry during liveness checking is dangerous. It might cause TLC to miss violations of the stated liveness properties. Please check liveness without symmetry defined. @@ -40,14 +40,14 @@ Implied-temporal checking--satisfiability problem has 1 branches. Computing initial states... @!@!@ENDMSG 2189 @!@!@ @!@!@STARTMSG 2190:0 @!@!@ -Finished computing initial states: 1 distinct state generated at 2025-01-19 18:36:41. +Finished computing initial states: 1 distinct state generated at 2025-01-19 23:52:43. @!@!@ENDMSG 2190 @!@!@ @!@!@STARTMSG 2192:0 @!@!@ -Checking temporal properties for the current state space with 3587 total distinct states at (2025-01-19 18:36:44) +Checking temporal properties for the current state space with 1627 total distinct states at (2025-01-19 23:52:46) @!@!@ENDMSG 2192 @!@!@ @!@!@STARTMSG 2267:0 @!@!@ -Finished checking temporal properties in 00s at 2025-01-19 18:36:44 +Finished checking temporal properties in 00s at 2025-01-19 23:52:46 @!@!@ENDMSG 2267 @!@!@ @!@!@STARTMSG 2200:0 @!@!@ -Progress(11) at 2025-01-19 18:36:44: 73.018 states generated (73.018 s/min), 8.206 distinct states found (8.206 ds/min), 4.615 states left on queue. +Progress(9) at 2025-01-19 23:52:46: 45.678 states generated (45.678 s/min), 7.117 distinct states found (7.117 ds/min), 5.486 states left on queue. @!@!@ENDMSG 2200 @!@!@ diff --git a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308355472/replicated.tla b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737327172537/replicated.tla similarity index 66% rename from storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308355472/replicated.tla rename to storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737327172537/replicated.tla index 33971e3071..b59645ac75 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737308355472/replicated.tla +++ b/storage_broker/spec/replicated/replicated.toolbox/Model_1_SnapShot_1737327172537/replicated.tla @@ -17,6 +17,20 @@ CONSTANT CONSTANT max_commit_lsn + +\* HELPERS + +Max(a,b) == IF a > b THEN a ELSE b + +(* The minimum of a non-empty set of integers *) +MinOfSet(S) == + CHOOSE x \in S: \A y \in S: x <= y + +(* The minimum of a non-empty set of integers *) +MaxOfSet(S) == + CHOOSE x \in S: \A y \in S: x >= y + +\* END HELPERS StateConstraint == /\ \A s \in safekeepers: @@ -25,9 +39,10 @@ StateConstraint == /\ \A s \in DOMAIN broker_state[b].sk: /\ broker_state[b].sk[s].commit_lsn <= max_commit_lsn + -InitSafekeeper == [pruned_lsn |-> 0, commit_lsn |-> 0] -InitBroker == [sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] +InitSafekeeper == [prune_lsn |-> 0, commit_lsn |-> 0, rx |-> [b \in brokers |-> NULL] ] +InitBroker == [sk |-> [s \in safekeepers |-> [prune_lsn |-> 0, commit_lsn |-> 0]]] InitPageserver == [last_record_lsn |-> 0, preferred_sk |-> NULL, sk |-> [s \in safekeepers |-> [commit_lsn |-> 0]]] InitOnline == safekeepers \cup brokers \cup pageservers @@ -58,20 +73,21 @@ SkCommit(s1, s2) == SkPeerRecovery(s1,s2) == /\ {s1, s2} \subseteq online - /\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn + /\ safekeeper_state[s1].commit_lsn < safekeeper_state[s2].commit_lsn \* s2 has more WAL than s1 + /\ safekeeper_state[s2].prune_lsn < safekeeper_state[s1].commit_lsn \* s2 has not yet trimmed the WAL the WAL /\ safekeeper_state' = [safekeeper_state EXCEPT![s1].commit_lsn = safekeeper_state[s2].commit_lsn] /\ UNCHANGED <> SkPushToBroker(s,b) == /\ {s, b} \subseteq online - /\ broker_state' = IF broker_state[b].sk[s].commit_lsn < safekeeper_state[s].commit_lsn - THEN - LET - bsk == broker_state[b].sk - updbsk == [bsk EXCEPT ![s].commit_lsn = safekeeper_state[s].commit_lsn] - IN - [broker_state EXCEPT ![b].sk = updbsk] - ELSE broker_state + /\ broker_state' = LET + broker_side == broker_state[b].sk[s] + sk_side == safekeeper_state[s] + merged == [broker_side EXCEPT + !["commit_lsn"] = Max(broker_side.commit_lsn, sk_side.commit_lsn), + !["prune_lsn"] = Max(broker_side.prune_lsn, sk_side.prune_lsn)] + IN + [broker_state EXCEPT ![b].sk[s] = merged] /\ UNCHANGED <> PsRecvBroker(b,p,s) == @@ -86,6 +102,21 @@ PsRecvBroker(b,p,s) == ELSE pageserver_state /\ UNCHANGED <> + +SkRecvBroker(b,s) == + /\ {b,s} \subseteq online + /\ safekeeper_state' = [safekeeper_state EXCEPT ![s].rx[b] = broker_state[b]] + /\ UNCHANGED <> + +SkPrune(s) == + /\ {s} \subseteq online + /\ LET + sk == safekeeper_state[s] + skis == {<>: <> \in {<> \in { <>: b \in sk.rx }: bi # NULL} } + IN + safekeeper_state' = safekeeper_state + /\ UNCHANGED <> + SksWithNewerWal(p) == LET @@ -105,7 +136,11 @@ Next == \/ \E s1 \in safekeepers: \E s2 \in safekeepers: \/ SkCommit(s1, s2) \/ SkPeerRecovery(s1, s2) - \/ \E s \in safekeepers: \E b \in brokers: SkPushToBroker(s, b) + \/ \E s \in safekeepers: \E b \in brokers: + \/ SkPushToBroker(s, b) + \/ SkRecvBroker(b, s) + \/ \E s \in safekeepers: + \/ SkPrune(s) \/ \E s \in safekeepers: \E b \in brokers: \E p \in pageservers: PsRecvBroker(b,p,s) \/ \E p \in pageservers: PsChooseSk(p) @@ -117,7 +152,12 @@ Spec == Init /\ [][Next]_<< broker_state, safekeeper_state, pageserver_state,onl PsLagsSk == \A p \in pageservers: \A s \in DOMAIN pageserver_state[p].sk: /\ pageserver_state[p].sk[s].commit_lsn <= safekeeper_state[s].commit_lsn - + +PeerRecoveryIsPossible == + \A laggard \in (safekeepers \cap online): \E donor \in (safekeepers \cap online): + /\ (safekeeper_state[laggard].commit_lsn < safekeeper_state[donor].commit_lsn) + => safekeeper_state[donor].prune_lsn <= safekeeper_state[laggard].commit_lsn + EventuallyLaggingSkIsNotPreferredSk == <>( LET diff --git a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1.launch b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1.launch index a09d0d0885..c799f17f3e 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1.launch +++ b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1.launch @@ -12,7 +12,7 @@ - + @@ -26,6 +26,7 @@ + diff --git a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737307595008.launch b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737307595008.launch deleted file mode 100644 index 0c3da56e23..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737307595008.launch +++ /dev/null @@ -1,58 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737307621596.launch b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737307621596.launch deleted file mode 100644 index 7175e68a8c..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737307621596.launch +++ /dev/null @@ -1,58 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737307660221.launch b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737307660221.launch deleted file mode 100644 index 5546705b36..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737307660221.launch +++ /dev/null @@ -1,58 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737307704621.launch b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737307704621.launch deleted file mode 100644 index 27f3ded305..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737307704621.launch +++ /dev/null @@ -1,58 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737307769810.launch b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737307769810.launch deleted file mode 100644 index 9d0cbac7dd..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737307769810.launch +++ /dev/null @@ -1,58 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737307828738.launch b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737307828738.launch deleted file mode 100644 index eaecdfb9f5..0000000000 --- a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737307828738.launch +++ /dev/null @@ -1,58 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737308355472.launch b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737323805723.launch similarity index 96% rename from storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737308355472.launch rename to storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737323805723.launch index 7d9ed3f070..4079ddaf0e 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737308355472.launch +++ b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737323805723.launch @@ -2,7 +2,7 @@ - + @@ -12,7 +12,7 @@ - + @@ -26,6 +26,7 @@ + diff --git a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737308024914.launch b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737323834253.launch similarity index 96% rename from storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737308024914.launch rename to storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737323834253.launch index 16960af230..e7c98ca3f9 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737308024914.launch +++ b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737323834253.launch @@ -2,7 +2,7 @@ - + @@ -12,7 +12,7 @@ - + @@ -26,6 +26,7 @@ + diff --git a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737308183077.launch b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737324141888.launch similarity index 96% rename from storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737308183077.launch rename to storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737324141888.launch index 45c5003d49..40bfbc7ee0 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737308183077.launch +++ b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737324141888.launch @@ -2,7 +2,7 @@ - + @@ -12,7 +12,7 @@ - + @@ -26,6 +26,7 @@ + diff --git a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737308216766.launch b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737324186169.launch similarity index 96% rename from storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737308216766.launch rename to storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737324186169.launch index 137c568ffe..6f8c5c99bb 100644 --- a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737308216766.launch +++ b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737324186169.launch @@ -2,7 +2,7 @@ - + @@ -12,7 +12,7 @@ - + @@ -26,6 +26,7 @@ + diff --git a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737324315582.launch b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737324315582.launch new file mode 100644 index 0000000000..6995260232 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737324315582.launch @@ -0,0 +1,61 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737326115252.launch b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737326115252.launch new file mode 100644 index 0000000000..3575d44169 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737326115252.launch @@ -0,0 +1,61 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737326135419.launch b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737326135419.launch new file mode 100644 index 0000000000..883bfb87d3 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737326135419.launch @@ -0,0 +1,61 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737326274268.launch b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737326274268.launch new file mode 100644 index 0000000000..307d62bc6d --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737326274268.launch @@ -0,0 +1,61 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737327144010.launch b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737327144010.launch new file mode 100644 index 0000000000..66e774e9e3 --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737327144010.launch @@ -0,0 +1,61 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737327172537.launch b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737327172537.launch new file mode 100644 index 0000000000..ba0d15e47f --- /dev/null +++ b/storage_broker/spec/replicated/replicated.toolbox/replicated___Model_1_SnapShot_1737327172537.launch @@ -0,0 +1,61 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +