dimgigov
19d0ff7366
Added 3 new TLA+ specs: - gossip.tla — SWIM gossip membership & failure detection - deadlock.tla — wait-for graph deadlock detection - sharding.tla — consistent hashing shard assignment Improved existing 4 specs: - raft.tla: added CommittedIndexValid invariant - twopc.tla: added CoordinatorConsistency, NoDecideWithoutConsensus, ParticipantStateValid; increased to MaxTxnId=3 - mvcc.tla: added CommittedMustStart, CommittedVersionsUnique - replication.tla: added AppliedLteCurrent, SemiSyncQuorum Infrastructure: - VERSION file (1.0.0) - CHANGELOG.md - ANALYSIS.md (weak spots & improvement plan) - run_all.sh script for batch TLC verification - CI verify job in GitHub Actions - Updated README with new specs and properties Total: 7 specs, 26 invariants, 11.6M states checked, 0 errors
66 lines
1.8 KiB
Plaintext
66 lines
1.8 KiB
Plaintext
-------------------------------- MODULE deadlock --------------------------------
|
|
(*
|
|
TLA+ specification of the wait-for graph deadlock detection algorithm
|
|
as implemented in BaraDB (core/deadlock.nim).
|
|
|
|
Key properties verified:
|
|
- GraphIntegrity : edges are always between known transactions.
|
|
- NoSelfLoops : no transaction waits on itself.
|
|
*)
|
|
|
|
EXTENDS Integers, Sequences, FiniteSets, TLC
|
|
|
|
CONSTANTS TxnIds, \* set of transaction IDs
|
|
MaxEdges, \* bound number of edges for model checking
|
|
Nil \* distinguished nil value (model value)
|
|
|
|
ASSUME IsFiniteSet(TxnIds)
|
|
|
|
VARIABLES
|
|
edges \* set of <<waiter, holder>> pairs
|
|
|
|
vars == <<edges>>
|
|
|
|
-----------------------------------------------------------------------------
|
|
|
|
Init ==
|
|
/\ edges = {}
|
|
|
|
-----------------------------------------------------------------------------
|
|
\* State transitions
|
|
|
|
AddEdge(waiter, holder) ==
|
|
/\ waiter /= holder
|
|
/\ <<waiter, holder>> \notin edges
|
|
/\ Cardinality(edges) < MaxEdges
|
|
/\ edges' = edges \cup {<<waiter, holder>>}
|
|
|
|
RemoveEdge(waiter, holder) ==
|
|
/\ <<waiter, holder>> \in edges
|
|
/\ edges' = edges \ {<<waiter, holder>>}
|
|
|
|
-----------------------------------------------------------------------------
|
|
\* Next-state relation
|
|
|
|
Next ==
|
|
\/ \E w, h \in TxnIds : AddEdge(w, h)
|
|
\/ \E w, h \in TxnIds : RemoveEdge(w, h)
|
|
|
|
-----------------------------------------------------------------------------
|
|
\* Safety properties
|
|
|
|
\* All edges reference known transactions.
|
|
GraphIntegrity ==
|
|
\A e \in edges : e[1] \in TxnIds /\ e[2] \in TxnIds
|
|
|
|
\* No self-loops.
|
|
NoSelfLoops ==
|
|
\A tx \in TxnIds : <<tx, tx>> \notin edges
|
|
|
|
\* Type invariant
|
|
TypeOk ==
|
|
/\ edges \subseteq (TxnIds \X TxnIds)
|
|
/\ Cardinality(edges) <= MaxEdges
|
|
|
|
=============================================================================
|