A snapshot isolated database modeling in TLA+

-

While idly browsing tlaplus/Examples repository, I noticed TLA+ spec for a snapshot isolated Key-Value Store written by my friend Andrew Helwer. This is a centralized database. Each transaction makes a copy of the store, and OCC merges their copy back to store upon commit. I immediately wanted to write a PlusCal version of it and contribute back.

My motivations were:

  • Let's see how quickly I can write the PlusCal version. This way I can get practice converting TLA+ specs to PlusCal. (TLC automatically converts PlusCal to TLA+ spec, but the other way requires some judgement call.)
  • The PlusCal version would make this spec easier to understand for modeling newbies.
  • I can also add the client-centric isolation checking to this to provide a more concrete example of that immensely useful module.
  • It would be cool to see the Serializability counterexample the model would throw. I was curious if the model checker will throw the classical write-skew counterexample.
  • This would be a cool self-contained example I can show in my TLA+ seminar inside Amazon/AWS to walk people from basic to intermediate/advance concepts in TLA+ modeling.

And, I did that. I had fun doing it and contributing it to the tlaplus/Examples repo. And of course, I had to write this blog post to explain the model, because that is how I am wired.

What could be your motivations to keep reading on?

  • A modeling walk-through! There aren't many examples of that. This is the way to learn about abstraction skill.
  • You can learn how to do transaction isolation checking for TLA+ models
  • You can find out if the Serializability counterexample is the classical write-skew counterexample
  • This beats mindless browsing on the Internet. Seriously man, you can do better.


Global variables


You can see the PlusCal keyword algorithm on line 22. PlusCal is just a block comment that TLC parses and translates to a TLA+ specification. You should still be able to read TLA+ to debug problems arising when you are modeling.

Ok, then we have the variables keyword to start us off with global variables of the algorithm.

store is the datastore we are operating on. It is simply a mapping from Keys to Values, hence a key-value store. In math-land, it is a function. As we declare it, we also initialize it, for the initial state of the system, to map each key to a NoVal. This is abstraction. I am interested in isolation checking, I am not interested in adding or removing keys. I can pretend the keyspace is fixed, and initially all keys are mapped to NoVal.

tx is the set of active transactions at a given time. In the initial state there are not active transactions, so tx is empty set.

missed is the set of updates this active transaction failed to see while working on its local snapshot of the database. We will talk about missed in the COMMIT part of a transaction process.


The transaction process

I realized I only need one type of process: a transaction process to do the acting on the store. I can instantiate this process 3 times, if I like to test with 3 concurrent processes.

As you read the spec below, notice the placement of the labels in the code. Label to label is the unit of atomic execution in PlusCal. There are rules for where they are needed like at the start of a while statement, and the TLC parser will inform you if you missed a required label placement. You can check the PlusCal cheatsheet for quick information on these.In addition you can add other labels as yield points from this process to other processes it is concurrently executing with.

It is very instructive to read the generated TLA+ and check how it corresponds to your PlusCal code. I would recommend you do it for this model until you see how TLA+ translation works. Especially pay attention to how process is instantiated with self, and called in Next later.


Transaction start


On line 38, process is instantiated for each element t in TxId set. This is a set that user can give in at model checking time with .cfg file, say as {t1,t2,t3}, which instantiates and runs this process 3 times concurrently.

We have 4 process local variables. snapshotStore has the same signature and initial mapping with global variable store. It denotes local copy/snapshot of the store.

Read_keys (respectively write_keys) denote the set of keys selected for reading (respectively writing to) by this transaction process.

Finally, ops is a operation log to record the reads & writes this transaction executes, and is used for interfacing to the client-centric isolation checking component.

Then on line 44 we have the start of the process code, and on line 45 the first label, titled START. This is one of those label required situations. The code for each process must begin with a label. If you scroll down and check the corresponding TLA+ translation, you will understand why this is the case.

Within this START label, we do the transaction initialization work. Line 46 adds this transaction to the set of existing transactions tx (remember this from the global variables?). The process refers to its id as self because this code is instantiated for each t in TxId.

Line 47 sets snapshotStore to copy the current value of store. It may be that another transaction process already got scheduled and ran to completion before we execute this line, so we may be snapshotting a modified version of the store to start and execute our transaction.

The with block in line 49, sets read_keys and write_keys to a random set in the superset of Key set (which may be given at the .cfg file as {k1, k2, k3}), excluding the empty set. So read_keys may be assigned to {k1,k2}, and write_keys to {k2}.

A heads up here about the difference between CHOOSE and with. CHOOSE cannot be used to introduce nondeterminism, but with does provide random choice.


Transaction read update/commit


The next label is READ. This means after executing the lines between START to READ, the scheduler may yield control to other processes to execute other labels for some time, before it picks back up on this current process to execute the READ label to UPDATE label atomically, and yield again. This checks for all possible concurrent executions of the process code.

We cheat in the read operation. We pretend to read things, but we don't need to read them, because the value we write in the UPDATE label (our process id, self) is independent of the values we read. But we do record in ops the content of our read_keys set to pass this information to the client-centric isolation check module which relies on this log to validate transaction isolation. When we are passing this we use a SetToSeq formula to flatten the set to a sequence the ops log expects. We could have added this to the log in a while loop one by one, but we avoid this because a while loop requires a label, and would mean the control may be yielded to other processes at each iteration, and this blows up the number of possible executions the model checker needs to check (without finding interesting behavior for transaction isolation checking purposes).

We have the UPDATE label on line 59. This is optimistic concurrency control (OCC), meaning we do the updates local first, and later at commit time if there is no conflict we get to commit them permanently. So here the process updates its own copy of store, the snapshotStore to assign the keys in write_keys, its id, self, as the value. On line 60, we do the update as a one-liner, with a new function assignment to the snapshotStore. For each key in Key space, we only update the keys that are in our write_keys to the value self, and leave the other keys alone.

We again avoid the while loop update. This is a process local variable, rather than the global store, so assigning to our local snapshotStore at different orders doesn't change the bottomline for isolation checking. For isolation checking, we just care about the contents of ops log for read values and the committed write values.

Finally in line 62, we have the COMMIT label. Line 63 is the no-conflict validation check. If there is no-conflict, we get to commit the transaction and merge our local updates with the global store. Otherwise, the process terminates, and our local updates get lost, which means the transaction is trivially and cleanly aborted without any side-effects.

Line 63 checks that this transaction did not miss an update on a key that is in your write_keys in order to prevent a write-write conflict snapshot isolation forbids. In other words, the intersection of missed[self] and write_keys is an empty set. But what is this missed set? You remember it defined as a global variable, but you haven't seen it updated yet. The update comes on line 68, if this transaction passes the check and gets to commit itself.

For commit, the process takes its id self from the list of active transactions set, tx, and updates the missed set of actively transactions in tx set with the updates it is about to install to the global store. This is again a one-liner full function assignment update. For each transaction, if the transaction is active (i.e., is a member of tx), we append our write_set to its missed set, otherwise we leave its missed set unchanged.

You should be able to follow the global store update on line 71 without any problem now. Finally, on line 74 we log these writes to the ops log so the client-centric isolation check module can use these logs for checking isolation.   

Here is a followup exercise for you. Try to break it by making the COMMIT finer grained. Can you pull some of the statement in COMMIT in a PRECOMMIT label to add more fine-grained concurrency to the protocol? Would that work or violate isolation invariants? If so, try to understand how by checking the counterexample TLA+ model checker produces.


Instantiating the CC

I am not going to go through the explanation of what the CC module does. For this, please read my blog post from last July.

In the CC module, Tim Soethout translates the ideas from the 2017 PODC paper on client-centric specification of database isolation to TLA+. That PODC'17 paper is a big improvement to be celebrated. Instead of a graph of operations and trying to check conflict on that graph, it enabled reducing isolation checking to state formulas about complete read states and performing validation through these formulas. This makes up for the difference between a complicated 1600 lines TLA+ module for checking isolation through graphs, versus 160 lines TLA+ module for doing the checking on states as the CC module implements.

Here is how we instantiate the client-centric isolation checking (CC) TLA+ module. First copy ClientCentric.tla and Util.tla in the same folder as your model for the CC instantiation to work. Then use INSTANCE keyword to instantiate it and assign it to a handle, in this case CC to refer to it. You can write CC!formula to refer to formula under the CC module. Or you can rekey them.


The figure shows the module constants and instantiating CC. The CC component also expects Keys and Values variables passed to it. This is done on line 13 through INSTANCE and WITH mapping. We map Keys to be the Key in our database model, and for Values we map it to TxId \union {NoVal} because that is what we use as values in our database model.

The transactions in our database model is interfaced to ClientCentric checking model only through the read and write operations it invokes, which is captured through an operations log. We pass this through the ops log when calling Isolation invariants to check, as we show next.


Invariants


Line 151 shows how to check SnapshotIsolation by using CC. That simple! We give the function what it needs to check, the initial state that the KV store starts, and the ops log for each transaction for the reads (keys and values) and writes (keys and values) it performs. The module takes care of the rest.

If we instead invoke the serializability check, we see that serializability does not work. Let's review the counterexample.

You can try this yourself by opening this folder in VScode, and using the TLA+ extension to model check the MCKVsnap.cfg with Serializability uncommented.


Serializability counterexample

It is indeed the classic write-skew example we get back. Our snapshot isolated database by design allows write-skew and this violates serializability. (This is not a problem, you can deal with it if you know what you are getting. Strictest isolation is not always better.)

  • Step 2 shows t1 start with *read_keys* {k1} and *write_keys* {k2}.
  • Step 5 shows t2 start with *read_keys* {k2} and *write_keys* {k1}.
  • In step 6, t1 commits.
  • In step 9, t2 commits, because there is no write-write conflict between t1 and t2, and the snapshot isolated database is happy to commit both.

The read-write conflict between t2 and t1 is not accounted for, which leads to the write-skew and violation of serializability.


The config file


Above is the config file for completeness. If you like to model check, install the VSCode TLA+ extension and follow these steps.

  • Open the .cfg file you are interested in checking in VSCode
  • Get the VSCode panel (Option+X on Mac), and choose "TLA+: Check Model with TLC")


It takes 16 seconds on my 2019 model MacBookPro to exhaustively model check this configuration. But if I add k3 to the Key set, it takes 44 minutes! There is a demonstration of state space explosion for you. 165 times increase in model checking time when we add just another key.

Still 44 minutes is not so bad! For even larger models, to reduce the checking times, you can invest in a large AWS machine, or distributed model checking via TLC.


Call to action


Abstraction is the hardest part to teach when teaching modeling with TLA+. There is an art to abstraction, and you learn it through apprenticeship process. By observing good examples of abstraction, you learn the art by osmosis over time. And abstraction is a very important thing to learn.
Abstraction, abstraction, abstraction!
That's how you win a Turing Award. --Leslie Lamport
TLA+ modeling examples like this will help for learning abstraction. I request you to contribute more TLA+ specification examples to https://github.com/tlaplus/Examples/, so you can help people to pickup and master the art of modeling with TLA+. We need examples from different use cases and subfields. 

Comments

Post a Comment

Popular posts from this blog

Hints for Distributed Systems Design

-
This is with apologies to Butler Lampson, who published the " Hints for computer system design " paper 40 years ago in SOSP'83. I don't claim to match that work of course. I just thought I could draft this post to organize my thinking about designing distributed systems and get feedback from others. I start with the same  disclaimer Lampson gave. These hints are not novel, not foolproof recipes, not laws of design, not precisely formulated, and not always appropriate. They are just hints.  They are context dependent, and some of them may be controversial. That being said, I have seen these hints successfully applied in distributed systems design throughout my 25 years in the field, starting from the theory of distributed systems (98-01), immersing into the practice of wireless sensor networks (01-11), and working on cloud computing systems both in the academia and industry ever since. These heuristic principles have been applied knowingly or unknowingly and has proven
Read more >>

Learning about distributed systems: where to start?

-
This is definitely not a "learn distributed systems in 21 days" post. I recommend a principled, from the foundations-up, studying of distributed systems, which will take a good three months in the first pass, and many more months to build competence after that. If you are practical and coding oriented you may not like my advice much. You may object saying, "Shouldn't I learn distributed systems with coding and hands on? Why can I not get started by deploying a Hadoop cluster, or studying the Raft code." I think that is the wrong way to go about learning distributed systems, because seeing similar code and programming language constructs will make you think this is familiar territory, and will give you a false sense of security. But, nothing can be further from the truth. Distributed systems need radically different software than centralized systems do.  --A. Tannenbaum This quotation is literally the first sentence in my distributed systems syllabus. Inst
Read more >>

Making database systems usable

-
Image
C. J. Date's Sigmod 1983 keynote, "Database Usability", was prescient. Usability is the most important thing to the customers. They care less about impressive benchmarks or clever algorithms, and more about whether they can operate and use a database efficiently to query, update, analyze, and persist their data with minimal headache. (BTW, does anyone have a link to the contents of this Sigmod'83 talk? There is no transcript around, except for this short abstract .) The paper we cover today is from Sigmod 2007. It takes on the database usability problem raised in that 1983 keynote head-on, and calls out that the king is still naked.  Let's give some context for the year 2007. Yes, XML format was still popular then. The use-case in the paper is XQuery. The paper does not contain any  reference to json. MongoDB would be released in 2009 with the document model; and that seems to be great timing for some of the usability pains mentioned in the paper! Web 2.0 was in
Read more >>

Looming Liability Machines (LLMs)

-
As part of our zoom reading group ( wow, 4.5 years old now ), we discussed a paper that uses LLMs for automatic root cause analysis (RCA) for cloud incidents. This was a pretty straightforward application of LLMs. The proposed system employs an LLM to match incoming incidents to incident handlers based on their alert types, predicts the incident's root cause category, and provides an explanatory narrative. The only customization is through prompt-engineering. Since this is a custom domain, I think a more principled and custom-designed  machine learning system would be more appropriate rather than adopting LLMs. Anyways, the use of LLMs for RCAs spooked me vicerally. I couldn't find the exact words during the paper discussion, but I can articulate this better now. Let me explain. RCA is serious business Root cause analysis (RCA) is the process of identifying the underlying causes of a problem/incident, rather than just addressing its symptoms. One RCA heuristic is asking 5 Why&#
Read more >>

Foundational distributed systems papers

-
I talked about the importance of reading foundational papers last week. To followup, here is my compilation of foundational papers in the distributed systems area. (I focused on the core distributed systems area, and did not cover networking, security, distributed ledgers, verification work etc. I even left out distributed transactions, I hope to cover them at a later date.)  I classified the papers by subject, and listed them in chronological order. I also listed expository papers and blog posts at the end of each section. Time and State in Distributed Systems Time, Clocks, and the Ordering of Events in a Distributed System. Leslie Lamport, Commn. of the ACM,  1978. Distributed Snapshots: Determining Global States of a Distributed System. K. Mani Chandy Leslie Lamport, ACM Transactions on Computer Systems, 1985. Virtual Time and Global States of Distributed Systems.  Mattern, F. 1988. Practical uses of synchronized clocks in distributed systems. B. Liskov, 1991. Expository papers
Read more >>

Advice to the young

-
Image
I notice I haven't written any advice posts recently. Here is a collection of my advice posts pre 2020. I've been feeling all this elderly wisdom pent up in me, ready to pour at any moment. So here it goes. Get ready to quench your thirst from my fount of wisdom. No man, think for yourself, only get what works for you. It is called foundations, not theory Foundations of computer science (or rather any field of study) are the most important topics you can learn. These lay down the frame of thinking/perspective for that area of study. Yet, I am saddened to hear these called as "theory", and labeled as "unpractical". This couldn't be farther from the truth. Take a look at how I recommend studying distributed systems . Don't you dare call this "theory" and "unpractical". This lays the bedrock that you build your practice on. Don't skimp on the foundations. Don't build your home on quicksand. Keep your hands dirty, your mind cl
Read more >>

Linearizability: A Correctness Condition for Concurrent Objects

-
Image
This paper is from Herlihy and Wing appeared in ACM Transactions on Programming Languages and Systems 1990. This is the canonical reference for the linearizability definition. I had not read this paper in detail before, so I thought it would be good to go to the source to see if there are additional delightful surprises in the original text. Hence, this post. I will dive into a technical analysis of the paper first, and then discuss some of my takes toward the end. I had written an accessible explanation of linearizability earlier; you may want to read that first. I will assume an understanding of linearizability to keep this review at reasonable length. Introduction I love how the old papers just barge in with the model, without bothered by pleasantries such as motivation of the problem. These are the first two sentences of the introduction. "A concurrent system consists of a collection of sequential processes that communicate through shared typed objects . This model encompass
Read more >>

Scalable OLTP in the Cloud: What’s the BIG DEAL?

-
Image
This paper is from Pat Helland, the apostate philosopher of database systems, overall a superb person, and a good friend of mine. The paper appeared this week at CIDR'24. (Check out the program for other interesting papers). The motivating question behind this work is: " What are the asymptotic limits to scale for cloud OLTP (OnLine Transaction Processing) systems? " Pat says that the CIDR 2023 paper "Is Scalable OLTP in the Cloud a Solved Problem?" prompted this question.  The answer to the question? Pat says that the answer lies in the joint responsibility of database and the application. If you know of Pat's work, which I have summarized several in this blog , you would know that Pat has been advocating along these lines before. But this paper provides a very crisp, specific, concrete answer. Read on for my summary of the paper. Disclaimer: This is a wisdom and technical information/detail packed 13-page paper, so I will try my best to summarize the sa
Read more >>

Understanding the Performance Implications of Storage-Disaggregated Databases

-
Image
Storage-compute disaggregation in databases has emerged as a pivotal architecture in cloud environments, as evidenced by Amazon ( Aurora ), Microsoft ( Socrates ), Google (AlloyDB), Alibaba ( PolarDB ), and Huawei (Taurus). This approach decouples compute from storage, allowing for independent and elastic scaling of compute and storage resources. It provides fault-tolerance at the storage level. You can then share the storage for other services, such as adding read-only replicas for the databases. You can even use the storage level for easier sharding of your database. Finally, you can also use this for exporting a changelog asynchronously to feed into peripheral cloud services, such as analytics. Disaggregated architecture was the topic of Sigmod 23 panel . I think this quote summarizes the industry's thinking on the topic. "Disaggregated architecture is here, and is not going anywhere. In a disaggregated architecture, storage is fungible, and computing scales independently.
Read more >>

Designing Data Intensive Applications (DDIA) Book

-
Image
We started reading this book as part of Alex Petrov's book club . We just got started, so you can join us, by joining the discord channel above. We meet Wednesday's 11am Eastern Time.  Previously we had read transaction processing book by Grey and Reuters. This page links to my summaries of that book. Chp 1. Reliable, Scalable, and Maintainable Applications I love the diagrams opening each chapter. Beautiful! The first chapter consists of warm up stuff. It talks about the definitions of reliabilty, scalability, and maintainability. It is still engaging, because  it is written with an educator and technical blogger voice, rather than a dry academic voice. This book came out on 2017. Martin is working on the new version. So if you have comments for things to focus on for the new version, it would be helpful to collect them in a document and email it to Martin. For example, I am curious about how the below paragraph from the Preface will get revised with 8 more years of hindsight:
Read more >>