TLA+ conference 2024

-

The TLA+ foundation got established last year in April as an independent, non-profit organization under the umbrella of the Linux Foundation. This April 15th, we colocated our annual TLA+ conference with the Linux OSSNA event to reach out to developers attending this event. Being under Linux Foundation, we didn't have to pay for the venue, but we paid $3K for professional recording of the sessions, so we can share the talks with the world at large. The videos will be available within a couple weeks. 


Marc Brooker: 15 years of TLA+

Marc Brooker gave the keynote this Monday in TLA+ conference 2024. His keynote was a good mix of inspiration for formal methods and challenging formal methods to do better. Brooker is a VP/distinguished engineer at AWS. He has been on-call for 15 years, and were involved with many popular AWS services, including Aurora, Lambda, EC2, EBS, API gateway, iot, bedrock. He defines himself as mostly a practitioner, building large scale distributed systems. Brooker's blog is a must-subscribe. His most recent blog post is a brief summary of this keynote talk, but do read on for my notes from his talk.

Image

Brooker started building circuits on breadboard in high-school, and started noticing the patterns in circuits, and got fascinated by realizing that with math we can quantify the output behavior of systems at design time, understand safety margins, and  understand system interactions. He found this so exciting, that after studying ECE, he started PhD on building distributed radar system. He was again delighted to see that using math they could predict the output of the system they are designing and building. 

Then we got into computer systems, and found that math was not there in the practice. A prevalent attitude in developing and operating computer systems was "it's just vibes, man!", and this was super disappointing to him.

To inject some rigor in to designs, he thought of modeling via distributed state machines, and asked his smarter colleagues, who recommended Alloy, Promela+Spin, and TLA+. He bought Leslie Lamport's book, and read all examples, and coded them, which completely changed his approach to thinking about these systems. They have explained the process and their experiences with TLA+ modeling in their  CACM 2015 article "how amazon web services uses formal methods". The paper is 6 pages long, and Broker says one of the most important part of the paper is Table 1. (I had gotten to see those specs when I was at AWS, and many more specs followed these since 2015.)

He was so transformed by these experiences that he is convinced that formal methods is one of the best engineering best practices. He says: If you’re a software engineer, especially one working on large-scale systems, distributed systems, or critical low-level system, and are not using formal methods as part of your approach, you’re probably wasting time and money. Because, ultimately, engineering is an exercise in optimizing for time and money.

"It would be well if engineering were less generally thought of, and even defined, as the art of constructing. In a certain important sense it is rather the art of not constructing; or, to define it rudely but not inaptly, it is the art of doing that well with one dollar, which any bungler can do with two after a fashion." Arthur Wellington

TLA+, rather than slowing things, accelerate engineering. Finding bugs earlier allows us to move faster. Formal methods also help us to optimize designs and protocols without risk, and crisply communicate exact reasoning.

In sum, Brooker believes formal methods are just good engineering practice! But this comes completely disconnected from many people's perception as we failed to communicate the value of this. How do we communicate this to them? Brooker says that's why he is excited about this field.

The present

Since the paper's publication TLA+ had been used for database services (Aurora, DynamoDB),  compute services (Lambda),  storage (EBS control plane physalia) and many other places

What caught Brooker by surprise was that: TLA+ role as an extremely precise format for protocol documentation was perhaps the most useful. 

In the present, AWS has a broad automated reasoning practice:

Personal 

Brooker says he continues to be excited about TLA+, and he uses P more and more often, and is learning Lean as well.

Future

Prediction 1: systems will continue to become more complex. (And soon their behavior will exceed human ability to reason about them.)

Prediction 2: systems will continue to become more critical. We saw this in our lives, and this snuck up on us in the last 30 years.

Prediction 3: cost, efficiency, sustainability, and productivity will become more important.

Prediction 4: AI will be a big deal.

Discussion

A quantitative understanding of system behavior is also sorely needed:

  • failure probabilities
  • latency and throughput distributions
  • system performance under different workloads
  • automatic optimization of system designs

It would be great to have faster exploration of the design space in an automated way. For example, there has been decades of debate on 2f+1 (Paxos) vs f+1 (chain) replication designs. Still there is no clear winner, because things are failure model and workload dependent. But given workload properties, matching design to workload should be trivial. So can we use automated tools to get an answer to this? A similar example is OCC vs locking concurrency control.

How do we reach working engineers (and working eng executives)?

Should tools get narrower and more specific? Is packaging and ui holding us back? Are we talking to decision makers about moving faster and with less risk?

Code vs model gap: people have been dismissive about this as this didn't turn out to be as bad as it sounds, but do we get any improvement on this. (Markus Kuppe's talk in the afternoon reported great progress on this problem.)

Brooker said model checking vs proof gap is not personally/practically much important to him, and that he remains to be extremely excited about TLA+.

Here are Brooker's slides from the keynote.


The rest of the day

We had four more industry talks in the morning. This was a big change/improvement over the previous years. We see accelarated adoption of TLA+ in the industry. Thousands seeds are sprouting in different companies, and that is really nice to see. We had great talks.

The companies (industrial use) have all the same basic story. They work on a problem/feature, which seem simple first, and gets captured initially by a couple paragraphs of description. But due to concurrency and nondeterminism, the cornercases keep popping up as they delve (not a chatbot I just like the word) in to the problem, and the document becomes a 40 page document many weeks later. When they are frustrated, out of desperation they pick up TLA+ modeling, which gives them assurance, and also simplifies the design. The good news is that you don't need advanced language features to be productive with TLA+ modeling. The modeling is the important thing, and you get very good return on investment on it. They are very happy about using TLA+, but as the implementation marches on they move on to other things, to pick up TLA+ another fateful Spring when the cycle repeats again for the next big feature/protocol/design they need to deliver. As I keep joking to Markus, the TLA+ stickers should say []<> rather than <>[], as the common use pattern seems to be always eventually using TLA+.


In the afternoon we had a session on advancements on TLA+ core concept and another on TLA+ ecosystem.

Image


Do check on the interactive TLA-web tool. I am excited about this, and many people in the audience were delighted watching the demo of this tool. 

Overall we had a really fun day. We topped this off with the TLA+ dinner, which was really friendly and colloquial. We walked to the waterfront, below the Pike Place, and dined at the crabpot sea food restaurant. We had an informal dinner, for a formal methods conference.

Image


What is next for TLA+? We should get our flywheel going. We should get more companies using it, which in turn would be creating demand for support/features, and the budding TLA+ ecosystem should be delivering them with funding. TLA+ ecosystem will stay strong and thrive only if we get more users with needs.


Comments

Post a Comment

Popular posts from this blog

Learning about distributed systems: where to start?

-
This is definitely not a "learn distributed systems in 21 days" post. I recommend a principled, from the foundations-up, studying of distributed systems, which will take a good three months in the first pass, and many more months to build competence after that. If you are practical and coding oriented you may not like my advice much. You may object saying, "Shouldn't I learn distributed systems with coding and hands on? Why can I not get started by deploying a Hadoop cluster, or studying the Raft code." I think that is the wrong way to go about learning distributed systems, because seeing similar code and programming language constructs will make you think this is familiar territory, and will give you a false sense of security. But, nothing can be further from the truth. Distributed systems need radically different software than centralized systems do.  --A. Tannenbaum This quotation is literally the first sentence in my distributed systems syllabus. Inst
Read more >>

Hints for Distributed Systems Design

-
This is with apologies to Butler Lampson, who published the " Hints for computer system design " paper 40 years ago in SOSP'83. I don't claim to match that work of course. I just thought I could draft this post to organize my thinking about designing distributed systems and get feedback from others. I start with the same  disclaimer Lampson gave. These hints are not novel, not foolproof recipes, not laws of design, not precisely formulated, and not always appropriate. They are just hints.  They are context dependent, and some of them may be controversial. That being said, I have seen these hints successfully applied in distributed systems design throughout my 25 years in the field, starting from the theory of distributed systems (98-01), immersing into the practice of wireless sensor networks (01-11), and working on cloud computing systems both in the academia and industry ever since. These heuristic principles have been applied knowingly or unknowingly and has proven
Read more >>

Foundational distributed systems papers

-
I talked about the importance of reading foundational papers last week. To followup, here is my compilation of foundational papers in the distributed systems area. (I focused on the core distributed systems area, and did not cover networking, security, distributed ledgers, verification work etc. I even left out distributed transactions, I hope to cover them at a later date.)  I classified the papers by subject, and listed them in chronological order. I also listed expository papers and blog posts at the end of each section. Time and State in Distributed Systems Time, Clocks, and the Ordering of Events in a Distributed System. Leslie Lamport, Commn. of the ACM,  1978. Distributed Snapshots: Determining Global States of a Distributed System. K. Mani Chandy Leslie Lamport, ACM Transactions on Computer Systems, 1985. Virtual Time and Global States of Distributed Systems.  Mattern, F. 1988. Practical uses of synchronized clocks in distributed systems. B. Liskov, 1991. Expository papers
Read more >>

Metastable failures in the wild

-
Image
This paper appeared in OSDI'22. There is a great summary of the paper by Aleksey (one of the authors and my former PhD student, go Aleksey!). There is also a great conference presentation video from Lexiang. Below I will provide a brief overview of the paper followed by my discussion points. This topic is very interesting and important, so I hope you have fun learning about this. Metastability concept and categories Metastable failure is defined as permanent overload with low throughput even after the fault-trigger is removed. It is an emergent behavior of a system, and it naturally arises from the optimizations for the common case that lead to sustained work amplification. In this paper, the authors are able to capture/abstract the system behavior of interest in terms of two parameters, the load and capacity. If the load is above capacity, you have work piling up, right? Or if the capacity drops under the sustained load level, the same effect, right? Both of these create  a tem
Read more >>

The demise of coding is greatly exaggerated

-
Image
NVDIA CEO Jensen Huang recently made very contraversial remarks : "Over the course of the last 10 years, 15 years, almost everybody who sits on a stage like this would tell you that it is vital that your children learn computer science, and everybody should learn how to program. And in fact, it’s almost exactly the opposite. It is our job to create computing technology such that nobody has to program and that the programming language is human. Everybody in the world is now a programmer.  This is the miracle of artificial intelligence." I am not going to wise crack and say that this is power poisioning and this is what happens when your company valuation more than triples in a year and surpasses Amazon and Google. (Although I don't discount this effect completely.) Jensen is very smart and also has some great wisdom , so I think we should give this the benefit of doubt and try to respond in a thoughtful manner.  A response is warranted because this statement got a lot of p
Read more >>

Scalable OLTP in the Cloud: What’s the BIG DEAL?

-
Image
This paper is from Pat Helland, the apostate philosopher of database systems, overall a superb person, and a good friend of mine. The paper appeared this week at CIDR'24. (Check out the program for other interesting papers). The motivating question behind this work is: " What are the asymptotic limits to scale for cloud OLTP (OnLine Transaction Processing) systems? " Pat says that the CIDR 2023 paper "Is Scalable OLTP in the Cloud a Solved Problem?" prompted this question.  The answer to the question? Pat says that the answer lies in the joint responsibility of database and the application. If you know of Pat's work, which I have summarized several in this blog , you would know that Pat has been advocating along these lines before. But this paper provides a very crisp, specific, concrete answer. Read on for my summary of the paper. Disclaimer: This is a wisdom and technical information/detail packed 13-page paper, so I will try my best to summarize the sa
Read more >>

The end of a myth: Distributed transactions can scale

-
Image
This paper appeared in VLDB'17. The paper presents NAM-DB, a scalable distributed database system that uses RDMA (mostly 1-way RDMA) and a novel timestamp oracle to support snapshot isolation (SI) transactions. NAM stands for network-attached-memory architecture, which leverages RDMA to enable compute nodes talk directly to a pool of memory nodes. Remote direct memory access (RDMA) allows bypassing the CPU when transferring data from one machine to another. This helps relieve a major factor in scalability of distributed transactions: the CPU overhead of the TCP/IP stack. With so many messages to process, CPU may spend most of the time serializing/deserializing network messages, leaving little room for the actual work. We had seen this phenomena first hand when we were researching the performance bottlenecks of Paxos protocols. This paper reminds me of the "Is Scalable OLTP in the Cloud a Solved Problem? (CIDR 2023)" which we reviewed recently. The two papers share one
Read more >>

SIGMOD panel: Future of Database System Architectures

-
Image
I mentioned this panel in my SIGMOD/PODS day 2 writeup.  The panel consisted of (from right to left) Gustavo Alonso (ETH), Swami Sivasubramanian (AWS), Anastasia Ailamaki (EPFL), Raghu Ramakrishnan (Microsoft), and Sam Madden (MIT). Sailesh Krishnamurthy from Google was unable to attend, so Anastasia who is on sabbatical at Google, also covered for him. The panel started with 5 minutes speeches from participants. The panel was lively and playful. The panelists tried to make their speeches controversial, and have zingers for each other.   Sam talked about the demise of DBMS monolith. He said, the Oracle of 90s is dead because it was incompatible with modern data ecosystem, and the modern DBMSs are shifting towards disaggregated designs. When Sam was a PhD student under Eric Brewer, Eric said we should build disaggregated databases, and people said that won't happen. But we are there now: Disaggregation has arrived! While Sam mentioned about the benefits of disaggregation, he also ca
Read more >>

Why I blog

-
Image
My blog has been going for 14 years now, and has just passed 4 million pageviews. Yay! I remember the 1 million pageviews moment in 2017 ! The main reason I was able to persist for so long is because I blog for selfish reasons. Let me try to unpack why I blog, and why I keep blogging. I write for myself The audience I have in mind is myself. I blog to clarify my understanding and thinking about a topic.  Reading a research/technical paper is already time consuming. I can't do it in less than 4 hours. Period. I love learning. And I am fortunate that I get to read research papers as part of my work. I double-dip on this effort to blog about them, to improve my understanding of these papers. Writing a blog post is the final step in my pipeline for reading a paper. I think my blog reviews of papers hits a good niche. Research papers are written for the wrong audience (or rather maybe the right audience but for the wrong reason): they are written to please 3 specific expert reviewers
Read more >>

There is plenty of room at the bottom

-
Image
This is a pun on the saying "there is always room at the top". This is also the title of a famous Feynman lecture from 1959 , where he made a case for nanotechnology.  In this post, I will try to argue that there is plenty of room at the bottom for distributed algorithms. Most work on distributed algorithms are done at a high-level abstraction plane. These high level solutions do not transfer well to the implementation level, and this opens a lot of space to explore at the implementation level. But this is not just an opportunistic argument. It is imperative to target the implementation level with our distributed algorithms work, otherwise they remain as theoretical, unused, inapplicable.  Let me try to demonstrate using consensus protocols as examples. Someone else can make the same case using another subdomain. Be mindful of what is swept under the rug What is succinct at the high level could be very hard to implement and get right at the low level. Paxos seems simple , bu
Read more >>