Beyond the Code: TLA+ and the Art of Abstraction

-

I have been teaching a TLA+ miniseries inside AWS. I just finished the 10th week, with a one hour seminar each week. I wanted to pen down my learnings from this experience.


The art of abstraction

Let's start with abstraction. Abstraction is a powerful tool for avoiding distraction. The etimology of the word abstract comes from Latin for cut and draw away. With abstraction, you slice out the protocol from a complex system, omit unnecessary details, and simplify a complex system into a useful model. For example, if you are interested in the consistency model of your distributed system, you can abstract away the mechanics of communication in the system when that is an unnecessary distraction.

In his 2019 talk, Leslie Lamport said:

Abstraction, abstraction, abstraction! That's how you win a Turing Award.
Inside Amazon abstraction is also very valuable. We see skilled engineers look at large systems, slice out a protocol/subsystem, cut to the essence of it, and dive deep to make the change to improve it or fix a problem. Abstraction is an invaluable skill. This is what I mean by "going beyond the code" in the title.
The only mental tool by means of which a very finite piece of reasoning can cover a myriad cases is called "abstraction"; as a result the effective exploitation of his powers of abstraction must be regarded as one of the most vital activities of a competent programmer. In this connection it might be worth-while to point out that the purpose of abstraction is not to be vague, but to create a new semantic level in which one can be absolutely precise. --Edsger W. Dijkstra
When we say abstraction, we are not just talking about layering (as in OSI model), interfaces, or modules and encapsulation. That is a very narrow understanding of the idea of abstraction. The more general understanding would be about refinement: a high-level abstract model allowing multiple implementations. The art is to see/find that high-level abstract model that eliminates the irrelevant and the amplifies the essential. You also need to figure out what is the appropriate level for the abstract component, and what is the nature of that abstract component, so it allows a more efficient or fault-tolerant implementation that you may be interested in without interfering with other subsystems in its environment. Abstraction requires both domain knowledge and proper skills, lest you abstract away an important detail/feature -- going with the first meaning of detail here.
We can not solve our problems with the same level of thinking that created them --Albert Einstein
We would like to teach this skill to new engineers. But how do we go about this? My biggest learning from the TLA+ miniseries has been that: TLA+ is useful for teaching engineers the art of abstraction and the right way to think/reason about distributed systems.

Don't get me wrong. I found abstraction the hardest thing to teach in my series. It is almost as if it requires osmosis and some transfer of zen to communicate the abstraction idea. It still remains pretty much an art.

But TLA+ is very useful in getting across the idea of abstraction, and below I will try to explain why I think so.


Foundations of TLA+: specifying with math

TLA+ has been popular for distributed systems modeling. Lamport came up with it in the 1990s. It's built on strong principles for modeling practical systems, since Lamport had strong industry collaborations. The model checker came in 2000. But even throughout the nineties, TLA+ was delivering value for people to write precise and unambiguous specification, and make them focus on the problem. English is ambiguous.

Specifying using math, rather than a programming language, has a special magic to it. It forces you to focus on the what rather than the how. It forces you--it shakes you-- out of your comfort zone. And you have to think mathematically.

I experienced developers grabs this concept quickly. I worked with an Level 7 and Level 6 engineer in my team and they were able to become productive with TLA+ in a couple of days. I wrote a system and the L7 zoomed in on a complicated subsystem of it and wrote a TLA+ model in a couple of days. For the other case, I modeled a protocol and the L6 was able to, in a couple of days, pick up on TLA+ and write variants of the protocol and solve his problems with these models. When I talked to them afterwards, they told me that they wish all their programming could be this fast. And magic like.


Foundations of TLA+: global state-transition model

TLA+ enables you to write succinct models fast. Marc Brooker had a throwaway comment on company Slack, which I love and try to put in all my talks about TLA+.

Global shared memory model is surely a handy fiction --Marc Brooker
Yes, TLA+ gives you a stop-the-world transition from one global state to another state by way of a protocol action, and it gives you the God view into the global state of the distributed system you are modeling. The consequence is that safety invariants and liveness properties are written as one liners since the entire global state is accessible for evaluation. This setup enables TLA+ users to model and reason about distributed systems in a succinct and fast manner.

If you want some elaboration on this, here is the TLA+ computation model in a nut shell. A system consist of two things:

  • A set of variables (global shared memory model)
  • A set of assignments (called "actions")

The global system state evolves as actions take the state to the next state, state', (as in Hoare logic).

{state} transitioning-action {state’}

Finally, the execution of an assignment can be conditional on a predicate (i.e., guard) being true. And that's all folks. This is TLA+'s handy fiction that enables you to write succinct models fast.


TLA+ use at AWS

I covered two points about TLA+ (saving a third one at the end of the post)

  1. TLA+ forces you to think mathematically/abstractly
  2. TLA+ enables you to write succinct models fast (by giving you this handy fiction of global shared memory)

I think these make TLA+ indispensable for design space exploration and converging on a protocol or a protocol variant for discovery, improvement, or fixing.

You can see this niche playing through AWS history. Chris Newcombe and Tim Raft gave a Principals of Amazon talk in 2012 bringing TLA+ to the attention of other engineers working on tricky distributed systems protocols. They published a paper in 2015 and shared this with the public. This fired up TLA+ interest in industry.

Today there are hundreds of TLA+ models in AWS, including from S3, DynamoDB, EBS, EFS, Lambda, Journal, etc. The common pattern on all these models is that, the engagement came organic and in a grassroots manner rather than by prescription or through a systematic process. An engineer is faced with a tricky concurrency/distributed system problem, and they bang their heads to the wall. Then they realize that they need to solve this problem at a higher level of thinking that created the problem. They hear by word of mouth about TLA+ and apply it to their problem, and solve it. Then they go away to do other things for a couple more years until they see another suitable problem to apply it. That's why I teach the miniseries and record the lectures. I like to teach the engineers to be prepared so when they see a problem that would benefit from TLA+ modeling. The problem the L6 I mentioned earlier was working on was the secondary index build. This is a background job. I mean, you wouldn't think this is concurrency/coordination intensive task, it is a background job. But it has interesting tricky concurrence race conditions with the foreground operations, and it benefited a lot from modeling with TLA+. If you learn TLA+ in advance, you would be in a good position (luck favors the prepared) to recognize when this is a useful problem to apply TLA+ and get leverage from it.


Other learnings from teaching

Here are some other learnings from my teaching. The hardest thing to teach is still abstraction. TLA+ makes this easier by forcing you from your comfort zone to think beyond the code. But still abstraction is an art. It seems to require osmosis to learn if you have hints, send them my way, because I'm really curious to learn. This is an important thing to teach to our engineers. What I found is nothing beats hands on learning and reading other models. So that's what I try to do in my miniseries.

There is still insufficient content for teaching intermediate concepts like refinement. Refinement is important because it is at the heart of the abstraction concept. TLA+ makes refinement very convenient, but we need to see more examples. I relegate my discussion of refinement to the end of this post.

The engineers like PlusCal. So I teach them how to write in PlusCal and read in TLA+. PlusCal is the gateway drug to TLA+, as Chris Newcombe likes to say.

The VScode plugin that came  recently has been great. It creates less friction in learning/trying TLA+ and we need more ecosystem tools that reduce friction. And if we want the TLA+ idea to reach more developers and thrive, we need developer influencers and good expositioners, like Hillel. We need practical examples that developers can relate to. Hillel's learntla site is a very useful resource, and we need more.

I had recently committed a snapshot isolated key-value database model to the TLA+ examples repo. I request you to contribute more TLA+ specification examples to https://github.com/tlaplus/Examples/, so you can help people to pickup TLA+ and master the art of modeling with TLA+. We need examples from different use cases and subfields.  


What will the future bring

I am really excited about the TLA+ foundation that launched in April under the Linux foundation. AWS is of course an inaugural member and sponsor. TLA+ has monthly community meetings open to public, and I hope the foundation will lead to way to more people getting involved in the development of TLA+ tools and ecosystem. Leslie Lamport attends the community meetings, so this could be your chance to see him at work, and get involved with the TLA+ community.

I like to mention two big threads for the future. The first is test case generation from TLA+ models to exercise the underlying implementation to explore behavior in cornercase scenarios. The second is the dual of it. Feeding the implementation's traces (with an appropriate abstraction function) to the high level TLA+ models for conformance checking. There are already some examples of these, but we hope to see some tools mature in these areas. The TLA+ foundation will release a call for proposal soon and include these areas for funding.

There are other interesting stuff happening on TLA+, like simulation for performance and availability modeling. You can see an example of it here.


Coexist! Use the right tool for the job

"In most cases, strengths and weaknesses are two sides of the same coin. A strength in one situation is a weakness in another..."
-- Steve Jobs

I am a big fan of TLA+, but I'm not a language zealot/exclusivist. A good craftsperson does not blame their tools, right? A good craftsperson also does not say "oh my screwdriver, that's my best tool. It is all I need all the time. I use it instead of a hammer." No, you use the right tool for the right job. So for something that requires utmost confidence use an automated proof tool. Although TLA+ has TLAPS proof system Daphne is superior for proving transition systems. So use Daphne for that, right? So for conformance checking or testing, use a suitable modeling tool. AWS published "Using Lightweight Formal Methods to Validate a Key-Value Storage Node in Amazon S3" where they used Rust based reference models for validating a system written in Rust. P would also work for conformance checking.
 
My point is,  there is still a big niche for TLA+ for modeling a protocol at the abstract level and making progress there: fixing a problem, or coming up with a variant of it by exploring the design space further. With TLA+, you are able to abstract things away, and you are able to write one-liners for checking, and focus on the essential quickly. Formal methods need to learn to "coexist" like the American bumper sticker says, and even better to learn to thrive together by sharing some formal methods tooling infrastructure.


Foundations of TLA+: refinement

Ok, this is what I saved for the end of the post. If you are still interested in reading more about TLA+ and abstraction, here it is.

Refinement is at the heart of abstraction, and is also a cornerstone of TLA+. In TLA+, refinement is just implication just as God intended. This means, the concrete system behaviors is a subset of allowed abstract system behaviors. So refinement is well supported in TLA+. Even any invariant evaluation is done in principle as refinement: Does the system model refine/implement this invariant formula?

Unfortunately, as I mentioned above, we don't see many examples of a TLA+ model refining another in terms of implementing in a stepwise refinement hierarchy. It is well supported, but we don't see more examples of it. It is simply done via declaring an instance of the abstract system in the concrete one, and checking the abstract's spec as an action property via TLC. This checks that any behavior generated of the concrete system is an accepted behavior of the abstract system.

Leslie Lamport's talk I referenced above gives a great example of this, when he explained how he had discovered Paxos. There the abstract *Consensus* problem is given as a brief abstract system. Then an intermediate abstract solution, voting is defined, and shown (and model-checked) to be a refinement of the *Consensus* problem model. The *Voting* model is still abstract, because it describes what properties the voting need to satisfy, but not how the acceptors implement these properties. Finally, Lamport shows a *Paxos* model that refines the *Voting* model. (Some people may find Hillel's simpler refinement example easier to follow.)

What is the right level of abstraction to use? How do we choose the abstract system to refine to? In a quote attributed to Einstein, he says: "Everything should be made as simple as possible, but not simpler." Not very useful, isn't it? But that is all we have as a guideline. Here all we can show is examples of refinement and examples of abstraction, and wait till the concepts click.

Of course the engineers initially fight with it. When we went over a two-phase commit model, they asked me why this is using shared memory rather than message passing. I explained that for the properties I like to explore, such as blocking upon transaction manager (TM) failure, the shared memory model is enough where the TM can read the states of resource managers (RMs) and RMs can read the state of TM. We would be able change this to a simple message passing version if we add a set to maintain the messages sent and filter from that set. For the next seminar, I wrote a message passing version. This added more state, made the model bloated, but did not add any interesting behavior over the shared memory version. I hated doing it, and had to take a shower afterwards, because it felt dirty.

Comments

Post a Comment

Popular posts from this blog

Hints for Distributed Systems Design

-
This is with apologies to Butler Lampson, who published the " Hints for computer system design " paper 40 years ago in SOSP'83. I don't claim to match that work of course. I just thought I could draft this post to organize my thinking about designing distributed systems and get feedback from others. I start with the same  disclaimer Lampson gave. These hints are not novel, not foolproof recipes, not laws of design, not precisely formulated, and not always appropriate. They are just hints.  They are context dependent, and some of them may be controversial. That being said, I have seen these hints successfully applied in distributed systems design throughout my 25 years in the field, starting from the theory of distributed systems (98-01), immersing into the practice of wireless sensor networks (01-11), and working on cloud computing systems both in the academia and industry ever since. These heuristic principles have been applied knowingly or unknowingly and has proven
Read more >>

Learning about distributed systems: where to start?

-
This is definitely not a "learn distributed systems in 21 days" post. I recommend a principled, from the foundations-up, studying of distributed systems, which will take a good three months in the first pass, and many more months to build competence after that. If you are practical and coding oriented you may not like my advice much. You may object saying, "Shouldn't I learn distributed systems with coding and hands on? Why can I not get started by deploying a Hadoop cluster, or studying the Raft code." I think that is the wrong way to go about learning distributed systems, because seeing similar code and programming language constructs will make you think this is familiar territory, and will give you a false sense of security. But, nothing can be further from the truth. Distributed systems need radically different software than centralized systems do.  --A. Tannenbaum This quotation is literally the first sentence in my distributed systems syllabus. Inst
Read more >>

Making database systems usable

-
Image
C. J. Date's Sigmod 1983 keynote, "Database Usability", was prescient. Usability is the most important thing to the customers. They care less about impressive benchmarks or clever algorithms, and more about whether they can operate and use a database efficiently to query, update, analyze, and persist their data with minimal headache. (BTW, does anyone have a link to the contents of this Sigmod'83 talk? There is no transcript around, except for this short abstract .) The paper we cover today is from Sigmod 2007. It takes on the database usability problem raised in that 1983 keynote head-on, and calls out that the king is still naked.  Let's give some context for the year 2007. Yes, XML format was still popular then. The use-case in the paper is XQuery. The paper does not contain any  reference to json. MongoDB would be released in 2009 with the document model; and that seems to be great timing for some of the usability pains mentioned in the paper! Web 2.0 was in
Read more >>

Looming Liability Machines (LLMs)

-
As part of our zoom reading group ( wow, 4.5 years old now ), we discussed a paper that uses LLMs for automatic root cause analysis (RCA) for cloud incidents. This was a pretty straightforward application of LLMs. The proposed system employs an LLM to match incoming incidents to incident handlers based on their alert types, predicts the incident's root cause category, and provides an explanatory narrative. The only customization is through prompt-engineering. Since this is a custom domain, I think a more principled and custom-designed  machine learning system would be more appropriate rather than adopting LLMs. Anyways, the use of LLMs for RCAs spooked me vicerally. I couldn't find the exact words during the paper discussion, but I can articulate this better now. Let me explain. RCA is serious business Root cause analysis (RCA) is the process of identifying the underlying causes of a problem/incident, rather than just addressing its symptoms. One RCA heuristic is asking 5 Why&#
Read more >>

Foundational distributed systems papers

-
I talked about the importance of reading foundational papers last week. To followup, here is my compilation of foundational papers in the distributed systems area. (I focused on the core distributed systems area, and did not cover networking, security, distributed ledgers, verification work etc. I even left out distributed transactions, I hope to cover them at a later date.)  I classified the papers by subject, and listed them in chronological order. I also listed expository papers and blog posts at the end of each section. Time and State in Distributed Systems Time, Clocks, and the Ordering of Events in a Distributed System. Leslie Lamport, Commn. of the ACM,  1978. Distributed Snapshots: Determining Global States of a Distributed System. K. Mani Chandy Leslie Lamport, ACM Transactions on Computer Systems, 1985. Virtual Time and Global States of Distributed Systems.  Mattern, F. 1988. Practical uses of synchronized clocks in distributed systems. B. Liskov, 1991. Expository papers
Read more >>

Advice to the young

-
Image
I notice I haven't written any advice posts recently. Here is a collection of my advice posts pre 2020. I've been feeling all this elderly wisdom pent up in me, ready to pour at any moment. So here it goes. Get ready to quench your thirst from my fount of wisdom. No man, think for yourself, only get what works for you. It is called foundations, not theory Foundations of computer science (or rather any field of study) are the most important topics you can learn. These lay down the frame of thinking/perspective for that area of study. Yet, I am saddened to hear these called as "theory", and labeled as "unpractical". This couldn't be farther from the truth. Take a look at how I recommend studying distributed systems . Don't you dare call this "theory" and "unpractical". This lays the bedrock that you build your practice on. Don't skimp on the foundations. Don't build your home on quicksand. Keep your hands dirty, your mind cl
Read more >>

Linearizability: A Correctness Condition for Concurrent Objects

-
Image
This paper is from Herlihy and Wing appeared in ACM Transactions on Programming Languages and Systems 1990. This is the canonical reference for the linearizability definition. I had not read this paper in detail before, so I thought it would be good to go to the source to see if there are additional delightful surprises in the original text. Hence, this post. I will dive into a technical analysis of the paper first, and then discuss some of my takes toward the end. I had written an accessible explanation of linearizability earlier; you may want to read that first. I will assume an understanding of linearizability to keep this review at reasonable length. Introduction I love how the old papers just barge in with the model, without bothered by pleasantries such as motivation of the problem. These are the first two sentences of the introduction. "A concurrent system consists of a collection of sequential processes that communicate through shared typed objects . This model encompass
Read more >>

Scalable OLTP in the Cloud: What’s the BIG DEAL?

-
Image
This paper is from Pat Helland, the apostate philosopher of database systems, overall a superb person, and a good friend of mine. The paper appeared this week at CIDR'24. (Check out the program for other interesting papers). The motivating question behind this work is: " What are the asymptotic limits to scale for cloud OLTP (OnLine Transaction Processing) systems? " Pat says that the CIDR 2023 paper "Is Scalable OLTP in the Cloud a Solved Problem?" prompted this question.  The answer to the question? Pat says that the answer lies in the joint responsibility of database and the application. If you know of Pat's work, which I have summarized several in this blog , you would know that Pat has been advocating along these lines before. But this paper provides a very crisp, specific, concrete answer. Read on for my summary of the paper. Disclaimer: This is a wisdom and technical information/detail packed 13-page paper, so I will try my best to summarize the sa
Read more >>

Understanding the Performance Implications of Storage-Disaggregated Databases

-
Image
Storage-compute disaggregation in databases has emerged as a pivotal architecture in cloud environments, as evidenced by Amazon ( Aurora ), Microsoft ( Socrates ), Google (AlloyDB), Alibaba ( PolarDB ), and Huawei (Taurus). This approach decouples compute from storage, allowing for independent and elastic scaling of compute and storage resources. It provides fault-tolerance at the storage level. You can then share the storage for other services, such as adding read-only replicas for the databases. You can even use the storage level for easier sharding of your database. Finally, you can also use this for exporting a changelog asynchronously to feed into peripheral cloud services, such as analytics. Disaggregated architecture was the topic of Sigmod 23 panel . I think this quote summarizes the industry's thinking on the topic. "Disaggregated architecture is here, and is not going anywhere. In a disaggregated architecture, storage is fungible, and computing scales independently.
Read more >>

Designing Data Intensive Applications (DDIA) Book

-
Image
We started reading this book as part of Alex Petrov's book club . We just got started, so you can join us, by joining the discord channel above. We meet Wednesday's 11am Eastern Time.  Previously we had read transaction processing book by Grey and Reuters. This page links to my summaries of that book. Chp 1. Reliable, Scalable, and Maintainable Applications I love the diagrams opening each chapter. Beautiful! The first chapter consists of warm up stuff. It talks about the definitions of reliabilty, scalability, and maintainability. It is still engaging, because  it is written with an educator and technical blogger voice, rather than a dry academic voice. This book came out on 2017. Martin is working on the new version. So if you have comments for things to focus on for the new version, it would be helpful to collect them in a document and email it to Martin. For example, I am curious about how the below paragraph from the Preface will get revised with 8 more years of hindsight:
Read more >>