Model live prepared-lower ownership during recovery
This commit is contained in:
parent
b288e77ed0
commit
6eba9f25ca
1 changed files with 151 additions and 61 deletions
|
|
@ -2,32 +2,40 @@
|
|||
EXTENDS FiniteSets, TLC
|
||||
|
||||
(***************************************************************************
|
||||
Artifact-level refinement for prepared-lower publication, generation leases,
|
||||
State Anchor use, exact-owned abandoned preparation recovery, and reclaim.
|
||||
Artifact-level refinement for concurrent prepared-lower publication,
|
||||
materializer-loss recovery, generation leases, State Anchor use, and reclaim.
|
||||
***************************************************************************)
|
||||
|
||||
CONSTANTS
|
||||
Generations,
|
||||
Preparations,
|
||||
Artifact,
|
||||
NoArtifact,
|
||||
G1,
|
||||
G2,
|
||||
P1,
|
||||
P2,
|
||||
A1
|
||||
|
||||
ASSUME
|
||||
/\ Generations = {G1, G2}
|
||||
/\ G1 # G2
|
||||
/\ Preparations = {P1, P2}
|
||||
/\ P1 # P2
|
||||
/\ Artifact = A1
|
||||
/\ NoArtifact # Artifact
|
||||
|
||||
ArtifactStates == {"Absent", "Published"}
|
||||
StageStates == {"Absent", "Owned", "Foreign"}
|
||||
MaterializerStates == {"Absent", "Live", "Lost"}
|
||||
GenerationsFixture == {G1, G2}
|
||||
PreparationsFixture == {P1, P2}
|
||||
|
||||
VARIABLES
|
||||
artifactState,
|
||||
stageState,
|
||||
prepareIntent,
|
||||
materializerState,
|
||||
leases,
|
||||
mounts,
|
||||
artifactBinding,
|
||||
|
|
@ -39,6 +47,7 @@ vars == <<
|
|||
artifactState,
|
||||
stageState,
|
||||
prepareIntent,
|
||||
materializerState,
|
||||
leases,
|
||||
mounts,
|
||||
artifactBinding,
|
||||
|
|
@ -49,8 +58,9 @@ vars == <<
|
|||
|
||||
Init ==
|
||||
/\ artifactState = "Absent"
|
||||
/\ stageState = "Absent"
|
||||
/\ prepareIntent = FALSE
|
||||
/\ stageState = [p \in Preparations |-> "Absent"]
|
||||
/\ prepareIntent = [p \in Preparations |-> FALSE]
|
||||
/\ materializerState = [p \in Preparations |-> "Absent"]
|
||||
/\ leases = {}
|
||||
/\ mounts = {}
|
||||
/\ artifactBinding = [g \in Generations |-> NoArtifact]
|
||||
|
|
@ -58,52 +68,86 @@ Init ==
|
|||
/\ replacementPresent = FALSE
|
||||
/\ foreignObserved = FALSE
|
||||
|
||||
BeginPrepare ==
|
||||
BeginPrepare(p) ==
|
||||
/\ artifactState = "Absent"
|
||||
/\ stageState = "Absent"
|
||||
/\ ~prepareIntent
|
||||
/\ prepareIntent' = TRUE
|
||||
/\ stageState[p] = "Absent"
|
||||
/\ ~prepareIntent[p]
|
||||
/\ materializerState[p] = "Absent"
|
||||
/\ prepareIntent' = [prepareIntent EXCEPT ![p] = TRUE]
|
||||
/\ materializerState' = [materializerState EXCEPT ![p] = "Live"]
|
||||
/\ UNCHANGED <<artifactState, stageState, leases, mounts,
|
||||
artifactBinding, gcRequested, replacementPresent, foreignObserved>>
|
||||
|
||||
CreateOwnedStage ==
|
||||
/\ artifactState = "Absent"
|
||||
/\ stageState = "Absent"
|
||||
/\ prepareIntent
|
||||
/\ stageState' = "Owned"
|
||||
/\ UNCHANGED <<artifactState, prepareIntent, leases, mounts,
|
||||
CreateOwnedStage(p) ==
|
||||
/\ stageState[p] = "Absent"
|
||||
/\ prepareIntent[p]
|
||||
/\ materializerState[p] = "Live"
|
||||
/\ stageState' = [stageState EXCEPT ![p] = "Owned"]
|
||||
/\ UNCHANGED <<artifactState, prepareIntent, materializerState, leases,
|
||||
mounts, artifactBinding, gcRequested, replacementPresent,
|
||||
foreignObserved>>
|
||||
|
||||
LoseMaterializer(p) ==
|
||||
/\ prepareIntent[p]
|
||||
/\ materializerState[p] = "Live"
|
||||
/\ materializerState' = [materializerState EXCEPT ![p] = "Lost"]
|
||||
/\ UNCHANGED <<artifactState, stageState, prepareIntent, leases, mounts,
|
||||
artifactBinding, gcRequested, replacementPresent, foreignObserved>>
|
||||
|
||||
PublishArtifact ==
|
||||
PublishArtifact(p) ==
|
||||
/\ artifactState = "Absent"
|
||||
/\ stageState = "Owned"
|
||||
/\ prepareIntent
|
||||
/\ stageState[p] = "Owned"
|
||||
/\ prepareIntent[p]
|
||||
/\ materializerState[p] = "Live"
|
||||
/\ artifactState' = "Published"
|
||||
/\ stageState' = "Absent"
|
||||
/\ prepareIntent' = FALSE
|
||||
/\ stageState' = [stageState EXCEPT ![p] = "Absent"]
|
||||
/\ prepareIntent' = [prepareIntent EXCEPT ![p] = FALSE]
|
||||
/\ materializerState' = [materializerState EXCEPT ![p] = "Absent"]
|
||||
/\ UNCHANGED <<leases, mounts, artifactBinding, gcRequested,
|
||||
replacementPresent, foreignObserved>>
|
||||
|
||||
RecoverOwnedStage ==
|
||||
/\ artifactState = "Absent"
|
||||
/\ stageState = "Owned"
|
||||
/\ prepareIntent
|
||||
/\ stageState' = "Absent"
|
||||
/\ prepareIntent' = FALSE
|
||||
ReusePublishedArtifact(p) ==
|
||||
/\ artifactState = "Published"
|
||||
/\ ~gcRequested
|
||||
/\ stageState[p] = "Owned"
|
||||
/\ prepareIntent[p]
|
||||
/\ materializerState[p] = "Live"
|
||||
/\ stageState' = [stageState EXCEPT ![p] = "Absent"]
|
||||
/\ prepareIntent' = [prepareIntent EXCEPT ![p] = FALSE]
|
||||
/\ materializerState' = [materializerState EXCEPT ![p] = "Absent"]
|
||||
/\ UNCHANGED <<artifactState, leases, mounts, artifactBinding,
|
||||
gcRequested, replacementPresent, foreignObserved>>
|
||||
|
||||
ObserveForeignStage ==
|
||||
/\ artifactState = "Absent"
|
||||
/\ stageState = "Absent"
|
||||
/\ ~prepareIntent
|
||||
/\ stageState' = "Foreign"
|
||||
/\ foreignObserved' = TRUE
|
||||
/\ UNCHANGED <<artifactState, prepareIntent, leases, mounts,
|
||||
artifactBinding, gcRequested, replacementPresent>>
|
||||
RecoverUnmaterializedIntent(p) ==
|
||||
/\ stageState[p] = "Absent"
|
||||
/\ prepareIntent[p]
|
||||
/\ materializerState[p] = "Lost"
|
||||
/\ prepareIntent' = [prepareIntent EXCEPT ![p] = FALSE]
|
||||
/\ materializerState' = [materializerState EXCEPT ![p] = "Absent"]
|
||||
/\ UNCHANGED <<artifactState, stageState, leases, mounts,
|
||||
artifactBinding, gcRequested, replacementPresent, foreignObserved>>
|
||||
|
||||
RefuseForeignStage ==
|
||||
/\ stageState = "Foreign"
|
||||
RecoverOwnedStage(p) ==
|
||||
/\ stageState[p] = "Owned"
|
||||
/\ prepareIntent[p]
|
||||
/\ materializerState[p] = "Lost"
|
||||
/\ stageState' = [stageState EXCEPT ![p] = "Absent"]
|
||||
/\ prepareIntent' = [prepareIntent EXCEPT ![p] = FALSE]
|
||||
/\ materializerState' = [materializerState EXCEPT ![p] = "Absent"]
|
||||
/\ UNCHANGED <<artifactState, leases, mounts, artifactBinding,
|
||||
gcRequested, replacementPresent, foreignObserved>>
|
||||
|
||||
ObserveForeignStage(p) ==
|
||||
/\ stageState[p] = "Absent"
|
||||
/\ ~prepareIntent[p]
|
||||
/\ materializerState[p] = "Absent"
|
||||
/\ stageState' = [stageState EXCEPT ![p] = "Foreign"]
|
||||
/\ foreignObserved' = TRUE
|
||||
/\ UNCHANGED <<artifactState, prepareIntent, materializerState, leases,
|
||||
mounts, artifactBinding, gcRequested, replacementPresent>>
|
||||
|
||||
RefuseForeignStage(p) ==
|
||||
/\ stageState[p] = "Foreign"
|
||||
/\ UNCHANGED vars
|
||||
|
||||
AcquireLease(g) ==
|
||||
|
|
@ -112,46 +156,52 @@ AcquireLease(g) ==
|
|||
/\ g \notin leases
|
||||
/\ leases' = leases \cup {g}
|
||||
/\ artifactBinding' = [artifactBinding EXCEPT ![g] = Artifact]
|
||||
/\ UNCHANGED <<artifactState, stageState, prepareIntent, mounts,
|
||||
gcRequested, replacementPresent, foreignObserved>>
|
||||
/\ UNCHANGED <<artifactState, stageState, prepareIntent,
|
||||
materializerState, mounts, gcRequested, replacementPresent,
|
||||
foreignObserved>>
|
||||
|
||||
MountStateAnchor(g) ==
|
||||
/\ g \in leases
|
||||
/\ artifactBinding[g] = Artifact
|
||||
/\ g \notin mounts
|
||||
/\ mounts' = mounts \cup {g}
|
||||
/\ UNCHANGED <<artifactState, stageState, prepareIntent, leases,
|
||||
artifactBinding, gcRequested, replacementPresent, foreignObserved>>
|
||||
/\ UNCHANGED <<artifactState, stageState, prepareIntent,
|
||||
materializerState, leases, artifactBinding, gcRequested,
|
||||
replacementPresent, foreignObserved>>
|
||||
|
||||
UnmountStateAnchor(g) ==
|
||||
/\ g \in mounts
|
||||
/\ mounts' = mounts \ {g}
|
||||
/\ UNCHANGED <<artifactState, stageState, prepareIntent, leases,
|
||||
artifactBinding, gcRequested, replacementPresent, foreignObserved>>
|
||||
/\ UNCHANGED <<artifactState, stageState, prepareIntent,
|
||||
materializerState, leases, artifactBinding, gcRequested,
|
||||
replacementPresent, foreignObserved>>
|
||||
|
||||
ReleaseLease(g) ==
|
||||
/\ g \in leases
|
||||
/\ g \notin mounts
|
||||
/\ leases' = leases \ {g}
|
||||
/\ artifactBinding' = [artifactBinding EXCEPT ![g] = NoArtifact]
|
||||
/\ UNCHANGED <<artifactState, stageState, prepareIntent, mounts,
|
||||
gcRequested, replacementPresent, foreignObserved>>
|
||||
/\ UNCHANGED <<artifactState, stageState, prepareIntent,
|
||||
materializerState, mounts, gcRequested, replacementPresent,
|
||||
foreignObserved>>
|
||||
|
||||
RequestGC ==
|
||||
/\ artifactState = "Published"
|
||||
/\ leases = {}
|
||||
/\ ~gcRequested
|
||||
/\ gcRequested' = TRUE
|
||||
/\ UNCHANGED <<artifactState, stageState, prepareIntent, leases, mounts,
|
||||
artifactBinding, replacementPresent, foreignObserved>>
|
||||
/\ UNCHANGED <<artifactState, stageState, prepareIntent,
|
||||
materializerState, leases, mounts, artifactBinding,
|
||||
replacementPresent, foreignObserved>>
|
||||
|
||||
PublishReplacementDuringGC ==
|
||||
/\ artifactState = "Published"
|
||||
/\ gcRequested
|
||||
/\ ~replacementPresent
|
||||
/\ replacementPresent' = TRUE
|
||||
/\ UNCHANGED <<artifactState, stageState, prepareIntent, leases, mounts,
|
||||
artifactBinding, gcRequested, foreignObserved>>
|
||||
/\ UNCHANGED <<artifactState, stageState, prepareIntent,
|
||||
materializerState, leases, mounts, artifactBinding, gcRequested,
|
||||
foreignObserved>>
|
||||
|
||||
ReclaimArtifact ==
|
||||
/\ artifactState = "Published"
|
||||
|
|
@ -161,16 +211,19 @@ ReclaimArtifact ==
|
|||
/\ artifactState' = IF replacementPresent THEN "Published" ELSE "Absent"
|
||||
/\ gcRequested' = FALSE
|
||||
/\ replacementPresent' = FALSE
|
||||
/\ UNCHANGED <<stageState, prepareIntent, leases, mounts,
|
||||
artifactBinding, foreignObserved>>
|
||||
/\ UNCHANGED <<stageState, prepareIntent, materializerState, leases,
|
||||
mounts, artifactBinding, foreignObserved>>
|
||||
|
||||
Next ==
|
||||
\/ BeginPrepare
|
||||
\/ CreateOwnedStage
|
||||
\/ PublishArtifact
|
||||
\/ RecoverOwnedStage
|
||||
\/ ObserveForeignStage
|
||||
\/ RefuseForeignStage
|
||||
\/ (\E p \in Preparations : BeginPrepare(p))
|
||||
\/ (\E p \in Preparations : CreateOwnedStage(p))
|
||||
\/ (\E p \in Preparations : LoseMaterializer(p))
|
||||
\/ (\E p \in Preparations : PublishArtifact(p))
|
||||
\/ (\E p \in Preparations : ReusePublishedArtifact(p))
|
||||
\/ (\E p \in Preparations : RecoverUnmaterializedIntent(p))
|
||||
\/ (\E p \in Preparations : RecoverOwnedStage(p))
|
||||
\/ (\E p \in Preparations : ObserveForeignStage(p))
|
||||
\/ (\E p \in Preparations : RefuseForeignStage(p))
|
||||
\/ (\E g \in Generations : AcquireLease(g))
|
||||
\/ (\E g \in Generations : MountStateAnchor(g))
|
||||
\/ (\E g \in Generations : UnmountStateAnchor(g))
|
||||
|
|
@ -183,8 +236,9 @@ Spec == Init /\ [][Next]_vars
|
|||
|
||||
TypeOK ==
|
||||
/\ artifactState \in ArtifactStates
|
||||
/\ stageState \in StageStates
|
||||
/\ prepareIntent \in BOOLEAN
|
||||
/\ stageState \in [Preparations -> StageStates]
|
||||
/\ prepareIntent \in [Preparations -> BOOLEAN]
|
||||
/\ materializerState \in [Preparations -> MaterializerStates]
|
||||
/\ leases \subseteq Generations
|
||||
/\ mounts \subseteq Generations
|
||||
/\ artifactBinding \in [Generations -> {NoArtifact, Artifact}]
|
||||
|
|
@ -192,6 +246,38 @@ TypeOK ==
|
|||
/\ replacementPresent \in BOOLEAN
|
||||
/\ foreignObserved \in BOOLEAN
|
||||
|
||||
PrepareOwnershipConsistent ==
|
||||
\A p \in Preparations :
|
||||
/\ prepareIntent[p] <=> materializerState[p] # "Absent"
|
||||
/\ stageState[p] = "Owned" => prepareIntent[p]
|
||||
/\ stageState[p] = "Foreign" =>
|
||||
/\ ~prepareIntent[p]
|
||||
/\ materializerState[p] = "Absent"
|
||||
|
||||
LiveOwnedStageNotRecoverable ==
|
||||
\A p \in Preparations :
|
||||
materializerState[p] = "Live" => ~ENABLED RecoverOwnedStage(p)
|
||||
|
||||
LostOwnedStageRecoverable ==
|
||||
\A p \in Preparations :
|
||||
/\ materializerState[p] = "Lost"
|
||||
/\ stageState[p] = "Owned"
|
||||
=> ENABLED RecoverOwnedStage(p)
|
||||
|
||||
LostIntentRecoverable ==
|
||||
\A p \in Preparations :
|
||||
/\ materializerState[p] = "Lost"
|
||||
/\ stageState[p] = "Absent"
|
||||
=> ENABLED RecoverUnmaterializedIntent(p)
|
||||
|
||||
PublishedOwnedStageReusable ==
|
||||
\A p \in Preparations :
|
||||
/\ artifactState = "Published"
|
||||
/\ ~gcRequested
|
||||
/\ materializerState[p] = "Live"
|
||||
/\ stageState[p] = "Owned"
|
||||
=> ENABLED ReusePublishedArtifact(p)
|
||||
|
||||
LeaseBindingConsistent ==
|
||||
\A g \in Generations :
|
||||
(g \in leases) <=> (artifactBinding[g] = Artifact)
|
||||
|
|
@ -213,9 +299,6 @@ ReplacementOnlyDuringGC ==
|
|||
replacementPresent => gcRequested
|
||||
|
||||
ForeignStagePreserved ==
|
||||
foreignObserved => stageState = "Foreign"
|
||||
|
||||
OwnedStageRequiresIntent ==
|
||||
stageState = "Owned" => prepareIntent
|
||||
foreignObserved => \E p \in Preparations : stageState[p] = "Foreign"
|
||||
|
||||
=============================================================================
|
||||
|
|
|
|||
Loading…
Reference in a new issue