Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Distributed Data Structures in Coq

Distributed Data Structures in Coq

RICON East 2013 lightning talk.

Christopher Meiklejohn

May 13, 2013
Tweet

More Decks by Christopher Meiklejohn

Other Decks in Programming

Transcript

  1. DISTRIBUTED DATA
    STRUCTURES IN COQ
    Christopher Meiklejohn
    @cmeik
    Tuesday, May 14, 13

    View Slide

  2. Tuesday, May 14, 13

    View Slide

  3. COQ
    Tuesday, May 14, 13

    View Slide

  4. CRDTs
    Tuesday, May 14, 13

    View Slide

  5. G-COUNTERS
    Tuesday, May 14, 13

    View Slide

  6. Vector Clocks
    Credit: http://en.wikipedia.org/wiki/File:Vector_Clock.svg
    Tuesday, May 14, 13

    View Slide

  7. CLOCKS
    Tuesday, May 14, 13

    View Slide

  8. IMPLEMENTATION
    Tuesday, May 14, 13

    View Slide

  9. 1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    Module ClockMap := FMapWeakList.Make (Nat_as_Legacy_OT).
    Module ClockMapFacts := FMapFacts.Facts (ClockMap).
    Tuesday, May 14, 13

    View Slide

  10. 1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    Definition Clock_merge (n1 n2 : option nat) :=
    match n1, n2 with
    | None, None => None
    | Some n, None => Some n
    | None, Some n => Some n
    | Some n1', Some n2' => Some (max n1' n2')
    end.
    Definition Clock_compare (n1 n2 : option nat) :=
    match n1, n2 with
    | None, None => None
    | Some n, None => Some false
    | None, Some n => Some true
    | Some n1', Some n2' => Some (leb n1' n2')
    end.
    Tuesday, May 14, 13

    View Slide

  11. PROOFS
    Tuesday, May 14, 13

    View Slide

  12. 1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    Lemma Clock_merge_comm : forall n1 n2,
    Clock_merge n1 n2 = Clock_merge n2 n1.
    Proof.
    intros. destruct n1; destruct n2; auto.
    simpl. f_equal. apply Max.max_comm.
    Qed.
    Tuesday, May 14, 13

    View Slide

  13. 1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    Lemma Clock_merge_idempotent : forall n1,
    Clock_merge n1 n1 = n1.
    Proof.
    intros. destruct n1; auto; simpl.
    f_equal. apply Max.max_idempotent.
    Qed.
    Tuesday, May 14, 13

    View Slide

  14. 1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    Lemma Clock_merge_assoc : forall n1 n2 n3,
    Clock_merge n1 (Clock_merge n2 n3) = Clock_merge (Clock_merge n1 n2)
    n3.
    Proof.
    intros. destruct n1; destruct n2; destruct n3; auto.
    unfold Clock_merge. f_equal. apply Max.max_assoc.
    Qed.
    Tuesday, May 14, 13

    View Slide

  15. G-COUNTERS
    Tuesday, May 14, 13

    View Slide

  16. IMPLEMENTATION
    Tuesday, May 14, 13

    View Slide

  17. 1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    Definition G_Counter := ClockMap.t nat.
    Definition G_Counter_init : G_Counter := ClockMap.empty nat.
    Tuesday, May 14, 13

    View Slide

  18. 1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    Definition G_Counter_incr actor clocks :=
    match ClockMap.find actor clocks with
    | None => ClockMap.add actor 1 clocks
    | Some count => (ClockMap.add actor (S count) clocks)
    end.
    Tuesday, May 14, 13

    View Slide

  19. 1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    Definition G_Counter_reveal clocks :=
    ClockMap.fold (fun key elt acc => (plus acc elt)) clocks 0.
    Tuesday, May 14, 13

    View Slide

  20. 1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    Definition G_Counter_merge c1 c2 :=
    ClockMap.map2 Clock_merge c1 c2.
    Tuesday, May 14, 13

    View Slide

  21. 1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    Definition G_Counter_equal (c1 c2 : G_Counter) :=
    ClockMap.Equal c1 c2.
    Tuesday, May 14, 13

    View Slide

  22. 1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    Definition G_Counter_compare (c1 c2 : G_Counter) :=
    ClockMap.Equal
    (ClockMap.map2 Clock_compare c1 c2) (ClockMap.map2 Clock_true c1 c2).
    Tuesday, May 14, 13

    View Slide

  23. PROOFS
    Tuesday, May 14, 13

    View Slide

  24. 1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    Theorem G_Counter_merge_comm : forall c1 c2,
    G_Counter_equal (G_Counter_merge c1 c2) (G_Counter_merge c2 c1).
    Proof.
    intros; unfold G_Counter_merge.
    unfold ClockMap.Equal; intro.
    repeat rewrite ClockMapFacts.map2_1bis; auto.
    apply Clock_merge_comm.
    Qed.
    Tuesday, May 14, 13

    View Slide

  25. 1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    Theorem G_Counter_merge_idempotent : forall clocks,
    G_Counter_equal (G_Counter_merge clocks clocks) clocks.
    Proof.
    intros; unfold G_Counter_merge.
    unfold ClockMap.Equal; intro.
    repeat rewrite ClockMapFacts.map2_1bis; auto.
    apply Clock_merge_idempotent.
    Qed.
    Tuesday, May 14, 13

    View Slide

  26. 1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    Theorem G_Counter_merge_assoc : forall c1 c2 c3,
    G_Counter_equal
    (G_Counter_merge c1 (G_Counter_merge c2 c3))
    (G_Counter_merge (G_Counter_merge c1 c2) c3).
    Proof.
    intros; unfold G_Counter_merge.
    unfold ClockMap.Equal; intro.
    repeat rewrite ClockMapFacts.map2_1bis; auto.
    repeat rewrite <- Clock_merge_assoc; reflexivity.
    Qed.
    Tuesday, May 14, 13

    View Slide

  27. 1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    Theorem G_Counter_incr_mono : forall clocks actor,
    G_Counter_compare clocks (G_Counter_incr actor clocks).
    Proof.
    intros; unfold G_Counter_compare; unfold ClockMap.Equal; intro.
    repeat rewrite ClockMapFacts.map2_1bis; auto.
    elim (eq_nat_dec actor y); intro.
    subst. unfold Clock_compare, Clock_true.
    unfold G_Counter_incr. simpl.
    destruct (ClockMap.find y clocks).
    rewrite ClockMapFacts.add_eq_o. f_equal.
    induction n; auto. reflexivity. reflexivity.
    unfold G_Counter_incr.
    destruct (ClockMap.find actor clocks) eqn:factor.
    rewrite ClockMapFacts.add_neq_o; auto. apply Clock_compare_refl.
    rewrite ClockMapFacts.add_neq_o; auto. apply Clock_compare_refl.
    Qed.
    Tuesday, May 14, 13

    View Slide

  28. 1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    Theorem G_Counter_merge_mono : forall c1 c2,
    G_Counter_compare c1 (G_Counter_merge c1 c2).
    Proof.
    intros; unfold G_Counter_compare.
    unfold ClockMap.Equal; intro.
    unfold Clock_compare, Clock_true, G_Counter_merge.
    repeat rewrite ClockMapFacts.map2_1bis; auto.
    destruct (ClockMap.find y c1);
    destruct (ClockMap.find y c2); simpl; f_equal.
    apply leb_max_mono.
    rewrite leb_correct; auto.
    Qed.
     
    Tuesday, May 14, 13

    View Slide

  29. NEXT STEPS
    Tuesday, May 14, 13

    View Slide

  30. PN-COUNTERS
    Tuesday, May 14, 13

    View Slide

  31. MORE DATA STRUCTURES
    Tuesday, May 14, 13

    View Slide

  32. GITHUB.COM
    CMEIKLEJOHN/DISTRIBUTED-DATA-STRUCTURES
    Tuesday, May 14, 13

    View Slide

  33. QED
    Tuesday, May 14, 13

    View Slide