250

# Verified Vector Clocks

RICON|West 2013, Lightning Talk

October 29, 2013

## Transcript

2. ### Do you even know how Verified Vector Clocks work? Christopher

Meiklejohn RICON|West 2013

6. None

20. ### ! ! Require Import Coq.Lists.List. Require Import Coq.Arith.EqNat. Require Import

Coq.Bool.Bool. ! Module VVClock. ! Definition vclock := list (nat * nat)%type. coq/vvclock.v
21. ### (* % @doc Create a brand new vclock. -spec fresh()

-> vclock(). fresh() -> []. *) ! Definition fresh : vclock := nil. coq/vvclock.v
22. ### (* % @doc Increment VClock at Node. -spec increment(Node ::

vclock_node(), VClock :: vclock()) -> vclock(). increment(Node, VClock) -> increment(Node, timestamp(), VClock). ! % @doc Increment VClock at Node. -spec increment(Node :: vclock_node(), IncTs :: timestamp(), VClock :: vclock()) -> vclock(). increment(Node, IncTs, VClock) -> {{_Ctr, _TS}=C1,NewV} = case lists:keytake(Node, 1, VClock) of false -> {{1, IncTs}, VClock}; {value, {_N, {C, _T}}, ModV} -> {{C + 1, IncTs}, ModV} end, [{Node,C1}|NewV]. *) ! Definition increment (actor : nat) (vclock : vclock) := match (find (fun clock => match clock with | pair x _ => beq_nat actor x end) vclock) with | None => cons (pair actor 1) vclock | Some (pair x y) => cons (pair x (S y)) (filter (fun clock => match clock with | pair x _ => negb (beq_nat actor x) end) vclock) end. coq/vvclock.v
23. ### (* % @doc Compares two VClocks for equality. -spec equal(VClockA

:: vclock(), VClockB :: vclock()) -> boolean(). equal(VA,VB) -> lists:sort(VA) =:= lists:sort(VB). *) ! Definition equal' status_and_vclock clock := match clock, status_and_vclock with | pair actor count, pair status vclock => match find (fun clock => match clock with | pair x _ => beq_nat actor x end) vclock with | None => pair false vclock | Some (pair _ y) => pair (andb status (beq_nat count y)) vclock end end. ! Definition equal vc1 vc2 := match fold_left equal' vc1 (pair true vc2) with | pair false _ => false | pair true _ => match fold_left equal' vc2 (pair true vc1) with | pair false _ => false | pair true _ => true end end. coq/vvclock.v
24. ### ! (* % @doc Return true if Va is a

direct descendant of Vb, % else false -- remember, a vclock is its own descendant! -spec descends(Va :: vclock()|[], Vb :: vclock()|[]) -> boolean(). descends(_, []) -> % all vclocks descend from the empty vclock true; descends(Va, Vb) -> [{NodeB, {CtrB, _T}}|RestB] = Vb, case lists:keyfind(NodeB, 1, Va) of false -> false; {_, {CtrA, _TSA}} -> (CtrA >= CtrB) andalso descends(Va,RestB) end. *) ! Fixpoint ble_nat (n m : nat) {struct n} : bool := match n with | O => true | S n' => match m with | O => false | S m' => ble_nat n' m' end end. ! Definition descends' status_and_vclock clock := match clock, status_and_vclock with | pair actor count, pair status vclock => match find (fun clock => match clock with | pair x _ => beq_nat actor x end) vclock with | None => pair false vclock | Some (pair _ y) => pair (andb status (ble_nat count y)) vclock end end. ! Definition descends vc1 vc2 := match fold_left descends' vc1 (pair true vc2) with | pair false _ => false | pair true _ => true end. coq/vvclock.v
25. ### (* % @doc Combine all VClocks in the input list

into their least possible % common descendant. -spec merge(VClocks :: [vclock()]) -> vclock() | []. merge([]) -> []; merge([SingleVclock]) -> SingleVclock; merge([First|Rest]) -> merge(Rest, lists:keysort(1, First)). ! merge([], NClock) -> NClock; merge([AClock|VClocks],NClock) -> merge(VClocks, merge(lists:keysort(1, AClock), NClock, [])). ! merge([], [], AccClock) -> lists:reverse(AccClock); merge([], Left, AccClock) -> lists:reverse(AccClock, Left); merge(Left, [], AccClock) -> lists:reverse(AccClock, Left); merge(V=[{Node1,{Ctr1,TS1}=CT1}=NCT1|VClock], N=[{Node2,{Ctr2,TS2}=CT2}=NCT2|NClock], AccClock) -> if Node1 < Node2 -> merge(VClock, N, [NCT1|AccClock]); Node1 > Node2 -> merge(V, NClock, [NCT2|AccClock]); true -> ({_Ctr,_TS} = CT) = if Ctr1 > Ctr2 -> CT1; Ctr1 < Ctr2 -> CT2; true -> {Ctr1, erlang:max(TS1,TS2)} end, merge(VClock, NClock, [{Node1,CT}|AccClock]) end. *) ! Definition max' vclock clock := match clock with | pair actor count => match find (fun clock => match clock with | pair x _ => beq_nat actor x end) vclock with | None => cons (pair actor count) vclock | Some (pair _ y) => cons (pair actor (max count y)) (filter (fun clock => match clock with | pair x _ => negb (beq_nat actor x) end) vclock) end end. ! Definition merge vc1 vc2 := fold_left max' vc1 vc2. coq/vvclock.v

28. ### module 'vvclock' [ 'fresh'/0, 'increment'/2, 'equal@'/2, 'equal'/2, ‘! ble_nat'/2, 'descends@'/2,

'descends'/2, 'max@'/2, 'merge'/2 ] ! attributes [ ]! ! 'fresh'/0 = fun() ->! []! 'increment'/2 = fun (_actor, _vclock) ->! case call 'Coq.Lists.List':'find'! ( fun (_clock) ->! case _clock of! { 'Pair'! , _y! , _x! } when 'true' ->! call 'Coq.Arith.EqNat':'beq_nat'! ( _actor! , _y! )! end! , _vclock! ) of! {'Some', _p} when 'true' ->! case _p of! { 'Pair'! , _y! , _x! } when 'true' ->! [{ 'Pair'! , _y! , {'S', _x}! }|call 'Coq.Lists.List':'filter'! ( fun (_clock) ->! case _clock of! { 'Pair'! , _y0! , _x0! } when 'true' ->! call 'Coq.Init.Datatypes':'negb' (call 'Coq.Arith.EqNat':'beq_nat'! ( _actor! , _y0! ))! end! , _vclock! )]! end! 'None' when 'true' ->! [{ 'Pair'! , _actor! , {'S', 'O'}! }|_vclock]! end! src/vvclock.core
29. ### src/vvclock.core 'equal@'/2 = fun (_status_and_vclock, _clock) ->! case _clock of!

{ 'Pair'! , _count! , _actor! } when 'true' ->! case _status_and_vclock of! { 'Pair'! , _vclock! , _status! } when 'true' ->! case call 'Coq.Lists.List':'find'! ( fun (_clock0) ->! case _clock0 of! { 'Pair'! , _y! , _x! } when 'true' ->! call 'Coq.Arith.EqNat':'beq_nat'! ( _count! , _y! )! end! , _status! ) of! {'Some', _p} when 'true' ->! case _p of! { 'Pair'! , _y! , _n! } when 'true' ->! { 'Pair'! , case _vclock of! 'True' when 'true' ->! call 'Coq.Arith.EqNat':'beq_nat'! ( _actor! , _n! )! 'False' when 'true' ->! 'False'! end! , _status! }! end! 'None' when 'true' ->! { 'Pair'! , 'False'! , _status! }! end! end! end
30. ### src/vvclock.core 'equal'/2 = fun (_vc1, _vc2) ->! case call 'Coq.Lists.List':'fold_left'!

( 'equal@'! , _vc1! , { 'Pair'! , 'True'! , _vc2! }! ) of! { 'Pair'! , _l! , _b! } when 'true' ->! case _l of! 'True' when 'true' ->! case call 'Coq.Lists.List':'fold_left'! ( 'equal@'! , _vc2! , { 'Pair'! , 'True'! , _vc1! }! ) of! { 'Pair'! , _l0! , _b0! } when 'true' ->! _l0! end! 'False' when 'true' ->! 'False'! end! end! 'ble_nat'/2 = fun (_n, _m) ->! case _n of! 'O' when 'true' ->! 'True'! {'S', _n@} when 'true' ->! case _m of! 'O' when 'true' ->! 'False'! {'S', _m@} when 'true' ->! call 'vvclock.VVClock':'ble_nat'! ( _n@! , _m@! )! end! end!
31. ### src/vvclock.core 'descends@'/2 = fun (_status_and_vclock, _clock) ->! case _clock of!

{ 'Pair'! , _count! , _actor! } when 'true' ->! case _status_and_vclock of! { 'Pair'! , _vclock! , _status! } when 'true' ->! case call 'Coq.Lists.List':'find'! ( fun (_clock0) ->! case _clock0 of! { 'Pair'! , _y! , _x! } when 'true' ->! call 'Coq.Arith.EqNat':'beq_nat'! ( _count! , _y! )! end! , _status! ) of! {'Some', _p} when 'true' ->! case _p of! { 'Pair'! , _y! , _n! } when 'true' ->! { 'Pair'! , case _vclock of! 'True' when 'true' ->! call 'vvclock.VVClock':'ble_nat'! ( _actor! , _n! )! 'False' when 'true' ->! 'False'! end! , _status! }! end! 'None' when 'true' ->! { 'Pair'! , 'True'! , _status! }! end! end! end!
32. ### src/vvclock.core 'descends'/2 = fun (_vc1, _vc2) ->! case call 'Coq.Lists.List':'fold_left'!

( 'descends@'/2! , _vc1! , { 'Pair'! , 'True'! , _vc2! }! ) of! { 'Pair'! , _l! , _b! } when 'true' ->! _l! end!
33. ### src/vvclock.core 'max@'/2 = fun (_vclock, _clock) ->! case _clock of!

{ 'Pair'! , _count! , _actor! } when 'true' ->! case call 'Coq.Lists.List':'find'! ( fun (_clock0) ->! case _clock0 of! { 'Pair'! , _y! , _x! } when 'true' ->! call 'Coq.Arith.EqNat':'beq_nat'! ( _count! , _y! )! end! , _vclock! ) of! {'Some', _p} when 'true' ->! case _p of! { 'Pair'! , _y! , _n! } when 'true' ->! [{ 'Pair'! , _count! , call 'Coq.Init.Peano':'max'! ( _actor! , _n! )! }|call 'Coq.Lists.List':'filter'! ( fun (_clock0) ->! case _clock0 of! { 'Pair'! , _y0! , _x! } when 'true' ->! call 'Coq.Init.Datatypes':'negb' (call 'Coq.Arith.EqNat':'beq_nat'! ( _count! , _y0! ))! end! , _vclock! )]! end! 'None' when 'true' ->! [{ 'Pair'! , _count! , _actor! }|_vclock]! end! end! 'merge'/2 = fun (_vc1, _vc2) ->! call 'Coq.Lists.List':'fold_left'! ( 'max'! , _vc1! , _vc2! )! end!

36. ### %% @doc Take from riak_core/src/vclock.erl. riak_core_test() -> A = vvclock:fresh(),

B = vvclock:fresh(), A1 = vvclock:increment('O', A), B1 = vvclock:increment({'S', 'O'}, B), B2 = vvclock:increment({'S', 'O'}, B1), ! 'True' = vvclock:descends(A1, A), 'True' = vvclock:descends(B1, B), 'False' = vvclock:descends(A1, B1), ! A2 = vvclock:increment('O', A1), C = vvclock:merge(A2, B1), C1 = vvclock:increment({'S', {'S', 'O'}}, C), ! 'True' = vvclock:descends(C1, A2), 'True' = vvclock:descends(C1, B1), 'False' = vvclock:descends(B1, C1), 'False' = vvclock:descends(B1, A1), ! ok. src/test.erl
37. ### A: [] B: [] A1: [{'Pair','O',{'S','O'}}] B1: [{'Pair',{'S','O'},{'S','O'}}] B2: [{'Pair',{'S','O'},{'S',{'S','O'}}}]

A2: [{'Pair','O',{'S',{'S','O'}}}] C: [{'Pair','O',{'S',{'S','O'}}},{'Pair',{'S','O'},{'S','O'}}] C1: [{'Pair',{'S',{'S','O'}},{'S','O'}}, {'Pair','O',{'S',{'S','O'}}}, {'Pair',{'S','O'},{'S','O'}}] make itest