Elastic Co
March 01, 2018
4.7k

# Elastic{ON} 2018 - Reliable by design - Applying formal methods to distributed systems

March 01, 2018

## Transcript

1. ### Reliable by Design Applying Formal Methods to Distributed Systems David

Turner @DaveCTurner Yannick Welsch @ywelsch

4. ### Richard Guindon { } Writing is nature’s way of letting

you know how sloppy your thinking is.
5. ### Leslie Lamport { } Mathematics is nature’s way of letting

you know how sloppy your writing is.

8. ### 8 Model Checking Interactive Theorem Proving • Exhaustive search •

Finite state space • Accessible • Detailed argument • Arbitrary state space • More specialised Flavours

Properties

13. ### 13 TLA+ Node1 Node2 Node3 • combines temporal logic and

set theory • specification defines initial state and next-state relation • states represented by assigning values to variables
14. ### 14 Next-state relation Node n firstUncommittedSlot: s currentTerm: t ...

PublishResponse{ ... } Node n firstUncommittedSlot: s currentTerm: t lastAcceptedTerm: t lastAcceptedValue: v ... PublishRequest - dest: n - slot: s - term: t - value: v PublishResponse - slot: s - term: t
15. ### \* next-state relation Next == \/ HandlePublishRequest \/ HandlePublishResponse \/

HandleClientRequest \/ SomeNodeCrashes \/ ... \* main safety property StateMachineSafety == \A n1, n2 \in Nodes : firstUncommittedSlot[n1] = firstUncommittedSlot[n2] => /\ currentClusterState[n1] = currentClusterState[n2] /\ currentConfiguration[n1] = currentConfiguration[n2] 15 Full specification • network behavior • node failures • client submitting values • next-state relation • safety property
16. ### TLC • model checker • integrated into IDE • exhaustive

state exploration • breadth-first • bounded state space • bugs even for small models • good at finding edge cases
17. ### Isabelle/HOL • interactive proof assistant • needs guidance • tracks

proof goals • fully automatically verifies proof
18. ### Experiences TLA+ Isabelle/HOL • executable specs • rapid prototyping •

high confidence • rising in popularity • no state-space limitations • deep insights • even higher confidence