PaxosCommit TLA+形式化验证

TLA+

• RM：资源管理
• Acceptors：提案接收者
• Majority：多数Acceptors的集合
• Ballot：提案的投票
• rmState：RM状态
• aState：Acceptor状态
• msgs：消息的集合

----------------------------- MODULE PaxosCommit ----------------------------
EXTENDS Integers
CONSTANT RM, Acceptors, Majority, Ballot
VARIABLES rmState, aState, msgs
CONSTANT prepared, aborted, none, phase1a, phase1b, phase2a, phase2b, commit, 
    abort, working, committed

Max(s) == IF s # {
   } THEN CHOOSE x \in s: \A y \in s: x >= y
          ELSE -1

ASSUME 
    /\ Ballot \subseteq Nat
    /\ 0 \in Ballot
    /\ Majority \subseteq SUBSET Acceptors
    /\ \A ms1, ms2 \in Majority: ms1 \intersect ms2 # {
   }

Messages == 
    [type: {
   phase1a}, ins: RM, bal: Ballot \ {
   0}]
    \union
    [type: {
   phase1b}, ins: RM, bal: Ballot \union {
   -1}, mbal: Ballot, 
        val: {
   prepared, aborted, none}, acc: Acceptors ]
    \union
    [type: {
   phase2a}, ins: RM, bal: Ballot, val: {
   prepared, aborted} ]
    \union
    [type: {
   phase2b}, ins: RM, bal: Ballot, val: {
   prepared, aborted}, 
        acc: Acceptors ]
    \union
    [type: {
   commit, abort}]

PCTypeOK == 
    /\ rmState \in [RM -> {
   prepared, working, committed, aborted}]
    /\ aState \in [RM ->