Implementing outbox model-checking first
Download as PPTX, PDF0 likes139 views
This document discusses implementing an "Outbox" pattern using model checking to ensure correctness. It describes how traditional two-phase commit is insufficient to handle anomalies like duplication and reordering. The Outbox approach uses transport and data store transactions along with publishing to address edge cases. Model checking with TLA+ specification language is advocated over just automated tests to model system states and verify properties like no duplicated processing. Several demos are presented to illustrate issues like ghost messages, lost messages, and consistent output.
Implementing outbox model-checking first
- 2. 2PC is no longer to the rescue
- 3. Welcome to the land of anomalies
- 4. What should we expect? 3 2 1 send order 3 2 1 2 1 3 2 3 3 1 2 2 processing order duplication re-ordering duplication re-ordering
- 6. Hero is here
- 7. Outbox in action Transport transaction Data store transaction Publish
- 8. Edge cases
- 10. TLA+: Temporal logic of actions S0 S1 S2 S3 A1 A2 A3 A4 A5 … … … Invariants* + *and more
- 11. In practice more like this https://www3.hhu.de/stups/prob/index.php/File:CANBus_sfdp.png
- 12. What makes a good model?
- 13. Demo 0: Toolbox
- 18. Questions?
Editor's Notes
- #2: Hi everyone, my name is Tomek and in this talk I’ll be talking about `Checking safety in Exactly-Once`
- #5: At-least-once message delivery Concurrent message receives Add an animation showing send-order and possible anomalies one by one
- #8: graph LR receiveMessage(1. Receive) dedupe{2. Deduplication} handler(3. Execute handler) storeOutbox(4. Store outgoing<br/>messages in outbox) commitStore(5. Commit<br/>to store) areSent{6. Have outgoing<br/>messages been<br/>sent?} send(7. Send messages) updateOutbox(8. Set as sent) ack(9. Ack) receiveMessage-->dedupe dedupe-- No record found -->handler handler-->storeOutbox storeOutbox-->commitStore commitStore-->areSent send-->updateOutbox updateOutbox-->ack dedupe-- Record found -->areSent areSent-- No -->send areSent-- Yes -->ack
- #14: What are the files? What are the parts of the specification?