This document discusses implementing an "Outbox" pattern using model checking to ensure correctness. It describes how traditional two-phase commit is insufficient to handle anomalies like duplication and reordering. The Outbox approach uses transport and data store transactions along with publishing to address edge cases. Model checking with TLA+ specification language is advocated over just automated tests to model system states and verify properties like no duplicated processing. Several demos are presented to illustrate issues like ghost messages, lost messages, and consistent output.

1. Implementing
Outbox*
Tomek Masternak
* model-checking first

2. 2PC is no
longer
to the rescue

3. Welcome to
the land of
anomalies

4. What should we expect?
3 2 1
send order
3 2 1
2
1
3 2
3 3 1
2 2
processing order
duplication
re-ordering
duplication
re-ordering

5. No single
solution

6. Hero is here

7. Outbox in action
Transport transaction
Data store transaction
Publish

8. Edge cases

9. Model-checking
vs
automanual tests

10. TLA+: Temporal logic of actions
S0
S1
S2
S3
A1
A2
A3
A4
A5
…
…
…
Invariants*
+
*and more

11. In practice more like this
https://www3.hhu.de/stups/prob/index.php/File:CANBus_sfdp.png

12. What makes a
good model?

13. Demo 0:
Toolbox

14. Demo 1:
Ghost
messages

15. Demo 2:
Lost messages

16. Demo 3:
No duplicated
processing

17. Demo 4:
Consistent
output

18. Questions?