Comments (6)
According to what is said above and to TypeOK in InternalMemory, ctl \in [Proc -> {"rdy", "busy","done"}]
, so the property \A p \in Proc : (ctl[p] = "req") ~> (ctl[p] = "rdy")
is indeed vacuously true. Without having looked at the spec in detail, it appears reasonable that "req"
should be replaced by "busy"
, which is the value the action Req(p)
sets ctl
to. In that case the property has a chance to be wrong, in a potentially interesting way.
from examples.
This seems strange in several ways! According to the Liveness/README the check of MCLiveInternalMemory.tla should fail. But according to manifest.json that run of TLC succeeds. But how can it succeed if ctl[p]
can never equal "rdy"
? Are we dealing with liveness checking finding a vacuous truth?
from examples.
Keep in mind that the property given in the README exercise is \A p \in Proc : (ctl[p] = "rdy") ~> (ctl[p] = "req")
which is different from the property in the LiveInternalMemory specification: \A p \in Proc : (ctl[p] = "req") ~> (ctl[p] = "rdy")
(The sides of the implication/"leads to" operator are swapped).
The property in the README exercise should not be implied by the specification:
1. Run TLC to check the LiveHourClock and LiveInternalMemory specifications,
using the files above. Use TLC to find a counterexample to show
that the specification LISpec of LiveInternalMemory does not satisfy the
following property
\A p \in Proc : (ctl[p] = "rdy") ~> (ctl[p] = "req")
from examples.
Per the Specifying Systems errata [pdf] the "rdy"
-> "busy"
error was reported for the textbook back in 2010 by Casey Klein. We can make the same substitution everywhere - in README
, the comment of LiveInternalMemory.tla
, and the definition of LivenessProperty
in LiveInternalMemory.tla
. Unfortunately this liveness property is not invalidated; the spec satisfies it regardless of whether the assumptions Liveness
or Liveness2
in LiveInternalMemory.tla
are used (which makes sense because the textbook has a proof that these assumptions are equivalent). Reading the InternalMemory.tla
spec I'm not sure what similar property would be false, or even how it could be. The only thing I can see that could possibly make it invalidated is if the Reply
macro in Rsp
evaluates to FALSE
.
So I'm not sure what to do really. I'm inclined to just make the substitution, same as the errata, but change the exercise text to say that LiveInternalMemory
does satisfy the property.
from examples.
Actually, an idea: perhaps the exercise formula in README
is supposed to be different than the formula in LiveInternalMemory.tla
. It should probably be \A p \in Proc : (ctl[p] = "rdy") ~> (ctl[p] = "busy")
, using the same substitution as above, which will certainly fail because there is no fairness assumption on Req
. Yes, I think that is the correct change.
from examples.
Sounds good to me. Of course we could add the exercise to check formula LivenessProperty
from module LiveInternalMemory
, but this is probably implicit, just like checking TypeInvariant
in InternalMemory
.
from examples.
Related Issues (20)
- Submodules vs. copying specs into the repo HOT 2
- GitPod & Codespaces - make sure bitrot hasn't set in
- Add TLC models for all specs for which it's viable
- Add some Apalache models HOT 5
- Bakery-Boulangerie specs don't satisfy `DeadlockFree` or `StarvationFree` liveness properties HOT 1
- Can't come up with working model for cbc_max or spanning HOT 1
- Liveness and Safety properties fail in SpanTreeRandom.tla HOT 11
- Deactivate macOS CI runners? HOT 3
- Add optional fields to manifest.json recording total and unique states for each model
- Add proof checking time to manifest details
- EWD998 model checking failure when running TLC from outside tlaplus/examples repo HOT 5
- Parameterize version of TLA+ tools used during CI run HOT 2
- Question about the specification of reliable broadcast algorithm by Bracha & Toueg (1985) HOT 8
- CI workflow fails on ubuntu HOT 7
- Do not suppress TLC output HOT 3
- Possible TLC regression on specifications/ewd998/EWD998ChanID.cfg HOT 7
- ERROR in specifications/SpecifyingSystems/Composing/CompositeFIFO.tla: In evaluation, the identifier in is either undefined or not an operator. HOT 1
- Remove deadlock flag in manifest.json in favor of `CHECK_DEADLOCK` in config file HOT 4
- Install TLA+ unicode converter into gitpod and codespaces HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from examples.