Model Overview Page
Contents
Model description
What is the behavior spec?
What to check?
What is the model?
How to run?
This model editor page allows you to make the most common choices
of the parameter values with which TLC is to be run.
It contains links to the Spec Options Page
for specifying additional
options for telling TLC what spec behaviors to check and
to the TLC Options Page for specifying additional
ways to control the execution of TLC.
Here are what the different sections of the Model Overview
page are for.
Enter any text you want here. The first line of the text is
displayed in the Quick Access window's list of models.
The behavior spec is the formula or pair of formulas that describe the
possible behaviors of the system or algorithm you want to check. (See
the What Is A Spec? help page.)
There are two ways to write the behavior spec:
- Init and Next
- A pair of formulas that specify the initial state and the next-state relation,
respectively.
- Single formula
- A single temporal formula of the form
Init /\ [][Next]vars /\ F,
where Init is the initial predicate,
Next is the next-state
relation, vars
is the tuple of variables,
and F is an optional fairness formula.
The only way to write a behavior spec that includes fairness is with a temporal formula.
You can also choose to specify No behavior spec. This is the only option
if the spec has no variables. With this option, TLC will just check assumptions and
evaluate a constant expression, if you have entered one in the
Evaluate Constant Expression section
of the Model Checking Results Page.
There are three kinds of properties of the behavior spec that TLC can check:
Deadlock
A deadlock is said to occur in a state for which the next-state relation
allows no successor states. Termination is deadlock that is not considered an error.
If you want the behavior spec to allow termination, then you should uncheck the
deadlock option. (This is not necessary for the spec produced by translating a PlusCal algorithm,
because its next-state relation is written in a way that causes TLC not to consider normal
termination to be a deadlock.)
Invariants
An invariant is a state predicate that is true of all reachable states--that is,
states that can occur in a behavior allowed by the behavior spec. You can include
a list of invariants. The checking of each invariant can be enabled or disabled
by checking or unchecking its box.
Properties
TLC can check if the behavior spec satisfies (implies) a temporal property, which
is expressed as a temporal-logic formula. You can specify a list of such properties,
each with a check-box for enabling or disabling its checking.
The most basic part of a model is an assignment of values to declared constants.
To assign a value to a constant, either double-click on the constant or select it and click on the
Edit button. This will raise a pop-up dialog giving you the choice
of three ways to assign a value to it:
- Ordinary assignment
- You can set the value of the constant to any constant TLA+ expression that
contains only symbols defined in the spec. The expression can even include
declared constants, as long as the value assigned to a constant does not depend
on that constant. (If there are circular dependencies, TLC will
produce a Java StackOverflowError error.)
- Model value
- It assigns to the constant a model value of the same name. (See
the Model Values and Symmetry
help page.)
- Set of model values
- You must enter a comma-separated list of legal model-value names,
optionally enclosed by
{
and }. You will have the option of making them
a symmetry set.
A typed model value is one whose name begins with a letter
and an underscore--for example, p_42a. If you
enter a set of model values that are not all of the same type,
you will have to click Next
to continue. You will then be given the choice of specifying a type
for the set you have just entered. For example, if you entered the
set {2, a, b} and choose the
type t , the constant will be assigned the
set {t_2, t_a, t_b} of model values.
Note that a number like 2 is not a
legal model value.
See the Model Values and Symmetry
help page to learn about typed values and symmetry sets.
There are two basic ways to run TLC: locally on the computer running the
Toolbox and remotely using multiple computers. For local execution, you can choose
from a small number of useful options. See the TLC Options Page for
additional choices of how to run TLC. Remote execution offers the possibility of
greatly speeding up execution through the use of a network of computers.
For information about the remote execution
options, see Running TLC in Distributed Mode.
- Subtopics
- Model Values and Symmetry
- Running TLC in Distributed Mode
↑ Creating a Model