[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[tlaplus] Re: How to understand the concept "step simulation"

I have to admit I'm a bit confused by the explanation in the text too and don't quite see what Inv is representing. For example, can I set Inv to anything that allows me to prove the formula, what if I set it to False?


On Sunday, March 10, 2019 at 12:52:43 PM UTC-7, Leslie Lamport wrote:
(1) If we remove the Inv from the formula Inv /\ Next => ..., it would assert
    that a step starting in any state that satisfies Next satisfies "..." --
    for example a state in which memQ is a sequence of imaginary numbers.
    I have no idea if that assertion is true for such a starting state.
    However, it suffices to prove the assertion for steps starting in a
    reachable state.  Conjoining the invariant Inv allows you to prove
    the assertion only for reachable states.  You have to choose Inv so
    it asserts what is true about reachable states that makes the
    implication true.  To do this, you have to understand why the theorem
    you're trying to prove is true.

(2) That mapping isn't derived; you have to invent it.  The sentence
    beginning "Intuitively" that starts on line 9 of page 63 tells you
    what condition that substitution must satisfy.  To be able to choose 
    the necessary mapping, y
ou need to understand why the theorem you're 
    trying to prove is true .


On Wednesday, March 6, 2019 at 10:53:35 PM UTC-8, Oliver Yang wrote:
Hi All,

In Section 5.8 of book "Specifying Systems", the "Proving Impl" is introduced. I have a rough understanding of refinement mapping, which
essentially maps states of Spec A to the states of Spec B. However, I have a hard time understanding "step simulation".

1) What's the purpose of introducing the invariant Inv in Formula 5.3? What are we trying to achieve here?
2) How do we derive the mapping: omem = vmem, octl = ..., obuf = buf? It looks like we jumped to the conclusion without showing any proof?



You received this message because you are subscribed to the Google Groups "tlaplus" group.
To unsubscribe from this group and stop receiving emails from it, send an email to tlaplus+unsubscribe@xxxxxxxxxxxxxxxx.
To view this discussion on the web visit https://groups.google.com/d/msgid/tlaplus/369feaf8-c1ad-49c5-9915-d13e8687105c%40googlegroups.com.