[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

*From*: awaw...@xxxxxxxxx*Date*: Sat, 23 Aug 2014 21:48:23 -0700 (PDT)

While validating the sentence Try other models. Start with a model with two jugs of capacity 3 and 6 gallons, having the goal of obtaining 4 gallons of water. TLC will report that the alleged invariant actually is an invariant. on page 57 of the TLA+ hyperbook, I observed that the DieHarder spec (Listing 1) does not end with the number of distinct states ever increasing (about 300 million after 10 minutes or so). However, the seemingly equivalent PDieHard (Listing 2) ends pretty soon reporting only 6 distinct states. How could this be? If the model-checking goes on infinitely, how do we infer from TLC " that the alleged invariant actually is an invariant"? My unsatisfying explanation right now is that since in the PDieHard spec, the variables "big" and "small" are Integers, and therefore have an unambiguous definition for their distinctness. In the Dieharder spec, the variable "injug" is a function, which might not possess a notion of distinctness. Obviously, this explanation is confusing and funky. Is it true that there is some deficiency in the DieHarder version of the spec to the same DieHard problem, or did I misunderstood something and introduced some bug in Listing 1? ------------------------------------- Listing 1 --algorithm DieHarder { variable injug = [j \in Jugs |-> 0]; { while (TRUE) { either with (j \in Jugs) \* fill jug j { injug[j] := Capacity[j] } or with (j \in Jugs) \* empty jug j { injug[j] := 0 } or with (j \in Jugs, k \in Jugs \ {j}) \* pour from jug j to jug k { with (poured = Min(injug[j]+injug[k], Capacity[k] - injug[k])) { injug[k] := injug[k] + poured || injug[j] := injug[j] - poured } } } } } ----------------------- Listing 2 --algorithm DieHard { variables big = 0, small = 0; { while (TRUE) { either big := 6 or small := 3 or big := 0 or small := 0 or with (poured = Min (big + small, 6) - big) { big := big + poured; small := small - poured } or with (poured = Min(big + small, 3) - small) { big := big - poured; small := small + poured } } } }

**Follow-Ups**:**Re: Why model-checking of DieHarder does not end, but PDieHard does?***From:*Leslie Lamport

- Prev by Date:
**Re: Why Amazon Chose TLA+** - Next by Date:
**Re: Why Amazon Chose TLA+** - Previous by thread:
**Re: Modelling interactive systems (state machines)** - Next by thread:
**Re: Why model-checking of DieHarder does not end, but PDieHard does?** - Index(es):