[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Unclear TLC evaluation behavior

While writing a specification I came across a TLC evaluation strategy that isn't clear to me. I've reproduced it in the following trivial (and nonsensical) spec:

    VARIABLE x, a

    vars == <<x, a>>

    TypeOK == /\ x \in Nat

                       /\ a \in BOOLEAN


    Init == x = 1 /\ a = TRUE

    Sub == x' = x + 1

    Next == (omitted)

    Spec == Init /\ [][Next]_vars

When I define Next as 

    Next == 

        IF Sub THEN 

            a' = ~a


            UNCHANGED a

and run TLC, I get the error "In evaluation, the identifier x is either undefined or not an operator", which points to the x' token of Sub. The same happens when I define next as

    Next == 

        Sub => a' = ~a

When I define Next to be

    Next == 

        LET p == Sub IN

        a' = ~a

I get the error "Successor state is not completely specified by the next-state action" (this could perhaps be explained by lazy evaluation).

Reading about TLC's evaluation rules in chapter 14 of "the book", I couldn't find something that would explain this behavior. Does TLC only evaluate primed assignments when written as simple conjuncts or disjuncts?