Hi.--The only way you can currently check it in TLC is with a refinement mapping (from M2 to M1) that you have to write yourself. In your case it seems simple enough as M2's state contains M1's, so it's a trivial matter (just Spec => M1!Spec [1]). In other cases, adding auxiliary variables is necessary, and may make this harder.The theoretical issue is that the problem of checking temporal existential quantification is co-NP-hard in the number of states. I once started to think of an algorithm that may be able to do it in linear time for some/many practical instances but put it aside for now.Ron[1]: In general for existential quantification, A ⇒ B ⊦ A ⇒ ∃x. B
You received this message because you are subscribed to the Google Groups "tlaplus" group.
To unsubscribe from this group and stop receiving emails from it, send an email to tlaplus+unsubscribe@googlegroups.com .
To post to this group, send email to tla...@xxxxxxxxxxxxxxxx.
Visit this group at https://groups.google.com/group/tlaplus .
For more options, visit https://groups.google.com/d/optout .