[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

*From*: Leslie Lamport <tlaplus.ll@xxxxxxxxx>*Date*: Sun, 10 Mar 2019 19:19:23 -0700 (PDT)*References*: <6e375878-19a2-4ea0-b792-a056e921ce86@googlegroups.com> <3ce3bea2-bb24-459b-88f9-4616bf11c7b5@googlegroups.com> <300bc940-3388-40c4-ac9e-744898d2a8ec@googlegroups.com>

(1) Please read the last two sentences of my answer to this question.

(2) TLC neither invents nor proves anything. TLC can check the

correctness of the theorem that asserts implementation on a

model of the specification. That theorem is stated in terms

of the refinement mapping. So, you need to find the refinement

mapping before you can tell TLC what it should check.

model of the specification. That theorem is stated in terms

of the refinement mapping. So, you need to find the refinement

mapping before you can tell TLC what it should check.

On Sunday, March 10, 2019 at 5:41:55 PM UTC-7, Oliver Yang wrote:

(1) I assume once the necessary mapping is invented,anyInv of the spec will do the job? My initialinterpretation is that finding the Inv will be key of finding the refinement mapping. Based on yourexplanation, it seems like it's the other way around. Once we find the mapping, then with any Inv, wecould prove Implementation.(2) If we will have to invent the mapping, I assume TLC will have to invent the mapping to be able toprove implementation? I haven't study TLC yet, but I assume it works in a combinatorial way? Howcould it be possible for TLC to figure out the refinement mapping, which is conceptual?Thanks,OliverOn Sunday, March 10, 2019 at 12:52:43 PM UTC-7, Leslie Lamport wrote:(1) If we remove the Inv from the formula Inv /\ Next => ..., it would assert

that a step starting in any state that satisfies Next satisfies "..." --

for example a state in which memQ is a sequence of imaginary numbers.

I have no idea if that assertion is true for such a starting state.

However, it suffices to prove the assertion for steps starting in a

reachable state. Conjoining the invariant Inv allows you to prove

the assertion only for reachable states. You have to choose Inv so

it asserts what is true about reachable states that makes the

implication true. To do this, you have to understand why the theorem

you're trying to prove is true.(2) That mapping isn't derived; you have to invent it. The sentence

beginning "Intuitively" that starts on line 9 of page 63 tells you

what condition that substitution must satisfy. To be able to choose

the necessary mapping, you need to understand why the theorem you're

trying to prove is true .Leslie

On Wednesday, March 6, 2019 at 10:53:35 PM UTC-8, Oliver Yang wrote:Hi All,In Section 5.8 of book "Specifying Systems", the "Proving Impl" is introduced. I have a rough understanding of refinement mapping, whichessentially maps states of Spec A to the states of Spec B. However, I have a hard time understanding "step simulation".1) What's the purpose of introducing the invariant Inv in Formula 5.3? What are we trying to achieve here?2) How do we derive the mapping: omem = vmem, octl = ..., obuf = buf? It looks like we jumped to the conclusion without showing any proof?Thanks,Oliver

You received this message because you are subscribed to the Google Groups "tlaplus" group.

To unsubscribe from this group and stop receiving emails from it, send an email to tlaplus+unsubscribe@xxxxxxxxxxxxxxxx.

To post to this group, send email to tlaplus@xxxxxxxxxxxxxxxx.

Visit this group at https://groups.google.com/group/tlaplus.

For more options, visit https://groups.google.com/d/optout.

**References**:**[tlaplus] How to understand the concept "step simulation"***From:*Oliver Yang

**[tlaplus] Re: How to understand the concept "step simulation"***From:*Leslie Lamport

**[tlaplus] Re: How to understand the concept "step simulation"***From:*Oliver Yang

- Prev by Date:
**[tlaplus] Re: How to understand the concept "step simulation"** - Next by Date:
**[tlaplus] problems with the command-line tools** - Previous by thread:
**[tlaplus] Re: How to understand the concept "step simulation"** - Next by thread:
**[tlaplus] Re: How to understand the concept "step simulation"** - Index(es):