Hello, the model checker shows you a counter-example to the invariant TCTypeOK where i reaches value 20, and how should it be otherwise? An invariant has to be true in all states that your specification can reach. Since all your actions increment i, it can grow beyond any bound. The predicate i \in Nat \ {0,1} is an invariant of your specification (but since your model has an infinite state space, TLC will not be able to verify it exhaustively). Regards, Stephan
--
You received this message because you are subscribed to the Google Groups "tlaplus" group. To unsubscribe from this group and stop receiving emails from it, send an email to tlaplus+unsubscribe@xxxxxxxxxxxxxxxx. To post to this group, send email to tlaplus@xxxxxxxxxxxxxxxx. Visit this group at https://groups.google.com/group/tlaplus. For more options, visit https://groups.google.com/d/optout. |