Re: [tlaplus] Dealing with a `pc` variable in refinement?

On 2 May 2019, at 03:12, Hillel Wayne <hwayne@xxxxxxxxx> wrote:
I was hoping there was another technique though, to more or less “ignore” `pc` in the temporal property checking. 
There's existential hiding (section 4.3 of Specifying Systems), but I don't believe TLC is currently able to check it.

The program counter is an "implementation detail" of the specification and should not be observable by the environment. Therefore the "morally correct" representation of the high-level specification is the TLA formula \EE pc : A.

TLC doesn't check properties of this kind and what you did is write a "refinement mapping" that computes the program counter of the high-level spec from the state of the low-level spec. This is the standard way of proving B => \EE pc : A, but there are certain cases when refinement mappings do not exist even if the implication is valid, see [1].

Stephan

[1] http://lamport.azurewebsites.net/pubs/pubs.html#auxiliary

--
You received this message because you are subscribed to the Google Groups "tlaplus" group.
To unsubscribe from this group and stop receiving emails from it, send an email to tlaplus+unsubscribe@xxxxxxxxxxxxxxxx.
To post to this group, send email to tlaplus@xxxxxxxxxxxxxxxx.
Visit this group at https://groups.google.com/group/tlaplus.
For more options, visit https://groups.google.com/d/optout.