The culprit is the conjunct /\ { GCBlocksForFile(f) : f \in DeletedFiles} of BlockGC. First of all, this is not type correct (a "silly _expression_" in TLA+ jargon) because it constructs a set (of Booleans, given the definition of GCBlocksForFile) but is used as a Boolean. Second, TLC will not interpret the expressions var' = ... inside the definition of GCBlocksForFile(f) as assignments but just as tests for equality, hence the error message that you see: the value of BlocksToFiles in the successor state is not yet defined. It appears to me that you intended to write /\ \A f \in DeletedFiles : GCBlocksForFile(f) in order to iterate the action for each element of DeletedFiles. However, this will again not work if DeletedFiles contains more than one element: TLC will interpret the formulas var' = ... as assignments for the first element of the set DeletedFiles and as equality tests for the following elements, and these tests will fail, making the action inapplicable. You really want to define operators that take the set DeletedFiles and produce the corresponding values in the successor state, for example BTF(fs) == [ b \in DOMAIN BlocksToFiles |-> IF BlocksToFiles[b] \in fs THEN NullFile ELSE BlocksToFiles[b] ] and use conjuncts such as /\ BlocksToFiles' = BTF(DeletedFiles) in the definition of action BlockGC. Hope this helps, Stephan
You received this message because you are subscribed to the Google Groups "tlaplus" group. To unsubscribe from this group and stop receiving emails from it, send an email to tlaplus+unsubscribe@xxxxxxxxxxxxxxxx. To view this discussion on the web visit https://groups.google.com/d/msgid/tlaplus/B3E0BCD1-F6EF-4679-BE23-99D21DD5D75B%40gmail.com. |