Re: [tlaplus] Is this a (hidden) variable that tells me the state the model checker is in?

[recepient recepient <netsmaza@xxxxxxxxx>]

Calvin, thank you taking time to respond. Was not aware of PlusCal Manual, section 3.2.8; noted. Just like printf can never replace a symbolic debugger, static analysis, and so on in regular programming languages, print can't be any bottom line in model checking. Agreed. 

Still to write LTL expressions right one has to have a sense of what states are reachable, when, and in what format. In my earlier work I was stymied by the fact TLA was not reaching every legal next state I thought possible. `print` helped me see what went wrong because I could at least get a hint of what TLA was up to - what it was running - and places it never seemed to get to. Sometimes variables will have same values but in different states ... making print tough to interpret right ... motivating my earlier question. 

Anyway, ... engaging question on better mechanisms than printf()-debugging" to learn about a system's behavior generalizing away from print,

* How/can we ask TLA to tell us legal next states from a specified label? Partial answer? the DOT diagram generator or error trace might be helpful here. The former eats memory on large state but otherwise spot on and the latter I do not understand.

* How/can we ask TLA to tell us about non-reachable labels? Periodically I see TLA pointing out unreachable code, however, not consistently. In my earlier case there was indeed code that was never hit, therefore my loop never continued, and therefore state I wanted to make never happened. Having TLA point out "hey, your label is never hit" would be a plus. 

*  A more operational question: I run TLA with a single LTL _expression_ entered in Property section. The _expression_ reads "LogSizeConsistent == <>([](LogSize=MessageIndex))". Only it is enabled. When TLA stops it reports "1 Error"  under model checking results tab.  The console shows,
---------
Checking temporal properties for the complete state space with 132 total distinct states at (2020-11-18 20:28:27)
Temporal properties were violated.
The following behavior constitutes a counter-example:
<39 states elided>
----------

Now as LogSizeConsistent is the only one enabled, I know which property failed. TLA doesn't bother to name it. Why? Finally, no where in the counter example does TLA tell me the value of LogSize, which is a defined function. Nor does it refer to or name LogSizeConsistent in the counter example. Clicking on the hyperlink "1 Error" shows nothing new. TLA is probably right; but I am a lot perplexed about why.

Regards

On Monday, November 16, 2020 at 8:10:00 PM UTC-5 Calvin Loncaric wrote:

No.

Let me defend Markus's response though, which I think actually adds much more value than mine.

PlusCal's print statement is much less useful and much more confusing than you are probably imagining. I believe PlusCal should never have been given a print statement in the first place! Did you know that "TLC may print the value even if the step containing the print statement is not executed" [PlusCal Manual, section 3.2.8]? Did you know that consecutive printed lines are probably not from consecutive states of execution? It is quite reasonable for the first answer to be one that discourages you from such a bizarre language primitive. :)

The good news: TLA+ has much better mechanisms than "printf()-debugging" to learn about a system's behavior. Markus is not suggesting that you have failed to write good correctness properties; he is suggesting that the same TLA+ mechanisms that let you check correctness properties can also be used to explore other properties as well! So let's pop up a level... what properties are you interested in?

--

Calvin

On Mon, Nov 16, 2020 at 1:57 PM recepient recepient <nets...@xxxxxxxxx> wrote:

Programmers unlike other engineers tend to comment on questions not asked ... then not answer the question as asked ... thereby adding no value. The rule is: answer the question as-is, then of course, continue on to other thoughts. 

In this case this comment,
>TLC check suitable properties 
is fully implied to using a model checker in the first place.

I asked the question I did because I still continue to find TLA+'s interpretation of PlusCal code (see the issue elsewhere in this group) weird. Print helps me understand how TLA thinks in small corner cases.

On Monday, November 16, 2020 at 3:13:16 PM UTC-5 Markus Alexander Kuppe wrote:

On 16.11.20 09:28, recepient recepient wrote:
> ... to do something like,
>
> print << __state_num__, msgQueue >>; (* perhaps state_num is hash on
> current state *)
>
> to help disambiguate msgQueue in different states which have the same valu?


You don't give much detail or context, but you appear to be relying on
TLC's print operator to understand your spec. Don't do this! Instead,
have TLC check suitable properties for which it produces useful
error-traces.

Markus

--
You received this message because you are subscribed to the Google Groups "tlaplus" group.
To unsubscribe from this group and stop receiving emails from it, send an email to tlaplus+u...@xxxxxxxxxxxxxxxx.
To view this discussion on the web visit https://groups.google.com/d/msgid/tlaplus/999ac752-32a6-4195-b94f-9c03917927b5n%40googlegroups.com.

-- 
You received this message because you are subscribed to the Google Groups "tlaplus" group.
To unsubscribe from this group and stop receiving emails from it, send an email to tlaplus+unsubscribe@xxxxxxxxxxxxxxxx.
To view this discussion on the web visit https://groups.google.com/d/msgid/tlaplus/3603c2f3-ee37-4d76-a7d4-ec8a1d49ce2cn%40googlegroups.com.