[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [tlaplus] TLX — TLA+ specifications in Elixir syntax, with TLC integration



I have something to contribute to the implementation question. I have done some experimentation with code generation from TLA+ to Elixir for my bachelor thesis years ago [1], and there were two main challenges in getting the code to be useful (as a basis for some actual implementation):
1. Non-determinism and how to take inputs for it
2. How to split the naturally global state and transitions of the TLA+ spec into local processes

For (1), I defined an oracle interface which can be used to gather inputs for all non-determinism present in the spec (and therefore the code). I wrote a prototype [2] for a real pump-station controller that used MQTT for gathering sensor data and forwarding it to the oracle to drive the state machine.

For (2), I meant to have some sort of configuration that allowed users to define how the state would be divided, but this was kinda rushed and I'm sure we could have a more elegant interface - see an example in [3].

In my masters, I continued this work and included unit test generation from the spec, which is a much more trivial problem than MBT since I can generate the test harness to fit exactly the structure of the code I also generated. My master thesis [4] is in English and it covers a bit of the initial work too, in case you want to learn more, and I also wrote a paper [5].

Great job on TLX btw! I don't mean to hijack the conversation fully into code generation as that can spark lot's of debate, I just wanted to share something I tried in the past that was also in the TLA+ and Elixir combination!

[1]: https://github.com/bugarela/tla-transmutation
[2]: https://github.com/bugarela/pump-station
[3]: https://github.com/bugarela/tla-transmutation/blob/master/tla_specifications/ewd840/config.json
[4]: https://github.com/bugarela/masters-dissertation
[5]: https://dl.acm.org/doi/10.1145/3559744.3559747

Em dom., 12 de abr. de 2026 às 19:05, Andrew Helwer <andrew.helwer@xxxxxxxxx> escreveu:
Thanks Georges, very interesting. I do not know Elixir but have long wanted to learn a BEAM VM language. If you write a TLX spec, do you think it is possible for the code to function as both a spec and some base for an implementation of the full system in Elixir?

Andrew

On Sun, Apr 12, 2026 at 6:07 AM Georges Martin <jrjsmrtn@xxxxxxxxx> wrote:
Hello,

> Le 12 avr. 2026 à 09:57, Irwansyah Irwansyah <irwansyah@xxxxxxxxx> a écrit :
>
> Unfortunately, the whole point of using TLA+ is we can go straight forward attacking the problem without having to deal with setting up developnent environment that came with progrramming languages

I understand, and don't question that.

TLX reads and emits TLA+ and PlusCal, and calls TLC. Its DSL is based on TLA+. I'm not reinventing the wheel, and don't intend to: I am neither a formal specs expert nor a mathematician.

That said, even though I have a long experience with Perl, LaTeX, XSLT, and a bit of Erlang, I found the syntax (not the concepts) of TLA+ and PlusCal, well... much more intimidating 😅 I also have experience with Smalltalk, Python and Elixir, so I understand the importance of Developer Experience -- DX.

Thus, with TLX, I just tried to improve the TLA+ DX (it worked for me), make formal specs usage frictionless in Elixir projects (it worked in my project), prove a large, distributed, Elixir project design and implementation were correct (TLC found one bug and one design ambiguity, so it worked for me), and integrate formal specs verifications into CI (it worked ! 🥳).

So, I tried to make TLX a good citizen in the TLA+ ecosystem. And simply decided to open source it. That's all.

Thanks for your feedback 🙂

Georges

--
You received this message because you are subscribed to the Google Groups "tlaplus" group.
To unsubscribe from this group and stop receiving emails from it, send an email to tlaplus+unsubscribe@xxxxxxxxxxxxxxxx.
To view this discussion visit https://groups.google.com/d/msgid/tlaplus/BB88B7B6-F487-4701-BC89-1AAE241B3E5A%40gmail.com.

--
You received this message because you are subscribed to the Google Groups "tlaplus" group.
To unsubscribe from this group and stop receiving emails from it, send an email to tlaplus+unsubscribe@xxxxxxxxxxxxxxxx.
To view this discussion visit https://groups.google.com/d/msgid/tlaplus/CABj%3DxUV-qnxpxeayKpTGZCGK0%3DvUTKkB87Q15rcCS41y5hRhMQ%40mail.gmail.com.

--
You received this message because you are subscribed to the Google Groups "tlaplus" group.
To unsubscribe from this group and stop receiving emails from it, send an email to tlaplus+unsubscribe@xxxxxxxxxxxxxxxx.
To view this discussion visit https://groups.google.com/d/msgid/tlaplus/CAFFtv%3Dt4YrtS%3DMXM2DSn2XxKK6p%3DcVLgRTR9Mg7rRskYR7G1AA%40mail.gmail.com.