Advertisement

Extracting Symbolic Transitions from TLA\(^{+}\) Specifications

  • Jure Kukovec
  • Thanh-Hai Tran
  • Igor Konnov
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 10817)

Abstract

In \(\textsc {TLA}^{+}\), a system specification is written as a logical formula that restricts the system behavior. As a logic, \(\textsc {TLA}^{+}\) does not have assignments and other imperative statements that are used by model checkers to compute the successor states of a system state. Model checkers compute successors either explicitly — by evaluating program statements — or symbolically — by translating program statements to an SMT formula and checking its satisfiability. To efficiently enumerate the successors, TLA’s model checker TLC introduces side effects. For instance, an equality \(x' = e\) is interpreted as an assignment of e to the yet unbound variable x.

Inspired by TLC, we introduce an automatic technique for discovering expressions in \(\textsc {TLA}^{+}\) formulas such as \(x' = e\) and \(x' \in \{e_1, \dots , e_k\}\) that can be provably used as assignments. In contrast to TLC, our technique does not explicitly evaluate expressions, but it reduces the problem of finding assignments to the satisfiability of an SMT formula. Hence, we give a way to slice a \(\textsc {TLA}^{+}\) formula in symbolic transitions, which can be used as an input to a symbolic model checker. Our prototype implementation successfully extracts symbolic transitions from a few \(\textsc {TLA}^{+}\) benchmarks.

Notes

Acknowledgments

We are grateful to Stephan Merz for insightful discussions on semantics of \(\textsc {TLA}^{+}\). We thank anonymous reviewers for their helpful suggestions.

References

  1. 1.
    A collection of \({\rm TLA}^{+}\) specifications. https://github.com/tlaplus/Examples/. Accessed 21 Oct 2017
  2. 2.
    Azmy, N., Merz, S., Weidenbach, C.: A rigorous correctness proof for pastry. In: Butler, M., Schewe, K.-D., Mashkoor, A., Biro, M. (eds.) ABZ 2016. LNCS, vol. 9675, pp. 86–101. Springer, Cham (2016).  https://doi.org/10.1007/978-3-319-33600-8_5CrossRefGoogle Scholar
  3. 3.
    Beyer, D., Keremoglu, M.E.: CPAchecker: a tool for configurable software verification. In: Gopalakrishnan, G., Qadeer, S. (eds.) CAV 2011. LNCS, vol. 6806, pp. 184–190. Springer, Heidelberg (2011).  https://doi.org/10.1007/978-3-642-22110-1_16CrossRefGoogle Scholar
  4. 4.
    Biere, A., Cimatti, A., Clarke, E., Zhu, Y.: Symbolic model checking without BDDs. In: Cleaveland, W.R. (ed.) TACAS 1999. LNCS, vol. 1579, pp. 193–207. Springer, Heidelberg (1999).  https://doi.org/10.1007/3-540-49059-0_14CrossRefGoogle Scholar
  5. 5.
    Biere, A., Heule, M., van Maaren, H.: Handbook of Satisfiability, vol. 185. IOS press, Amsterdam (2009)zbMATHGoogle Scholar
  6. 6.
    Bracha, G., Toueg, S.: Asynchronous consensus and broadcast protocols. J. ACM 32(4), 824–840 (1985)MathSciNetCrossRefGoogle Scholar
  7. 7.
    Chandra, T.D., Toueg, S.: Unreliable failure detectors for reliable distributed systems. J. ACM 43(2), 225–267 (1996)MathSciNetCrossRefGoogle Scholar
  8. 8.
    Chaudhuri, K., Doligez, D., Lamport, L., Merz, S.: The TLA\(^{+}\) proof system: building a heterogeneous verification platform. In: Cavalcanti, A., Deharbe, D., Gaudel, M.-C., Woodcock, J. (eds.) ICTAC 2010. LNCS, vol. 6255, p. 44. Springer, Heidelberg (2010).  https://doi.org/10.1007/978-3-642-14808-8_3CrossRefGoogle Scholar
  9. 9.
    Clarke, E., Grumberg, O., Jha, S., Lu, Y., Veith, H.: Counterexample-guided abstraction refinement for symbolic model checking. J. ACM 50(5), 752–794 (2003)MathSciNetCrossRefGoogle Scholar
  10. 10.
    Conchon, S., Goel, A., Krstić, S., Mebsout, A., Zaïdi, F.: Cubicle: a parallel SMT-based model checker for parameterized systems. In: Madhusudan, P., Seshia, S.A. (eds.) CAV 2012. LNCS, vol. 7358, pp. 718–724. Springer, Heidelberg (2012).  https://doi.org/10.1007/978-3-642-31424-7_55CrossRefGoogle Scholar
  11. 11.
    Dijkstra, E.W., Feijen, W.H., Van Gasteren, A.M.: Derivation of a termination detection algorithm for distributed computations. In: Broy, M. (ed.) Control Flow and Data Flow: concepts of distributed programming, pp. 507–512. Springer, Heidelberg (1986).  https://doi.org/10.1007/978-3-642-82921-5_13CrossRefGoogle Scholar
  12. 12.
    Gafni, E., Lamport, L.: Disk paxos. Distrib. Comput. 16(1), 1–20 (2003)CrossRefGoogle Scholar
  13. 13.
    Guerraoui, R.: On the hardness of failure-sensitive agreement problems. Inf. Process. Lett. 79(2), 99–104 (2001)MathSciNetCrossRefGoogle Scholar
  14. 14.
    Konnov, I., Lazić, M., Veith, H., Widder, J.: A short counterexample property for safety and liveness verification of fault-tolerant distributed algorithms. In: POPL, pp. 719–734 (2017)CrossRefGoogle Scholar
  15. 15.
    Kroening, D., Tautschnig, M.: CBMC – C bounded model checker. In: Ábrahám, E., Havelund, K. (eds.) TACAS 2014. LNCS, vol. 8413, pp. 389–391. Springer, Heidelberg (2014).  https://doi.org/10.1007/978-3-642-54862-8_26CrossRefGoogle Scholar
  16. 16.
    Kukovec, J., Tran, T.H., Konnov, I.: Extracting symbolic transitions from \({\rm TLA}^{+}\) specifications (technical report 2018). http://forsyte.at/wp-content/uploads/abz2018_full.pdf. Accessed 7 Feb 2018
  17. 17.
    Lamport, L.: The part-time parliament. ACM TCS 16(2), 133–169 (1998)CrossRefGoogle Scholar
  18. 18.
    Lamport, L.: Specifying systems: the \({\rm TLA}^{+}\) language and tools for hardware and software engineers. Addison-Wesley Longman Publishing Co., Inc., Boston (2002)Google Scholar
  19. 19.
    Merz, S.: The specification language \({\rm TLA}^{+}\). In: Bjørner, D., Henson, M.C. (eds.) Logics of specification languages. Monographs in Theoretical Computer Science (An EATCS Series), pp. 401–451. Springer, Heidelberg (2008).  https://doi.org/10.1007/978-3-540-74107-7_8CrossRefGoogle Scholar
  20. 20.
    Merz, S., Vanzetto, H.: Automatic verification of \({\rm TLA}^{+}\) proof obligations with SMT solvers. In: Bjørner, N., Voronkov, A. (eds.) LPAR 2012. LNCS, vol. 7180, pp. 289–303. Springer, Heidelberg (2012).  https://doi.org/10.1007/978-3-642-28717-6_23CrossRefGoogle Scholar
  21. 21.
    Merz, S., Vanzetto, H.: Harnessing SMT solvers for \({\rm TLA}^{+}\) proofs. ECEASST, 53 (2012). https://hal.inria.fr/hal-00760579
  22. 22.
    Moraru, I., Andersen, D.G., Kaminsky, M.: There is more consensus in Egalitarian parliaments. In: SOSP, pp. 358–372. ACM (2013)Google Scholar
  23. 23.
    Newcombe, C., Rath, T., Zhang, F., Munteanu, B., Brooker, M., Deardeuff, M.: How Amazon web services uses formal methods. Commun. ACM 58(4), 66–73 (2015)CrossRefGoogle Scholar
  24. 24.
    Ongaro, D.: Consensus: bridging theory and practice. Ph.D. thesis, Stanford University (2014)Google Scholar
  25. 25.
    Raynal, M.: A case study of agreement problems in distributed systems: non-blocking atomic commitment. In: HASE, pp. 209–214 (1997)Google Scholar
  26. 26.
    Yu, Y., Manolios, P., Lamport, L.: Model checking TLA+ specifications. In: Pierre, L., Kropf, T. (eds.) CHARME 1999. LNCS, vol. 1703, pp. 54–66. Springer, Heidelberg (1999).  https://doi.org/10.1007/3-540-48153-2_6CrossRefGoogle Scholar

Copyright information

© Springer International Publishing AG, part of Springer Nature 2018

Authors and Affiliations

  1. 1.TU Wien (Vienna University of Technology)ViennaAustria
  2. 2.University of Lorraine, CNRS, Inria, LORIANancyFrance

Personalised recommendations