Live data from Hacker News

TLA+ model checking made symbolic

blog.acolyer.org

41–50 of 54 posts

Re: TLA+ model checking made symbolic

#41

Is anybody using TLA+ in production outside of academia? What for? I've always wanted to, but I'm not familiar enough with it to always recognize when it'd be the right tool to reach for. I primarily code in Elixir and Erlang, and have used property testing to perform some level of model checking when working with state machines, and I suspect TLA+ could be helpful for formalizing that a little bit, but it isn't a th…

We use TLA+. There's nothing particularly magical about TLA+. There are a variety of modeling languages and model checking toolkits out there. I've yet to encounter someone in industries that have commonly adopted model definition & checking who uses TLA+. It's popularity seems highest among folks in newer SaaS/IT arenas than elsewhere. More often I run into folks using SCADE's model checker. Tied for a distant 2nd,…

Did you all ever open source your emacs tooling? I’d like to see that.

Re: TLA+ model checking made symbolic

#42

Is anybody using TLA+ in production outside of academia? What for? I've always wanted to, but I'm not familiar enough with it to always recognize when it'd be the right tool to reach for. I primarily code in Elixir and Erlang, and have used property testing to perform some level of model checking when working with state machines, and I suspect TLA+ could be helpful for formalizing that a little bit, but it isn't a th…

We use TLA+. There's nothing particularly magical about TLA+. There are a variety of modeling languages and model checking toolkits out there. I've yet to encounter someone in industries that have commonly adopted model definition & checking who uses TLA+. It's popularity seems highest among folks in newer SaaS/IT arenas than elsewhere. More often I run into folks using SCADE's model checker. Tied for a distant 2nd,…

TLA+'s secret power is refinement; the entire logic is built around the abstraction/refinement relation. One of the best ways to use TLA+ is to specify you system in two or three levels of detail and check that they are, indeed, refinements. If you just use TLA+ for model-checking and don't use refinement mappings that are possible due to the language's elegance, you're giving up on most of its power, and if that's the case, you might as well use weaker specification languages like Promella and NuSMV. But I think it's worthwhile to learn how to use refinements and enjoy the full power of TLA+ rather than just as a language for model-checking. Unlike Promella and NuSMV, TLA+ is not designed as a frontend language for a model-checker. It's a language primarily designed to allow you to think about and understand your system in interesting ways, and it also has a model checker. It's designed to be read and discussed (hence the emphasis on pretty-printing) much more than written and edited. If you're using it anyway, make the full use of it.

Re: TLA+ model checking made symbolic

#43

Earlier quoted context omitted.

I've written some models for "personal use and validation", and I keep it in my toolbelt (with Alloy) in case my thinking is not clear about something

Could you briefly describe some of the models you played with? It seems cool that someone just specified models and verifies them in their spare time.

My spare time is kind of... weird. They were related to concurrency in an actor system, I validated a design and implementation (can’t share much more). I recommend checking Hillel’s blog as suggested, he has excellent examples (and his book is a good starting point for TLA+ and Pluscal as well)

Re: TLA+ model checking made symbolic

#44
post #41

Earlier quoted context omitted.

We use TLA+. There's nothing particularly magical about TLA+. There are a variety of modeling languages and model checking toolkits out there. I've yet to encounter someone in industries that have commonly adopted model definition & checking who uses TLA+. It's popularity seems highest among folks in newer SaaS/IT arenas than elsewhere. More often I run into folks using SCADE's model checker. Tied for a distant 2nd,…

Did you all ever open source your emacs tooling? I’d like to see that.

We didn't. It's on our list of things to open source and write about though, so we will when time permits. Probably won't be until after the new year, as we're focused on preparing for CES.

Re: TLA+ model checking made symbolic

#45
post #42

Earlier quoted context omitted.

We use TLA+. There's nothing particularly magical about TLA+. There are a variety of modeling languages and model checking toolkits out there. I've yet to encounter someone in industries that have commonly adopted model definition & checking who uses TLA+. It's popularity seems highest among folks in newer SaaS/IT arenas than elsewhere. More often I run into folks using SCADE's model checker. Tied for a distant 2nd,…

TLA+'s secret power is refinement; the entire logic is built around the abstraction/refinement relation. One of the best ways to use TLA+ is to specify you system in two or three levels of detail and check that they are, indeed, refinements. If you just use TLA+ for model-checking and don't use refinement mappings that are possible due to the language's elegance, you're giving up on most of its power, and if that's t…

[deleted]

Re: TLA+ model checking made symbolic

#46
post #42

Earlier quoted context omitted.

We use TLA+. There's nothing particularly magical about TLA+. There are a variety of modeling languages and model checking toolkits out there. I've yet to encounter someone in industries that have commonly adopted model definition & checking who uses TLA+. It's popularity seems highest among folks in newer SaaS/IT arenas than elsewhere. More often I run into folks using SCADE's model checker. Tied for a distant 2nd,…

TLA+'s secret power is refinement; the entire logic is built around the abstraction/refinement relation. One of the best ways to use TLA+ is to specify you system in two or three levels of detail and check that they are, indeed, refinements. If you just use TLA+ for model-checking and don't use refinement mappings that are possible due to the language's elegance, you're giving up on most of its power, and if that's t…

I'm now _really_ curious as to how many people who use and value TLA+ have actually used refinement. I've used it, you've used it, Lamport and (probs) Merz and Markus have used it, most other people I've talked to haven't. Probably time for a community poll or something.

Re: TLA+ model checking made symbolic

#47
post #46
post #42

Earlier quoted context omitted.

TLA+'s secret power is refinement; the entire logic is built around the abstraction/refinement relation. One of the best ways to use TLA+ is to specify you system in two or three levels of detail and check that they are, indeed, refinements. If you just use TLA+ for model-checking and don't use refinement mappings that are possible due to the language's elegance, you're giving up on most of its power, and if that's t…

I'm now _really_ curious as to how many people who use and value TLA+ have actually used refinement. I've used it, you've used it, Lamport and (probs) Merz and Markus have used it, most other people I've talked to haven't. Probably time for a community poll or something.

Technically it's impossible to use TLA+ without using refinement, as the entire TLA logic is based on it. Checking Machine ⇒ □P is checking that Machine refines □P. But, of course, the real power -- and what you and I both meant -- comes from writing machine formulas on both sides of the implication sign.

I don't think many of those who use TLA+ use refinement between two machine formulas, but I think that's partly because they still consider TLA+ as a frontend language for TLC, which is unfortunate, because if all you want (or, rather, think you want) is a model-checker, there are probably better ones. In fact, the little use of refinement is just a symptom of this bigger issue. I don't think refinement is always useful, but I do think that everyone who uses TLA+ should use its power for analysis rather than just mundane model-checking. I admit, TLC is so enticing, that once you use it, TLA+ can feel secondary to it. Of course, I'd be happy if people used model-checkers more, whether TLC, Spin, NuSMV, Simulink or others, but I'd be even happier if people used TLA+ for its primary purpose, perhaps after being enticed by TLC: thinking about system design. I guess the problem is exactly what Lamport pointed out: programmers (including myself) don't like to think, especially when we can use automation. To be honest, I don't think I would have come to TLA+ if it weren't for TLC. So, in a sense, TLC both pulls people to TLA+ and obscures its main purpose.

In the TLA+ workshop I imagine one day giving to my colleagues, I start with refinement. I would also start without TLC at all; just showing how TLA+ helps you think -- its main purpose and advantage. When writing specifications, I now always start with refinement, first writing how the system would behave at a very high-level, and only then refining a specific algorithm.

(If anyone reads this without having read the article, and doesn't know what TLC is, it's a model-checker for TLA+ that's included in the TLA+ Toolbox)

Re: TLA+ model checking made symbolic

#48

Is anybody using TLA+ in production outside of academia? What for? I've always wanted to, but I'm not familiar enough with it to always recognize when it'd be the right tool to reach for. I primarily code in Elixir and Erlang, and have used property testing to perform some level of model checking when working with state machines, and I suspect TLA+ could be helpful for formalizing that a little bit, but it isn't a th…

We use TLA+. There's nothing particularly magical about TLA+. There are a variety of modeling languages and model checking toolkits out there. I've yet to encounter someone in industries that have commonly adopted model definition & checking who uses TLA+. It's popularity seems highest among folks in newer SaaS/IT arenas than elsewhere. More often I run into folks using SCADE's model checker. Tied for a distant 2nd,…

Did you also wire up trace expression evaluation in Emacs?

Re: TLA+ model checking made symbolic

#49
post #47
post #46

Earlier quoted context omitted.

I'm now _really_ curious as to how many people who use and value TLA+ have actually used refinement. I've used it, you've used it, Lamport and (probs) Merz and Markus have used it, most other people I've talked to haven't. Probably time for a community poll or something.

Technically it's impossible to use TLA+ without using refinement, as the entire TLA logic is based on it. Checking Machine ⇒ □P is checking that Machine refines □P. But, of course, the real power -- and what you and I both meant -- comes from writing machine formulas on both sides of the implication sign. I don't think many of those who use TLA+ use refinement between two machine formulas, but I think that's partly b…

Why exactly is TLA+ better suited to thinking about system design compared to say mCRL2, SCADE, or Simulink? Especially relative to the latter two since they provide a paved road to going from your system model to your system implementation, which TLA+ makes no attempt to do.

Re: TLA+ model checking made symbolic

#50
post #47

Earlier quoted context omitted.

Technically it's impossible to use TLA+ without using refinement, as the entire TLA logic is based on it. Checking Machine ⇒ □P is checking that Machine refines □P. But, of course, the real power -- and what you and I both meant -- comes from writing machine formulas on both sides of the implication sign. I don't think many of those who use TLA+ use refinement between two machine formulas, but I think that's partly b…

Why exactly is TLA+ better suited to thinking about system design compared to say mCRL2, SCADE, or Simulink? Especially relative to the latter two since they provide a paved road to going from your system model to your system implementation, which TLA+ makes no attempt to do.

I don't know mCRL2 at all, but SCADE and Simulink are niche tools (excellent at what they're for). TLA+ is completely general-purpose because it can describe a system at arbitrary levels of abstraction (and link the levels). You could hypothetically describe the same system at the level of logic gates or at the level of human interaction. Now, it is not true that TLA+ makes no attempt to directly link to the implementation, but it makes no particular attempt to do so. Its ability to do so stems directly from its power to describe a system at truly arbitrary levels. You want to describe your system at your code level so that you can verify your actual code? You can do that. But here's where things get interesting. If you want to verify a specification using any sound tool -- be it a model-checker or deductive proof -- the size of the specification becomes very limited. We can verify about 3000-6000 lines of a specification. It can be this number of lines of a low-level specification, i.e. code, or of a high-level specification. So this means that if we want to verify our actual implementation, our program must be tiny. But TLA+ gives you the option to specify and verify, say, a 2000-line high-level specification of a 2MLOC program to find problems at that level, and that's what people in general-purpose software need most.

If your tool -- any tool -- links directly to the implementation, we know that the verified implementation will be very limited in size. It is TLA+'s ability to choose arbitrary levels of detail that gives it the power to help design large system. Such designs, however, cannot be formally (i.e. mechanically) linked to the implementation. If they could, we'd know how to fully verify large systems, but we don't.

Post reply on HN