A Tutorial Introduction to TLA + Stephan Merz http://www.loria.fr/˜merz/ INRIA Nancy & LORIA Nancy, France TLA + Community Event, ABZ 2014 Toulouse, June 3, 2014 TLA + Tutorial Stephan Merz (INRIA Nancy) Toulouse, June 2014 1 / 39
Objective Explain basic concepts of TLA + ◮ modeling systems: static and dynamic aspects ◮ existing tool support for modeling and analysis PlusCal translator, TLC model checker, TLAPS proof platform ◮ elementary aspects of system refinement Example-driven presentation, not trying to be exhaustive TLA + Tutorial Stephan Merz (INRIA Nancy) Toulouse, June 2014 2 / 39
Outline Modeling Systems in TLA + 1 2 System Verification 3 The PlusCal Algorithm Language Refinement in TLA + 4 TLA + Tutorial Stephan Merz (INRIA Nancy) Toulouse, June 2014 3 / 39
Example: Distributed Termination Detection 0 1 3 2 Nodes arranged on a ring perform some computation ◮ nodes can be active (double circle) or inactive ◮ how can node 0 (master node) detect when all nodes are inactive? TLA + Tutorial Stephan Merz (INRIA Nancy) Toulouse, June 2014 4 / 39
Example: Distributed Termination Detection 0 0 1 3 1 3 � 2 2 Nodes arranged on a ring perform some computation ◮ nodes can be active (double circle) or inactive ◮ how can node 0 (master node) detect when all nodes are inactive? Token-based algorithm ◮ initially: token at master node, who may pass it to its neighbor TLA + Tutorial Stephan Merz (INRIA Nancy) Toulouse, June 2014 4 / 39
Example: Distributed Termination Detection 0 0 0 1 3 1 3 1 3 � � 2 2 2 Nodes arranged on a ring perform some computation ◮ nodes can be active (double circle) or inactive ◮ how can node 0 (master node) detect when all nodes are inactive? Token-based algorithm ◮ initially: token at master node, who may pass it to its neighbor ◮ when a node is inactive, it passes on the token TLA + Tutorial Stephan Merz (INRIA Nancy) Toulouse, June 2014 4 / 39
Example: Distributed Termination Detection 0 0 0 0 1 3 1 3 · · · � 1 3 1 3 � � 2 2 2 2 Nodes arranged on a ring perform some computation ◮ nodes can be active (double circle) or inactive ◮ how can node 0 (master node) detect when all nodes are inactive? Token-based algorithm ◮ initially: token at master node, who may pass it to its neighbor ◮ when a node is inactive, it passes on the token ◮ termination detected when token returns to inactive master node TLA + Tutorial Stephan Merz (INRIA Nancy) Toulouse, June 2014 4 / 39
Example: Distributed Termination Detection 0 0 0 0 1 3 1 3 · · · � 1 3 1 3 � � 2 2 2 2 Nodes arranged on a ring perform some computation ◮ nodes can be active (double circle) or inactive ◮ how can node 0 (master node) detect when all nodes are inactive? Token-based algorithm ◮ initially: token at master node, who may pass it to its neighbor ◮ when a node is inactive, it passes on the token ◮ termination detected when token returns to inactive master node Complication: nodes may send messages, activating receiver TLA + Tutorial Stephan Merz (INRIA Nancy) Toulouse, June 2014 4 / 39
Dijkstra’s Algorithm (EWD 840, 1983) 0 1 3 2 Nodes and token colored black or white ◮ master node initiates probe by sending white token TLA + Tutorial Stephan Merz (INRIA Nancy) Toulouse, June 2014 5 / 39
Dijkstra’s Algorithm (EWD 840, 1983) 0 0 1 3 1 3 � 2 2 Nodes and token colored black or white ◮ master node initiates probe by sending white token ◮ message to higher-numbered node stains sending node TLA + Tutorial Stephan Merz (INRIA Nancy) Toulouse, June 2014 5 / 39
Dijkstra’s Algorithm (EWD 840, 1983) 0 0 0 1 3 1 3 1 3 � � 2 2 2 Nodes and token colored black or white ◮ master node initiates probe by sending white token ◮ message to higher-numbered node stains sending node ◮ when passing the token, a black node stains the token TLA + Tutorial Stephan Merz (INRIA Nancy) Toulouse, June 2014 5 / 39
Dijkstra’s Algorithm (EWD 840, 1983) 0 0 0 1 3 1 3 1 3 � � 2 2 2 Nodes and token colored black or white ◮ master node initiates probe by sending white token ◮ message to higher-numbered node stains sending node ◮ when passing the token, a black node stains the token Termination detection by master node ◮ white token at inactive, white master node TLA + Tutorial Stephan Merz (INRIA Nancy) Toulouse, June 2014 5 / 39
Dijkstra’s Algorithm (EWD 840, 1983) 0 0 0 1 3 1 3 1 3 � � 2 2 2 Nodes and token colored black or white ◮ master node initiates probe by sending white token ◮ message to higher-numbered node stains sending node ◮ when passing the token, a black node stains the token Termination detection by master node ◮ white token at inactive, white master node Required correctness properties ◮ safety: termination detected only if all nodes inactive ◮ liveness: when all nodes inactive, termination will be detected TLA + Tutorial Stephan Merz (INRIA Nancy) Toulouse, June 2014 5 / 39
TLA + Specification of EWD 840: Data Model MODULE EWD840 EXTENDS Naturals CONSTANT N ∆ ASSUME NAssumption = N ∈ Nat \ { 0 } ∆ Nodes = 0 .. N − 1 ∆ Color = { “white” , “black” } VARIABLES tpos , tcolor , active , color ∆ = ∧ tpos ∈ Nodes ∧ tcolor ∈ Color TypeOK ∧ active ∈ [ Nodes → BOOLEAN ] ∧ color ∈ [ Nodes → Color ] Declaration of parameters Definition of operators ◮ sets Nodes and Color ◮ TypeOK documents expected values of variables ◮ active and color are arrays, i.e. functions TLA + Tutorial Stephan Merz (INRIA Nancy) Toulouse, June 2014 6 / 39
TLA + Specification of EWD 840: Behavior (1) ∆ = ∧ tpos ∈ Nodes ∧ tcolor = “black” Init ∧ active ∈ [ Nodes → BOOLEAN ] ∧ color ∈ [ Nodes → Color ] Initial condition: any “type-correct” values; token should be black TLA + Tutorial Stephan Merz (INRIA Nancy) Toulouse, June 2014 7 / 39
TLA + Specification of EWD 840: Behavior (1) ∆ = ∧ tpos ∈ Nodes ∧ tcolor = “black” Init ∧ active ∈ [ Nodes → BOOLEAN ] ∧ color ∈ [ Nodes → Color ] ∆ InitiateProbe = ∧ tpos = 0 ∧ ( tcolor = “black” ∨ color [ 0 ] = “black” ) ∧ tpos ′ = N − 1 ∧ tcolor ′ = “white” ∧ color ′ = [ color EXCEPT ! [ 0 ] = “white” ] ∧ active ′ = active ∆ PassToken ( i ) = ∧ tpos = i ∧ ¬ active [ i ] ∧ tpos ′ = i − 1 ∧ tcolor ′ = IF color [ i ] = “black” THEN “black” ELSE tcolor ∧ color ′ = [ color EXCEPT ! [ i ] = “white” ] ∧ active ′ = active Initial condition: any “type-correct” values; token should be black Action definitions: describe transitions of the algorithm TLA + Tutorial Stephan Merz (INRIA Nancy) Toulouse, June 2014 7 / 39
TLA + Specification of EWD 840: Behavior (2) ∆ SendMsg ( i ) = ∧ active [ i ] ∧ ∃ j ∈ Nodes \ { i } : ∧ active ′ = [ active EXCEPT ! [ j ] = TRUE ] ∧ color ′ = [ color EXCEPT ! [ i ] = IF j > i THEN “black” ELSE @ ] ∧ UNCHANGED � tpos , tcolor � ∆ Deactivate ( i ) = ∧ active [ i ] ∧ active ′ = [ active EXCEPT ! [ i ] = FALSE ] ∧ UNCHANGED � color , tpos , tcolor � Definition of remaining actions TLA + Tutorial Stephan Merz (INRIA Nancy) Toulouse, June 2014 8 / 39
TLA + Specification of EWD 840: Behavior (2) ∆ SendMsg ( i ) = ∧ active [ i ] ∧ ∃ j ∈ Nodes \ { i } : ∧ active ′ = [ active EXCEPT ! [ j ] = TRUE ] ∧ color ′ = [ color EXCEPT ! [ i ] = IF j > i THEN “black” ELSE @ ] ∧ UNCHANGED � tpos , tcolor � ∆ Deactivate ( i ) = ∧ active [ i ] ∧ active ′ = [ active EXCEPT ! [ i ] = FALSE ] ∧ UNCHANGED � color , tpos , tcolor � ∆ = Next ∨ InitiateProbe ∨ ∃ i ∈ Nodes \ { 0 } : PassToken ( i ) ∨ ∃ i ∈ Nodes : SendMsg ( i ) ∨ Deactivate ( i ) ∆ vars = � tpos , tcolor , active , color � ∆ Spec = Init ∧ � [ Next ] vars Definition of remaining actions Possible executions: initial condition, interleaving of transitions TLA + Tutorial Stephan Merz (INRIA Nancy) Toulouse, June 2014 8 / 39
Modeling a System in TLA + Describe the system configurations 1 ◮ represent the state of the system by state variables ◮ mathematical abstractions: numbers, sets, functions, tuples, . . . TLA + Tutorial Stephan Merz (INRIA Nancy) Toulouse, June 2014 9 / 39
Modeling a System in TLA + Describe the system configurations 1 ◮ represent the state of the system by state variables ◮ mathematical abstractions: numbers, sets, functions, tuples, . . . Specify system behavior as a state machine Init ∧ � [ Next ] v 2 ◮ initial condition: state formula identifies initial states ◮ next-state relation: action formula constrains allowed transitions ◮ overall spec: temporal formula defines system executions ◮ � [ Next ] v every transition satisfies Next or leaves v unchanged TLA + Tutorial Stephan Merz (INRIA Nancy) Toulouse, June 2014 9 / 39
Recommend
More recommend
