apalache-mc / apalache

APALACHE: symbolic model checker for TLA+ and Quint
https://apalache-mc.org/
Apache License 2.0
439 stars 40 forks source link

Assignments in quint `init` operators need to be unprimed #2863

Open shonfeder opened 7 months ago

shonfeder commented 7 months ago

We are currently translating all cases of quint's assign operator, _' = _ as _' := _ in the apalache IR:

https://github.com/informalsystems/apalache/blob/efb30eaf2f1fc76249e1116ee72e659485483823/tla-io/src/main/scala/at/forsyte/apalache/io/quint/Quint.scala#L614

But in the init operator these should not be primed.

shonfeder commented 7 months ago

This is not super straightforward in the general case. Consider a quint spec like

var x: int
var y: int

def foo = x' = 0
def bar = y' = 0

def init = all{ foo, bar }

In order to ensure that we translate the variable initialization into equalities (as needed by TLC) instead of "assignments" (as we are currently doing), we will need to track all operators that are used in init (transitively) and ensure that we treat quint assignment application one way in those contexts, but treat them as apalache assignments in all other contexts. This is totally doable of course, but it will complicate the translation a lot. We may want to consider something on the quint side instead, that gives us different operators for these two different cases.

FYI @bugarela

bugarela commented 7 months ago

I also thought about doing this in Quint side. However, I accidentally just bumped into this, which might be a promising way of doing it in the Apalache side: https://github.com/informalsystems/apalache/blob/9295b5b6cdc76b991e99a5546a6c62e62e7dfd39/tla-bmcmt/src/main/scala/at/forsyte/apalache/tla/bmcmt/passes/ReTLAToVMTTranspilePassImpl.scala#L42