heidihoward / pbft-tlaplus

Formal specification of PBFT in TLA+
MIT License
7 stars 1 forks source link

Fix Apalache type annotations by migrating to type system 1.2. #2

Closed lemmy closed 3 months ago

lemmy commented 3 months ago

Related: https://github.com/apalache-mc/apalache/blob/main/docs/src/lang/records.md https://apalache.informal.systems/docs/adr/002adr-types.html#13-type-system-12-including-precise-records-variants-and-rows https://github.com/apalache-mc/apalache/blob/main/docs/src/adr/014adr-precise-records.md

lemmy commented 3 months ago

FWIW: Replacing Tstamp and Views with finite sets makes Apalache start bounded model checking. However, some construct causes it to expand the sets.

diff --git a/pbft.tla b/pbft.tla
index 8f90780..201a18d 100644
--- a/pbft.tla
+++ b/pbft.tla
@@ -37,7 +37,7 @@ ASSUME ByzR \subseteq R

 \* Set of request timestamps
 \* We use just natural numbers as there's a single client
-Tstamps == Nat
+Tstamps == 0..0

 \* Set of sequence numbers
 \* Bounding sequence numbers to the total number of requests
@@ -59,7 +59,7 @@ States == SeqNums \union {0}
 Results == SeqNums

 \* Set of possible views
-Views == Nat
+Views == 0..100

 \* RequestDigest takes a client request and returns a unique identifier
 \* Since we are assuming timestamps are unique, we can use them as the digest
-> % ./apalache-0.44.11/bin/apalache-mc check --cinit=ConstInit --inv=Inv --no-deadlock MCpbft.tla   
20:27:55.744 [main] INFO at.forsyte.apalache.tla.tooling.opt.CheckCmd -- Loading configuration
20:27:55.769 [main] INFO at.forsyte.apalache.tla.tooling.opt.CheckCmd --   > TLC config file found in specification directory. To enable it, pass --config=MCpbft.cfg.
# Usage statistics is ON. Thank you!
# If you have changed your mind, disable the statistics with config --enable-stats=false.

Output directory: /Users/markus/src/TLA/_specs/MSFT/pbft-tlaplus/_apalache-out/MCpbft.tla/2024-07-28T20-27-55_3165530396224552025
# APALACHE version: 0.44.11 | build: 5dee24e                      I@20:27:55.968
Tuning: search.outputTraces=false                                 I@20:27:55.987
PASS #0: SanyParser                                               I@20:27:56.123
Parsing file /Users/markus/src/TLA/_specs/MSFT/pbft-tlaplus/MCpbft.tla
Parsing file /Users/markus/src/TLA/_specs/MSFT/pbft-tlaplus/pbft.tla
Parsing file /private/var/folders/7d/4x6z2cc91jl588ysynlc1tfc0000gn/T/Integers.tla
Parsing file /private/var/folders/7d/4x6z2cc91jl588ysynlc1tfc0000gn/T/FiniteSets.tla
Parsing file /private/var/folders/7d/4x6z2cc91jl588ysynlc1tfc0000gn/T/__rewire_tlc_in_apalache.tla
Parsing file /private/var/folders/7d/4x6z2cc91jl588ysynlc1tfc0000gn/T/Naturals.tla
Parsing file /private/var/folders/7d/4x6z2cc91jl588ysynlc1tfc0000gn/T/__rewire_sequences_in_apalache.tla
Parsing file /private/var/folders/7d/4x6z2cc91jl588ysynlc1tfc0000gn/T/__apalache_folds.tla
PASS #1: TypeCheckerSnowcat                                       I@20:27:56.592
 > Running Snowcat .::.                                           I@20:27:56.592
 > Your types are purrfect!                                       I@20:27:58.087
 > All expressions are typed                                      I@20:27:58.087
PASS #2: ConfigurationPass                                        I@20:27:58.088
  > Set the initialization predicate to Init                      I@20:27:58.092
  > Set the transition predicate to Next                          I@20:27:58.092
  > Set the constant initialization predicate to ConstInit        I@20:27:58.093
  > Set an invariant to Inv                                       I@20:27:58.093
PASS #3: DesugarerPass                                            I@20:27:58.098
  > Desugaring...                                                 I@20:27:58.098
PASS #4: InlinePass                                               I@20:27:58.270
Leaving only relevant operators: ConstInit, ConstInitPrimed, Init, InitPrimed, Inv, Next I@20:27:58.270
PASS #5: TemporalPass                                             I@20:27:58.350
  > Rewriting temporal operators...                               I@20:27:58.351
  > No temporal property specified, nothing to encode             I@20:27:58.351
PASS #6: InlinePass                                               I@20:27:58.351
Leaving only relevant operators: ConstInit, ConstInitPrimed, Init, InitPrimed, Inv, Next I@20:27:58.351
PASS #7: PrimingPass                                              I@20:27:58.364
  > Introducing ConstInitPrimed for ConstInit'                    I@20:27:58.366
  > Introducing InitPrimed for Init'                              I@20:27:58.369
PASS #8: VCGen                                                    I@20:27:58.369
  > Producing verification conditions from the invariant Inv      I@20:27:58.370
  > VCGen produced 8 verification condition(s)                    I@20:27:58.375
PASS #9: PreprocessingPass                                        I@20:27:58.376
  > Before preprocessing: unique renaming                         I@20:27:58.376
 > Applying standard transformations:                             I@20:27:58.382
  > PrimePropagation                                              I@20:27:58.382
  > Desugarer                                                     I@20:27:58.386
  > UniqueRenamer                                                 I@20:27:58.391
  > Normalizer                                                    I@20:27:58.399
  > Keramelizer                                                   I@20:27:58.423
  > After preprocessing: UniqueRenamer                            I@20:27:58.465
PASS #10: TransitionFinderPass                                    I@20:27:58.482
  > Found 1 initializing transitions                              I@20:27:58.527
  > Found 13 transitions                                          I@20:27:58.539
  > Found constant initializer ConstInit                          I@20:27:58.540
  > Applying unique renaming                                      I@20:27:58.542
PASS #11: OptimizationPass                                        I@20:27:58.554
 > Applying optimizations:                                        I@20:27:58.559
  > ConstSimplifier                                               I@20:27:58.559
  > ExprOptimizer                                                 I@20:27:58.578
  > SetMembershipSimplifier                                       I@20:27:58.593
  > ConstSimplifier                                               I@20:27:58.597
PASS #12: AnalysisPass                                            I@20:27:58.615
 > Marking skolemizable existentials and sets to be expanded...   I@20:27:58.617
  > Skolemization                                                 I@20:27:58.617
  > Expansion                                                     I@20:27:58.618
  > Remove unused let-in defs                                     I@20:27:58.628
 > Running analyzers...                                           I@20:27:58.635
  > Introduced expression grades                                  I@20:27:58.647
PASS #13: BoundedChecker                                          I@20:27:58.648
State 0: Checking 8 state invariants                              I@20:28:00.305
The set $C$2265 is expanded, producing O(2^404) constraints. This may slow down the solver. W@20:28:00.750
<unknown>: rewriter error: Attempted to expand a powerset of size 2^404 E@20:28:00.769
at.forsyte.apalache.infra.AdaptedException: <unknown>: rewriter error: Attempted to expand a powerset of size 2^404
        at at.forsyte.apalache.infra.passes.PassChainExecutor$.run(PassChainExecutor.scala:39)
        at at.forsyte.apalache.tla.tooling.opt.CheckCmd.run(CheckCmd.scala:129)
        at at.forsyte.apalache.tla.Tool$.runCommand(Tool.scala:138)
        at at.forsyte.apalache.tla.Tool$.run(Tool.scala:118)
        at at.forsyte.apalache.tla.Tool$.main(Tool.scala:40)
        at at.forsyte.apalache.tla.Tool.main(Tool.scala)
Please report an issue at [https://github.com/informalsystems/apalache/issues]: at.forsyte.apalache.infra.AdaptedException: <unknown>: rewriter error: Attempted to expand a powerset of size 2^404
A bug report template has been generated at [/Users/markus/src/TLA/_specs/MSFT/pbft-tlaplus/_apalache-out/MCpbft.tla/2024-07-28T20-27-55_3165530396224552025/BugReport.md].
If you choose to use it, please complete the template with a description of the expected behavior and impact.
It took me 0 days  0 hours  0 min  4 sec                          I@20:28:00.776
Total time: 4.804 sec                                             I@20:28:00.776
EXITCODE: ERROR (255)
heidihoward commented 3 months ago

Thanks for updating it to 1.2. I think you're seeing the same error as me.

Here's what I get, even for just the usual init (one state) and length 0.

$ apalache-mc check --config=MCpbft.cfg --length=0 MCpbft.tla 
13:36:07.122 [main] INFO at.forsyte.apalache.tla.tooling.opt.CheckCmd -- Loading configuration
# Usage statistics is OFF. We care about your privacy.
# If you want to help our project, consider enabling statistics with config --enable-stats=true.

Output directory: /home/codespace/pbft-tlaplus/_apalache-out/MCpbft.tla/2024-07-29T13-36-07_17752118606435554856
# APALACHE version: 0.44.11 | build: 5dee24e                      I@13:36:07.423
  > MCpbft.cfg: Loading TLC configuration                         I@13:36:07.444
TLC config option CHECK_DEADLOCK true will be ignored             W@13:36:07.499
  > Using inv predicate(s) TypeOK, SafetyInv, CommittedInv from the TLC config I@13:36:07.506
Tuning: search.outputTraces=false                                 I@13:36:07.507
PASS #0: SanyParser                                               I@13:36:07.705
Parsing file /home/codespace/pbft-tlaplus/MCpbft.tla
Parsing file /home/codespace/pbft-tlaplus/pbft.tla
Parsing file /tmp/Integers.tla
Parsing file /tmp/FiniteSets.tla
Parsing file /tmp/__rewire_tlc_in_apalache.tla
Parsing file /tmp/Naturals.tla
Parsing file /tmp/__rewire_sequences_in_apalache.tla
Parsing file /tmp/__apalache_folds.tla
PASS #1: TypeCheckerSnowcat                                       I@13:36:08.254
 > Running Snowcat .::.                                           I@13:36:08.254
 > Your types are purrfect!                                       I@13:36:10.301
 > All expressions are typed                                      I@13:36:10.301
PASS #2: ConfigurationPass                                        I@13:36:10.302
  > MCpbft.cfg: Using SPECIFICATION SpecByz                       I@13:36:10.469
  > MCpbft.cfg: found INVARIANTS: TypeOK, SafetyInv, CommittedInv I@13:36:10.470
  > Set the initialization predicate to Init                      I@13:36:10.473
  > Set the transition predicate to NextByz                       I@13:36:10.474
  > Set the constant initialization predicate to CInit            I@13:36:10.474
  > Set an invariant to TypeOK                                    I@13:36:10.475
  > Set an invariant to SafetyInv                                 I@13:36:10.475
  > Set an invariant to CommittedInv                              I@13:36:10.475
  > Replaced operator Tstamps with OVERRIDE_Tstamps               I@13:36:10.476
  > Replaced operator Views with OVERRIDE_Views                   I@13:36:10.477
PASS #3: DesugarerPass                                            I@13:36:10.482
  > Desugaring...                                                 I@13:36:10.483
PASS #4: InlinePass                                               I@13:36:10.519
Leaving only relevant operators: CInit, CInitPrimed, CommittedInv, Init, InitPrimed, NextByz, SafetyInv, TypeOK I@13:36:10.520
PASS #5: TemporalPass                                             I@13:36:10.652
  > Rewriting temporal operators...                               I@13:36:10.652
  > No temporal property specified, nothing to encode             I@13:36:10.652
PASS #6: InlinePass                                               I@13:36:10.652
Leaving only relevant operators: CInit, CInitPrimed, CommittedInv, Init, InitPrimed, NextByz, SafetyInv, TypeOK I@13:36:10.653
PASS #7: PrimingPass                                              I@13:36:10.676
  > Introducing CInitPrimed for CInit'                            I@13:36:10.678
  > Introducing InitPrimed for Init'                              I@13:36:10.679
PASS #8: VCGen                                                    I@13:36:10.679
  > Producing verification conditions from the invariant TypeOK   I@13:36:10.680
  > VCGen produced 6 verification condition(s)                    I@13:36:10.686
  > Producing verification conditions from the invariant SafetyInv I@13:36:10.688
  > VCGen produced 2 verification condition(s)                    I@13:36:10.688
  > Producing verification conditions from the invariant CommittedInv I@13:36:10.688
  > VCGen produced 1 verification condition(s)                    I@13:36:10.689
PASS #9: PreprocessingPass                                        I@13:36:10.690
  > Before preprocessing: unique renaming                         I@13:36:10.690
 > Applying standard transformations:                             I@13:36:10.695
  > PrimePropagation                                              I@13:36:10.695
  > Desugarer                                                     I@13:36:10.707
  > UniqueRenamer                                                 I@13:36:10.715
  > Normalizer                                                    I@13:36:10.726
  > Keramelizer                                                   I@13:36:10.739
  > After preprocessing: UniqueRenamer                            I@13:36:10.765
PASS #10: TransitionFinderPass                                    I@13:36:10.792
  > Found 1 initializing transitions                              I@13:36:10.835
  > Found 18 transitions                                          I@13:36:10.854
  > Found constant initializer CInit                              I@13:36:10.854
  > Applying unique renaming                                      I@13:36:10.856
PASS #11: OptimizationPass                                        I@13:36:10.870
 > Applying optimizations:                                        I@13:36:10.875
  > ConstSimplifier                                               I@13:36:10.876
  > ExprOptimizer                                                 I@13:36:10.905
  > SetMembershipSimplifier                                       I@13:36:10.928
  > ConstSimplifier                                               I@13:36:10.934
PASS #12: AnalysisPass                                            I@13:36:10.964
 > Marking skolemizable existentials and sets to be expanded...   I@13:36:10.966
  > Skolemization                                                 I@13:36:10.966
  > Expansion                                                     I@13:36:10.968
  > Remove unused let-in defs                                     I@13:36:10.978
 > Running analyzers...                                           I@13:36:10.986
  > Introduced expression grades                                  I@13:36:10.994
PASS #13: BoundedChecker                                          I@13:36:10.994
State 0: Checking 9 state invariants                              I@13:36:11.343
The set $C$825 is expanded, producing O(2^48) constraints. This may slow down the solver. W@13:36:11.633
<unknown>: rewriter error: Attempted to expand a powerset of size 2^48 E@13:36:11.653
at.forsyte.apalache.infra.AdaptedException: <unknown>: rewriter error: Attempted to expand a powerset of size 2^48
        at at.forsyte.apalache.infra.passes.PassChainExecutor$.run(PassChainExecutor.scala:39)
        at at.forsyte.apalache.tla.tooling.opt.CheckCmd.run(CheckCmd.scala:129)
        at at.forsyte.apalache.tla.Tool$.runCommand(Tool.scala:138)
        at at.forsyte.apalache.tla.Tool$.run(Tool.scala:118)
        at at.forsyte.apalache.tla.Tool$.main(Tool.scala:40)
        at at.forsyte.apalache.tla.Tool.main(Tool.scala)
Please report an issue at [https://github.com/informalsystems/apalache/issues]: at.forsyte.apalache.infra.AdaptedException: <unknown>: rewriter error: Attempted to expand a powerset of size 2^48
A bug report template has been generated at [/home/codespace/pbft-tlaplus/_apalache-out/MCpbft.tla/2024-07-29T13-36-07_17752118606435554856/BugReport.md].
If you choose to use it, please complete the template with a description of the expected behavior and impact.
It took me 0 days  0 hours  0 min  4 sec                          I@13:36:11.660
Total time: 4.235 sec                                             I@13:36:11.660
EXITCODE: ERROR (255)