Closed lemmy closed 5 years ago
Hi @lemmy! Thanks so much for taking a look at this repo and taking the time to write out all these clarifications. I'm only an amateur TLA+ user, so getting feedback from an expert like yourself is super useful and very much appreciated. I've updated the README to point to this issue, so others know to read through it as well.
Here are my BPaxos specs. BPaxos is actually a family of five protocols: Simple BPaxos, Unsafe BPaxos, Unanimous BPaxos, Deadlock BPaxos, and Majority Commit BPaxos. Note that I only have complete specs for some of them.
A few comments about the "Limitations and Alternatives" section:
For the (finite) model, TLC actually checks the correctness of the specification for the stated safety and liveness properties. For simple algorithms - such as the one below (taken from here) - TLC can even check the complete algorithm, not just a model of it.
If one needs higher assurances for infinite models, TLA+ comes with a proof system to write machine checked proofs. Usually people combine the powers of TLC and TLAPS (see Proving Safety Properties and Using TLC to Check Inductive Invariance).
Infinite executions do not imply that the state space is infinite. By definition a behavior is always an infinite sequence of states (a terminating execution has a suffix of infinite stuttering). TLC can easily check specs that allow infinitely many behaviors:
TLC checks this specification in less than a second. Do not replace {0,1} with Nat though! ;-)
True, even better if the implementation is correct-by-construction. In reality though, even machine checked proofs do not provide absolute confidence. Anyway, engineers are usually happy with less. SPIN for example supports model-driven verification which apparently is good enough for NASA.
In comparison, how long did it take you to find the inductive invariant and write a machine checked proof (compare "Proof assistants are addictive and a huge time sink.")?
By the way, can you share your BPaxos spec to study it as part of our scalability tests?
Also, apalache might in the future scale to larger models.
I'm inclined to argue that this problem is not unique for TLA+. ;-)