TLA+ language preview

1. A counter's spec and invariant

MODULE banner, VARIABLE, and a THEOREM about the spec

horizon-dark

---- MODULE Counter ----
EXTENDS Naturals

VARIABLE count

TypeOK == count \in Nat

Init == count = 0

(* the next-state relation
   (* count only ever goes up *) *)
Next == count' = count + 1

Spec == Init /\ [][Next]_count

THEOREM Spec => [](TypeOK)
====

atom-one-dark

---- MODULE Counter ----
EXTENDS Naturals

VARIABLE count

TypeOK == count \in Nat

Init == count = 0

(* the next-state relation
   (* count only ever goes up *) *)
Next == count' = count + 1

Spec == Init /\ [][Next]_count

THEOREM Spec => [](TypeOK)
====

github-dark

---- MODULE Counter ----
EXTENDS Naturals

VARIABLE count

TypeOK == count \in Nat

Init == count = 0

(* the next-state relation
   (* count only ever goes up *) *)
Next == count' = count + 1

Spec == Init /\ [][Next]_count

THEOREM Spec => [](TypeOK)
====

dracula

---- MODULE Counter ----
EXTENDS Naturals

VARIABLE count

TypeOK == count \in Nat

Init == count = 0

(* the next-state relation
   (* count only ever goes up *) *)
Next == count' = count + 1

Spec == Init /\ [][Next]_count

THEOREM Spec => [](TypeOK)
====

nord

---- MODULE Counter ----
EXTENDS Naturals

VARIABLE count

TypeOK == count \in Nat

Init == count = 0

(* the next-state relation
   (* count only ever goes up *) *)
Next == count' = count + 1

Spec == Init /\ [][Next]_count

THEOREM Spec => [](TypeOK)
====

github

---- MODULE Counter ----
EXTENDS Naturals

VARIABLE count

TypeOK == count \in Nat

Init == count = 0

(* the next-state relation
   (* count only ever goes up *) *)
Next == count' = count + 1

Spec == Init /\ [][Next]_count

THEOREM Spec => [](TypeOK)
====

2. Two-phase commit

CONSTANT, a state machine over a set of resource managers

horizon-dark

---- MODULE TwoPhaseCommit ----
EXTENDS Naturals, FiniteSets

CONSTANT RM

VARIABLE rmState

Init == rmState = [rm \in RM |-> "working"]

canCommit == \A rm \in RM : rmState[rm] \in {"prepared", "committed"}

Prepare(rm) ==
  /\ rmState[rm] = "working"
  /\ rmState' = [rmState EXCEPT ![rm] = "prepared"]

Commit(rm) ==
  /\ canCommit
  /\ rmState' = [rmState EXCEPT ![rm] = "committed"]

Abort(rm) ==
  /\ rmState[rm] # "committed"
  /\ rmState' = [rmState EXCEPT ![rm] = "aborted"]
====

atom-one-dark

---- MODULE TwoPhaseCommit ----
EXTENDS Naturals, FiniteSets

CONSTANT RM

VARIABLE rmState

Init == rmState = [rm \in RM |-> "working"]

canCommit == \A rm \in RM : rmState[rm] \in {"prepared", "committed"}

Prepare(rm) ==
  /\ rmState[rm] = "working"
  /\ rmState' = [rmState EXCEPT ![rm] = "prepared"]

Commit(rm) ==
  /\ canCommit
  /\ rmState' = [rmState EXCEPT ![rm] = "committed"]

Abort(rm) ==
  /\ rmState[rm] # "committed"
  /\ rmState' = [rmState EXCEPT ![rm] = "aborted"]
====

github-dark

---- MODULE TwoPhaseCommit ----
EXTENDS Naturals, FiniteSets

CONSTANT RM

VARIABLE rmState

Init == rmState = [rm \in RM |-> "working"]

canCommit == \A rm \in RM : rmState[rm] \in {"prepared", "committed"}

Prepare(rm) ==
  /\ rmState[rm] = "working"
  /\ rmState' = [rmState EXCEPT ![rm] = "prepared"]

Commit(rm) ==
  /\ canCommit
  /\ rmState' = [rmState EXCEPT ![rm] = "committed"]

Abort(rm) ==
  /\ rmState[rm] # "committed"
  /\ rmState' = [rmState EXCEPT ![rm] = "aborted"]
====

dracula

---- MODULE TwoPhaseCommit ----
EXTENDS Naturals, FiniteSets

CONSTANT RM

VARIABLE rmState

Init == rmState = [rm \in RM |-> "working"]

canCommit == \A rm \in RM : rmState[rm] \in {"prepared", "committed"}

Prepare(rm) ==
  /\ rmState[rm] = "working"
  /\ rmState' = [rmState EXCEPT ![rm] = "prepared"]

Commit(rm) ==
  /\ canCommit
  /\ rmState' = [rmState EXCEPT ![rm] = "committed"]

Abort(rm) ==
  /\ rmState[rm] # "committed"
  /\ rmState' = [rmState EXCEPT ![rm] = "aborted"]
====

nord

---- MODULE TwoPhaseCommit ----
EXTENDS Naturals, FiniteSets

CONSTANT RM

VARIABLE rmState

Init == rmState = [rm \in RM |-> "working"]

canCommit == \A rm \in RM : rmState[rm] \in {"prepared", "committed"}

Prepare(rm) ==
  /\ rmState[rm] = "working"
  /\ rmState' = [rmState EXCEPT ![rm] = "prepared"]

Commit(rm) ==
  /\ canCommit
  /\ rmState' = [rmState EXCEPT ![rm] = "committed"]

Abort(rm) ==
  /\ rmState[rm] # "committed"
  /\ rmState' = [rmState EXCEPT ![rm] = "aborted"]
====

github

---- MODULE TwoPhaseCommit ----
EXTENDS Naturals, FiniteSets

CONSTANT RM

VARIABLE rmState

Init == rmState = [rm \in RM |-> "working"]

canCommit == \A rm \in RM : rmState[rm] \in {"prepared", "committed"}

Prepare(rm) ==
  /\ rmState[rm] = "working"
  /\ rmState' = [rmState EXCEPT ![rm] = "prepared"]

Commit(rm) ==
  /\ canCommit
  /\ rmState' = [rmState EXCEPT ![rm] = "committed"]

Abort(rm) ==
  /\ rmState[rm] # "committed"
  /\ rmState' = [rmState EXCEPT ![rm] = "aborted"]
====

3. Mutual exclusion with unicode operators

∀, ∈, and → in a safety property

horizon-dark

---- MODULE MutexSafety ----
EXTENDS Naturals

CONSTANT Procs

VARIABLE pc

MutualExclusion ==
  ∀ p1, p2 ∈ Procs :
    (p1 # p2) → ¬(pc[p1] = "critical" ∧ pc[p2] = "critical")

THEOREM Spec => [](MutualExclusion)
====

atom-one-dark

---- MODULE MutexSafety ----
EXTENDS Naturals

CONSTANT Procs

VARIABLE pc

MutualExclusion ==
  ∀ p1, p2 ∈ Procs :
    (p1 # p2) → ¬(pc[p1] = "critical" ∧ pc[p2] = "critical")

THEOREM Spec => [](MutualExclusion)
====

github-dark

---- MODULE MutexSafety ----
EXTENDS Naturals

CONSTANT Procs

VARIABLE pc

MutualExclusion ==
  ∀ p1, p2 ∈ Procs :
    (p1 # p2) → ¬(pc[p1] = "critical" ∧ pc[p2] = "critical")

THEOREM Spec => [](MutualExclusion)
====

dracula

---- MODULE MutexSafety ----
EXTENDS Naturals

CONSTANT Procs

VARIABLE pc

MutualExclusion ==
  ∀ p1, p2 ∈ Procs :
    (p1 # p2) → ¬(pc[p1] = "critical" ∧ pc[p2] = "critical")

THEOREM Spec => [](MutualExclusion)
====

nord

---- MODULE MutexSafety ----
EXTENDS Naturals

CONSTANT Procs

VARIABLE pc

MutualExclusion ==
  ∀ p1, p2 ∈ Procs :
    (p1 # p2) → ¬(pc[p1] = "critical" ∧ pc[p2] = "critical")

THEOREM Spec => [](MutualExclusion)
====

github

---- MODULE MutexSafety ----
EXTENDS Naturals

CONSTANT Procs

VARIABLE pc

MutualExclusion ==
  ∀ p1, p2 ∈ Procs :
    (p1 # p2) → ¬(pc[p1] = "critical" ∧ pc[p2] = "critical")

THEOREM Spec => [](MutualExclusion)
====