TLA +  Proofs

Abstract

TLA + is a specification language based on standard set theory and temporal logic that has constructs for hierarchical proofs. We describe how to write TLA + proofs and check them with TLAPS, the TLA + Proof System. We use Peterson's mutual exclusion algorithm as a simple example to describe the features of TLAPS and show how it and the Toolbox (an IDE for TLA + ) help users to manage large, complex proofs.1 The TLA + module containing the specification and proof is accessible at the TLAPS Web page [20].2 The figure shows the pretty-printed version of PlusCal code and TLA + formulas. As an example of how they are typed, here is the ascii version of the variables declaration: variables flag = [i \in {0, 1} |-> FALSE], turn = 0;

A Rigorous Correctness Proof for Pastry

“…Transition predicates (also called actions) are first-order formulas that contain unprimed and primed state variables for denoting the values of the variables in the state before and after the transition. Validation of TLA + specifications is mechanized by TLC [9], an explicit-state model checker for finite instances of TLA + specifications, and formal verification by TLAPS, the TLA + Proof System [4]. TLAPS is based on a hierarchical proof language; the user writes a TLA + proof in the form of a hierarchy of proof steps, each of which is interpreted by the proof manager, which generates corresponding proof obligations and passes them to automatic back-end provers, including Zenon, Isabelle/TLA + , and SMT solvers.…”

Proving Determinacy of the PharOS Real-Time Operating System

“…In this work, we formally specify a high-level model of PharOS executions in the specification language TLA + [6] and use tlaps, the TLA + Proof System [4], to formally prove determinacy of our model. Our proof is based on the paperand-pencil proof of [9].…”

“…tlaps [4] is an interactive proof assistant for TLA + . It allows users to develop proofs for lemmas and theorems asserted in a TLA + module, using a hierarchical proof language.…”

Certified Impossibility Results for Byzantine-Tolerant Mobile Robots

“…An attractive way to assess the validity of distributed algorithm is to use tool assisted verification, be it based process algebra [3,18], local computations [25], Event-B [7], COQ [8], HOL [9], Isabelle/HOL [21], or TLA [23,22] that can enjoy an Isabelle back-end for its provers [12]. Surprisingly, only few works consider using mechanized assistance for networks of mobile entities, be it population protocols [13,10] or mobile robots [14,4].…”