Question

我很难证明涉及记录的细化映射。以下是TLA specs@github的简化说明（请注意，该帖子也在tlaplus-googlegroup中，但尚未回复。）：

SimpleVoting.tla:

它为每个参与者维护一个maxBal，这是一个自然数。在IncreaseMaxBal(p, b)中，maxBal[p]增加到一个较大的值b。

---------------------------- MODULE SimpleVoting ----------------------------
EXTENDS Naturals
-----------------------------------------------------------------------------
CONSTANT Participant

VARIABLE maxBal

TypeOK == maxBal \in [Participant -> Nat]
-----------------------------------------------------------------------------
Init == maxBal = [p \in Participant |-> 0]

IncreaseMaxBal(p, b) ==
  /\ maxBal[p] < b
  /\ maxBal' = [maxBal EXCEPT ![p] = b]
-----------------------------------------------------------------------------
Next == \E p \in Participant, b \in Nat : IncreaseMaxBal(p, b)

Spec == Init /\ [][Next]_maxBal
=============================================================================

Record.tla:

它维护2D“数组” state，其中state[p][q]是q的状态，p的状态，而State是一条记录： State == [maxBal : Nat, maxVBal : Nat]。

在Prepare(p, b)中，state[p][p].maxBal增加到一个较大的值b。

------------------------------- MODULE Record -------------------------------
EXTENDS Naturals, TLAPS
---------------------------------------------------------------------------
CONSTANTS Participant  \* the set of partipants

VARIABLES state \* state[p][q]: the state of q \in Participant from the view of p \in Participant

State == [maxBal: Nat, maxVBal: Nat]

TypeOK == state \in [Participant -> [Participant -> State]]
---------------------------------------------------------------------------
InitState == [maxBal |-> 0, maxVBal |-> 0]

Init == state = [p \in Participant |-> [q \in Participant |-> InitState]] 

Prepare(p, b) == 
    /\ state[p][p].maxBal < b
    /\ state' = [state EXCEPT ![p][p].maxBal = b]
---------------------------------------------------------------------------
Next == \E p \in Participant, b \in Nat : Prepare(p, b)

Spec == Init /\ [][Next]_state
---------------------------------------------------------------------------

直观地讲，Record将maxBal[p]的{{1}}保持为SimpleVoting。因此，我想证明state[p][p].maxBal在以下优化映射下优化Record：

SimpleVoting

但是，以下证明中的步骤maxBal == [p \in Participant |-> state[p][p].maxBal] SV == INSTANCE SimpleVoting失败。

<3>2

THEOREM Spec => SV!Spec <1>1. Init => SV!Init BY DEF Init, SV!Init, maxBal, InitState <1>2. [Next]_state => [SV!Next]_maxBal <2>1. UNCHANGED state => UNCHANGED maxBal BY DEF maxBal <2>2. Next => SV!Next <3> SUFFICES ASSUME NEW p \in Participant, NEW b \in Nat, Prepare(p, b) PROVE SV!IncreaseMaxBal(p, b) BY DEF Next, SV!Next <3>1. maxBal[p] < b BY DEF Prepare, maxBal <3>2. maxBal' = [maxBal EXCEPT ![p] = b] \* failed here! BY DEF Prepare, maxBal <3>3. QED BY <3>1, <3>2 DEF SV!IncreaseMaxBal <2>3. QED BY <2>1, <2>2 <1>3. QED处的义务如下。假设中的<3>2是否与结论state' = [state EXCEPT ![p] = ...]相同？缺什么？我的证明有什么问题？

[p_1 \in Participant |-> state[p_1][p_1].maxBal]' ...

如何完成涉及记录的细化映射的TLAPS证明？

0 个答案: