TLA+ Refinement Proofs FAQs

Question 1

How are stuttering steps handled in refinement?

Accepted Answer

Stuttering steps occur when the concrete spec takes an action that doesn't change the mapped abstract state. TLA+ handles this naturally as its semantics allow for 'stuttering', meaning the abstract spec sees these as steps where nothing changed.

Question 2

How do I check refinement using the TLC model checker?

Accepted Answer

You typically use the INSTANCE keyword to map concrete variables to abstract ones, then verify that the concrete specification implies the abstract specification's properties (Spec => A!Spec).

Question 3

What is a refinement mapping?

Accepted Answer

A refinement mapping is a set of definitions that explains exactly how the variables and state in a concrete specification correspond to the variables in an abstract specification.

Question 4

When should I use TLAPS instead of TLC for refinement?

Accepted Answer

Use TLC for automated verification of finite state spaces and finding counterexamples quickly. Use TLAPS (TLA+ Proof System) for complete mathematical proofs, especially when dealing with infinite state spaces or critical safety-certified systems.

Question 5

What is refinement in TLA+?

Accepted Answer

Refinement is the formal process of proving that a more detailed (concrete) specification correctly implements a higher-level (abstract) specification by showing every behavior of the concrete spec is allowed by the abstract spec.

TLA+ Refinement Proofs

TLA+ Refinement Proofs

Key Features

Use Cases

Key Features

Use Cases