Specifying Systems: The TLA+ Language and Tools for Hardware and Software Engineers

382 Pages·2002·2.481 MB·

by  Leslie Lamport

Specifying Systems
First Printing
Version of 18 June 2002

Specifying Systems
The TLA+ Language and Tools for
Hardware and Software Engineers
Leslie Lamport
Microsoft Research
Boston San Francisco New York Toronto Montreal
(cid:15) (cid:15) (cid:15) (cid:15)
London Munich Paris Madrid
(cid:15) (cid:15) (cid:15)
Capetown Sydney Tokyo Singapore Mexico City
(cid:15) (cid:15) (cid:15) (cid:15)
Manyofthedesignations usedbymanufacturersandsellersto distinguishtheir
productsareclaimedastrademarks. Wherethosedesignationsappearinthisbook,
andAddison-Wesleywasawareofatrademarkclaim,thedesignations havebeen
printedwithinitialcapitallettersorinallcapitals.
Theauthorandpublisherhavetakencareinthepreparation ofthisbook,butmakeno
expressedorimpliedwarrantyofanykindandassumenoresponsibilityforerrorsor
omissions. Noliabilityisassumedforincidentalorconsequential damagesinconnection
withorarisingoutofthe useoftheinformationorprogramscontained herein.
Thepublishero(cid:11)ersdiscountsonthisbookwhenorderedinquantityforspecialsales.
Formoreinformation,please contact:
U.S.CorporateandGovernmentSales
[phone]
[email protected]
Forsalesoutsideofthe U.S.,pleasecontact:
International Sales
[phone]
[email protected]
VisitAddison-WesleyontheWeb: www.awprofessional.com
Library of Congress Cataloging-in-Publication Data
Lamport,Leslie
Specifying systems : the TLA+ language and tools for hardware and software
engineers/LeslieLamport.
p. cm.
Includesbibliographicalreferencesandindex.
ISBN0-321-14306-X(alk. paper)
1. Systemdesign. 2. Computersystems{Speci(cid:12)cations. 3. Logic,symbolic
andmathematical. I.Title.
QA76.9.S88L352003 2002074369
0
004.2 1--dc21
Copyright(cid:13)c 2003 byPearsonEducation, Inc
Allrightsreserved. Nopartofthispublicationmaybereproduced,stored inare-
trievalsystem,ortransmitted,inanyform,orbyanymeans,electronic,mechanical,
photocopying,recording,orotherwise,withoutthepriorconsent ofthepublisher.
PrintedintheUnitedStatesofAmerica. PublishedsimultaneouslyinCanada.
Forinformationonobtaining permissionforuseofmaterialfromthiswork,please
submitawrittenrequest to:
PearsonEducation,Inc.
RightsandContractsDepartment
75ArlingtonStreet,Suite300
Boston,MA02116
Fax: [phone]
ISBN0-321-14306-X
Textprintedonrecycledpaper
12345678910-MA-0605040302
Firstprinting, July 2002
To Ellen

This whole book is but a draught|nay, but the draught of a draught.
Herman Melville

Contents
List of Figures and Tables xv
Acknowledgments xvii
Introduction 1
Part I Getting Started 5
1 A Little Simple Math 9
1.1 Propositional Logic . . . . . . . . . . . . . . . . . . . . . . . . . . 9
1.2 Sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
1.3 Predicate Logic . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
1.4 Formulas and Language . . . . . . . . . . . . . . . . . . . . . . . 14
2 Specifying a Simple Clock 15
2.1 Behaviors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
2.2 An Hour Clock . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
2.3 A Closer Look at the Speci(cid:12)cation . . . . . . . . . . . . . . . . . 18
+
2.4 The Speci(cid:12)cation in TLA . . . . . . . . . . . . . . . . . . . . . . 19
2.5 An Alternative Speci(cid:12)cation . . . . . . . . . . . . . . . . . . . . . 21
3 An Asynchronous Interface 23
3.1 The First Speci(cid:12)cation . . . . . . . . . . . . . . . . . . . . . . . . 24
3.2 Another Speci(cid:12)cation . . . . . . . . . . . . . . . . . . . . . . . . 28
3.3 Types: A Reminder . . . . . . . . . . . . . . . . . . . . . . . . . 30
3.4 De(cid:12)nitions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
3.5 Comments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
4 A FIFO 35
4.1 The Inner Speci(cid:12)cation . . . . . . . . . . . . . . . . . . . . . . . 35
4.2 Instantiation Examined . . . . . . . . . . . . . . . . . . . . . . . 37
ix
x CONTENTS
4.2.1 Instantiation Is Substitution. . . . . . . . . . . . . . . . . 37
4.2.2 Parametrized Instantiation . . . . . . . . . . . . . . . . . 39
4.2.3 Implicit Substitutions . . . . . . . . . . . . . . . . . . . . 40
4.2.4 Instantiation Without Renaming . . . . . . . . . . . . . . 40
4.3 Hiding the Queue . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
4.4 A Bounded FIFO . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
4.5 What We’re Specifying . . . . . . . . . . . . . . . . . . . . . . . . 43
5 A Caching Memory 45
5.1 The Memory Interface . . . . . . . . . . . . . . . . . . . . . . . . 45
5.2 Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
5.3 A Linearizable Memory . . . . . . . . . . . . . . . . . . . . . . . 51
5.4 Tuples as Functions . . . . . . . . . . . . . . . . . . . . . . . . . 53
5.5 Recursive Function De(cid:12)nitions . . . . . . . . . . . . . . . . . . . 54
5.6 A Write-Through Cache . . . . . . . . . . . . . . . . . . . . . . . 54
5.7 Invariance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
5.8 ProvingImplementation . . . . . . . . . . . . . . . . . . . . . . . 62
6 Some More Math 65
6.1 Sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
6.2 Silly Expressions . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
6.3 Recursion Revisited . . . . . . . . . . . . . . . . . . . . . . . . . 67
6.4 Functions versus Operators . . . . . . . . . . . . . . . . . . . . . 69
6.5 Using Functions. . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
6.6 Choose. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
7 Writing a Speci(cid:12)cation: Some Advice 75
7.1 Why Specify . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
7.2 What to Specify . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
7.3 The Grain of Atomicity . . . . . . . . . . . . . . . . . . . . . . . 76
7.4 The Data Structures . . . . . . . . . . . . . . . . . . . . . . . . . 78
7.5 Writing the Speci(cid:12)cation . . . . . . . . . . . . . . . . . . . . . . . 79
7.6 Some Further Hints. . . . . . . . . . . . . . . . . . . . . . . . . . 80
7.7 When and How to Specify . . . . . . . . . . . . . . . . . . . . . . 83
Part II More Advanced Topics 85
8 Liveness and Fairness 87
8.1 Temporal Formulas . . . . . . . . . . . . . . . . . . . . . . . . . . 88
8.2 Temporal Tautologies . . . . . . . . . . . . . . . . . . . . . . . . 92
8.3 Temporal Proof Rules . . . . . . . . . . . . . . . . . . . . . . . . 95
8.4 Weak Fairness. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
8.5 The Memory Speci(cid:12)cation . . . . . . . . . . . . . . . . . . . . . . 100