8
8
(* *)
9
9
(* * We fix the number of ballots *)
10
10
(* *)
11
- (* * We add the necessary type annotation on variables *)
11
+ (* * We add the necessary type annotations on variables *)
12
12
(* *)
13
13
(* * We rewrite SafeAt and ShowsSafeAt to avoid ranges of integers with *)
14
14
(* non-constant bounds (which `^Apalache^' does not support). *)
15
15
(* *)
16
- (* Ideally, we would have instantiated Voting.tla, made the appropriate *)
17
- (* substitutions, and reused the rest. However, the presence of TLAPS proofs in *)
18
- (* Consensus.tla and Voting.tla seem to make `^Apalache^' fail. *)
19
- (* *)
20
- (* We also give an inductive invariant that proves the Safety property. On a *)
21
- (* desktop computer bought in 2022, `^Apalache^' takes 1 minute and 45 seconds to *)
22
- (* check that the invariant is inductive when there are for 3 values, 3 processes, *)
23
- (* and 4 ballots. Instructions to run `^Apalache^' appear at the end of the *)
16
+ (* We also give an inductive invariant that proves the consistency property. On a *)
17
+ (* desktop computer from 2022, `^Apalache^' takes 1 minute and 45 seconds to check *)
18
+ (* that the invariant is inductive when there are 3 values, 3 processes, and 4 *)
19
+ (* ballots. Instructions to run `^Apalache^' appear at the end of the *)
24
20
(* specification. *)
25
21
(********************************************************************************** *)
26
22
@@ -34,7 +30,7 @@ Quorum == {
34
30
{ "A1_OF_ACCEPTOR" , "A3_OF_ACCEPTOR" } ,
35
31
{ "A2_OF_ACCEPTOR" , "A3_OF_ACCEPTOR" } }
36
32
37
- MaxBal == 3 \* 1m45s with MaxBal=3
33
+ MaxBal == 2
38
34
Ballot == 0 .. MaxBal \* NOTE: has to be finite for `^Apalache^' because it is used as the domain of a function
39
35
40
36
VARIABLES
0 commit comments