ease-lab / hermes Goto Github PK

In the HermesRMWs TLA+ specification,HRSemanticsRMW is stated as an invariant. This appears not to hold when model checking with TLC, even on a small model.

Here's a simple repro script that can be run from a clean directory:

#!/bin/sh
git clone https://github.com/ease-lab/Hermes.git
cd Hermes/tla
wget https://github.com/tlaplus/tlaplus/releases/download/v1.7.3/tla2tools.jar

echo "INIT HRInit" >> HermesRMWs.cfg
echo "NEXT HRNext" >>  HermesRMWs.cfg
echo "CONSTANTS" >>  HermesRMWs.cfg
echo "H_NODES = {33,44,55}" >> HermesRMWs.cfg
echo "H_MAX_VERSION = 2" >> HermesRMWs.cfg
echo "INVARIANT HRSemanticsRMW" >> HermesRMWs.cfg

java -cp tla2tools.jar tlc2.TLC -workers 4 HermesRMWs

TLC produces a 12-step counterexample (hermes_cex.txt) in a few seconds.

I don't have a deep enough understanding of the underlying protocol to be clear on whether this is a bug in the algorithm or in the specification, but wanted to document this for reference, and see if you have any thoughts on this.