tla — TLA+ model checked by TLC — openbash

A business or a system written as a TLA+ module, checked by TLC: every state its steps can reach, each rule that breaks with its shortest trace, and the rules that hold.

tla

tla is a command on the openbash shell, reachable over HTTP, SSH and MCP with one key. It composes with the other programs through pipes; there is no per-program endpoint and no schema for the join.

tla check /tmp/Shop.tla

TLC 1.7.4 · Shop.tla · 1.8 s
1,204 states generated, 388 distinct, depth 9

BROKEN  ShipsAfterQC — 14 states break it. Shortest trace, 5 steps:
   1  Initial predicate
        /\ order = [o1 |-> "paid"]
   ...

holds   OneContainerPerPallet

help

tla: a TLA+ model checked by TLC.

USAGE
  tla check Name.tla [OTHER.tla ... | Name.cfg] [--json]

CHECK
  Runs SANY and TLC on the module Name.tla and prints what TLC found: parsed
  or not (in SANY's own words where not), the states it reached, each
  invariant that breaks with how many states break it and its shortest
  trace, and each invariant that holds. TLC searches breadth first, so the
  trace it gives is the shortest way to the broken rule.

  The config is Name.cfg given beside the module, else a `\* Name.cfg:`
  comment block at the end of the module, one config line per comment line:

    \* Shop.cfg:
    \* INIT Init
    \* NEXT Next
    \* INVARIANTS ShipsAfterQC OneContainerPerPallet

  Other modules the main one EXTENDS go beside it; the standard modules
  (Naturals, Sequences, FiniteSets, TLC) need not. Write the module under
  /tmp with a heredoc first. --json prints the checker's answer as it came.

  Exit 0 when every invariant holds; 1 when one breaks or the model does not
  run. A model is checked while you wait: TLC stops at 90 seconds, so keep
  the state space small (a few customers, a few pallets).

  It is the same check a workbook holding a TLA+ module gets after every
  edit, and the module /try/business-plan writes for a business runs here
  as it is.

COSTS
  Free.