experimental results from benjamin

experimental results from benjamin

open ../archs/exec_C[E]
open ../models/c11_txn[E] as M
open ../models/tsc[E] as N

module c11_tdrf[E]

pred p[X:Exec_C] {
  withoutinit[X]

  M/consistent[none->none, X]
  M/racefree[none->none, X]

  not (N/consistent[none->none,X])

  // all transactions are atomic
  no (X.stxn - X.atxn)

  // avoid non-SC atomic operations
  no (X.A - X.SC)

  X.EV = E
}

run p for 1 Exec, 7 E // benjamin: no soln found in 4297s

open ../archs/exec_C[E]
open ../models/c11_txn[E] as M
open ../models/tsc[E] as N

module c11_tdrf[E]

pred p[X:Exec_C] {
  withoutinit[X]

  M/consistent[none->none, X]
  M/racefree[none->none, X]

  not (N/consistent[none->none,X])

  // all transactions are atomic
  no (X.stxn - X.atxn)

  // avoid non-SC atomic operations
  no (X.A - X.SC)

  X.EV = E
}

run p for 1 Exec, 7 E // started on benjamin 1448 on fri 3 nov


Add solutions from Wednesday's tutorials

// This tutorial models a certain kind of state machine in Alloy

// A state machine is a set of states.
// Each state q has a successor relation.
//     q.successors is the set of possible next states following state q

sig State {
	successors: set State
}

// There is exactly one initial state

one sig Initial extends State { }

// There is a set of final states
// Each final state has an empty set of successors

some sig Final extends State { } { no successors }

// The kind of state machine we are modelling has two other kinds of state:
// yellow states and black states.
// By using sig declarations in Alloy these sets are disjoint by default.
// We add an axiom (a "fact") asserting that every state is initial, final, yellow or black

sig Yellow extends State { }
sig Black extends State { }
fact { State = Initial + Final + Yellow + Black }

// The 0-arity predicate nontrivModel below expresses that the model is "nontrivial" in the
// sense that black, yellow and final states all exist.

pred nontrivModel { #Final > 0 && #Black > 0 && #Yellow > 0 }

// Uncomment the run command below to check to see if the predicate can be satisfied in scope 1
run nontrivModel for 5

// *** EXERCISE 1 ***
// (a) Find the smallest  scope in which nontrivModel is satisfiable
// (b) Look at the model generated by clicking on Instance
//	To improve the display of the model click on Theme
//	Click on sig Black in the left-hand menu and colour Black states black
//	Similarly colour Yellow states yellow, the initial state green and final states red
//	Click on successors and delete the label from the text box in the top left corner
//	If there is a funny $nontrivModel relation displayed click on that and set "show as arcs" to off
//	Click on Apply and then Close
// The model should now display nicely
// (c)  Look at further models by clicking on Next
//	Also run nontrivModel again in larger scope (not too large) to generate larger models

// *** EXERCISE 2 ***
// Say that a state is deadlocked if it has no successors.
// The sig declaration for Final requires final states to be deadlocked
// Add an axiom stating that only Final states can deadlock
// (You may find it useful to use a comprehension term { q: A | P }
//   which defines the subset of those q in set A that satisfy property P)
// For a good reference on the logic of Alloy look at the slides for Session 1 of:
//    http://alloy.mit.edu/alloy/tutorials/day-course/

fact { all q: State - Final | some q.successors }

// After this, and all subsequent exercises involving the addition of new facts run nontrivModel
// in suitable scope and use the Next button to again explore the range of models available

// *** EXERCISE 3 ***
// Add an axiom stating that every state is reachable from the initial state

fact { State = Initial.*successors }

// *** EXERCISE 4 ***
// Black nodes are intended to represent error states.
// When an execution reaches a black node it has to be corrected by eventually
// resetting the system by returning it to the Initial node.
// Add an axiom stating that the initial node is reachable from every black node

fact { all q: Black | Initial in q.^successors }

//*** EXERCISE 5 ***
// Yellow states are intended to represent non-error intermediate states that
// may be encountered en-route to arriving at a final state
// Add an axiom stating that every yellow state has a path to a final state

fact { all q: Yellow | some q': Final | q' in q.^successors }

// *** EXERCISE 6 ***
// In this exercise we use the "assert" command to state a property that we
// hope follows from the axioms.
// The property is that every state has a path to a final state
// complete the assert command below by filling in the property
// between the curly braces.

assert  finishable { all q: State | some q': Final | q' in q.*successors }

// Uncomment and modify the check command below to check finishable in a sufficiently large scope to
// be confident whether or not the property is true.

check finishable for 5

// If the property is not true then can you fix the model to make it true?

// *** EXERCISE 7 ***
// There is one further property we want to axiomatize.
// We want to force the system to reset after a Black state.
// This can be achieved by requiring that
// every path to a final state from a black state goes through the initial state.
// Add this as an axiom.
// (Hint, you might need to use set operators to define a derived relation.)

fact { no Black.^(successors :> (State - Initial)) & Final }

// Additional property: no final state is the successor of an initial state

fact { not Initial in successors.Final }

// This tutorial models a certain kind of state machine in Alloy

// A state machine is a set of states.
// Each state q has a successor relation.
//     q.successors is the set of possible next states following state q

sig State {
	successors: set State
}

// There is exactly one initial state

one sig Initial extends State { }

// There is a set of final states
// Each final state has an empty set of successors

sig Final extends State { } { no successors }

// The kind of state machine we are modelling has two other kinds of state:
// yellow states and black states.
// By using sig declarations in Alloy these sets are disjoint by default.
// We add an axiom (a "fact") asserting that every state is initial, final, yellow or black

sig Yellow extends State { }
sig Black extends State { }
fact { State = Initial + Final + Yellow + Black }

// The 0-arity predicate nontrivModel below expresses that the model is "nontrivial" in the
// sense that black, yellow and final states all exist.

pred nontrivModel { #Final > 0 && #Black > 0 && #Yellow > 0 }

// Uncomment the run command below to check to see if the predicate can be satisfied in scope 1
// run nontrivModel for 1

// *** EXERCISE 1 ***
// (a) Find the smallest  scope in which nontrivModel is satisfiable
// (b) Look at the model generated by clicking on Instance
//	To improve the display of the model click on Theme
//	Click on sig Black in the left-hand menu and colour Black states black
//	Similarly colour Yellow states yellow, the initial state green and final states red
//	Click on successors and delete the label from the text box in the top left corner
//	If there is a funny $nontrivModel relation displayed click on that and set "show as arcs" to off
//	Click on Apply and then Close
// The model should now display nicely
// (c)  Look at further models by clicking on Next
//	Also run nontrivModel again in larger scope (not too large) to generate larger models

// *** EXERCISE 2 ***
// Say that a state is deadlocked if it has no successors.
// The sig declaration for Final requires final states to be deadlocked
// Add an axiom stating that only Final states can deadlock
// (You may find it useful to use a comprehension term { q: A | P }
//   which defines the subset of those q in set A that satisfy property P)
// For a good reference on the logic of Alloy look at the slides for Session 1 of:
//    http://alloy.mit.edu/alloy/tutorials/day-course/

// After this, and all subsequent exercises involving the addition of new facts run nontrivModel
// in suitable scope and use the Next button to again explore the range of models available

// *** EXERCISE 3 ***
// Add an axiom stating that every state is reachable from the initial state

// *** EXERCISE 4 ***
// Black nodes are intended to represent error states.
// When an execution reaches a black node it has to be corrected by eventually
// resetting the system by returning it to the Initial node.
// Add an axiom stating that the initial node is reachable from every black node

//*** EXERCISE 5 ***
// Yellow states are intended to represent non-error intermediate states that
// may be encountered en-route to arriving at a final state
// Add an axiom stating that every yellow state has a path to a final state

// *** EXERCISE 6 ***
// In this exercise we use the "assert" command to state a property that we
// hope follows from the axioms.
// The property is that every state has a path to a final state
// complete the assert command below by filling in the property
// between the curly braces.

assert  finishable { }

// Uncomment and modify the check command below to check finishable in a sufficiently large scope to
// be confident whether or not the property is true.

// check finishable for 1

// If the property is not true then can you fix the model to make it true?

// *** EXERCISE 7 ***
// There is one further property we want to axiomatize.
// We want to force the system to reset after a Black state.
// This can be achieved by requiring that
// every path to a final state from a black state goes through the initial state.
// Add this as an axiom.
// (Hint, you might need to use set operators to define a derived relation.)


remove blackHeadIn*

remove blackHeadIn*

open util/ordering[Col] as cols
open util/ordering[Row] as rows

abstract sig Region {
	index: Int
}
sig Col extends Region {
  cell: Row -> Color
}{
	index >= 0
	index <= 9
}
sig Row extends Region {}{
	index >= 0
	index <= 9
}

fact {
	all r: Col - last {
		add[r.index, 1] = r.next.index
	}
	all r: Row - last {
		add[r.index, 1] = r.next.index
	}
}

enum Color { Black, White }

fact {
  all c: Col, r: Row | one cell [c, r]
}

-- both Row and Col
pred prev_is_white(c: Col, r: Row, prev: Region->Region) {
	// トリック: prevがCol->ColでもRowに使ってよい
	// なぜなら空集合が返るのでin Whiteが成立するから
	cell[prev[c], r] + cell[c, prev[r]] in White
}

pred no_prev(c: Col, r: Row, prev: Region->Region) {
	// トリック: nextがCol->ColでもRowに使ってよい
	// なぜなら空集合が返るのでnoが成立するから
	no prev[c] and no prev[r]
}

// c, rがブロックの先頭であるかどうか
pred is_black_head(c: Col, r: Row, prev: Region->Region) {
	// 最初のRowであるか、または前のRowのセルが白い
  no_prev[c, r, prev] or prev_is_white[c, r, prev]
	// このセルは黒い
  cell[c, r] in Black
}
fun range(start, end: Region, next: Region -> Region): Region{
	start.*next - end.^next
}

fun get_block_end(start: Region, size: Int): Region{
	plus[start.index, minus[size, 1]][index]
}

fun headsInRow (r: Row): set Col {
  { c: Col | is_black_head[c, r, cols/prev]}
}

// Col cの中の、ブロックの頭であるRowの集合
fun headsInCol (c: Col): set Row {
  { r: Row | is_black_head[c, r, rows/prev]}
}

fact noOtherHeadsInRow {
  no c: Col, r: Row {
		c not in headsInRow[r] and is_black_head[c, r, cols/prev]
	}
}
fact noOtherHeadsInCol {
  no c: Col, r: Row {
		r not in headsInCol[c] and is_black_head[c, r, rows/prev]
	}
}

-- about rows or cols

pred headsSeqInRow (r: Row, s: seq Col) {
  s.elems = headsInRow[r]
  all i: s.butlast.inds | lt [s[i], s[plus[i, 1]]]
}
pred headsSeqInCol (c: Col, s: seq Row) {
	// sの要素はブロック先頭の集合と同一
  s.elems = headsInCol[c]
	// sは単調増加
  all i: s.butlast.inds | lt [s[i], s[plus[i, 1]]]
}

fun Int2Row (i: Int): Row {
	index.i & Row
}

pred rowHint (j: Int, sizes: seq Int) {
  let r = Int2Row[j] | some cs: seq Col {
    #sizes = #cs
    // csは黒ブロックの先頭の位置のソートされたシークエンス
    headsSeqInRow [r, cs]
    all i: sizes.inds {
      // cs[i]をstart, startの位置にsize[i]を足して1を引いた位置にあるColをendと呼ぶ
      let start = cs [i], end = Col & get_block_end[start, sizes[i]] {

        // endが存在する
        some end
        // startからendまで全部黒
        all c: range[start, end, cols/next] | cell [c, r] in Black
        // endの次がないか、または白
        no end.next or cell [end.next, r] in White
      }
    }
  }
}

-- about cols

fun Int2Col (i: Int): Col {
	index.i & Col
}

pred colHint (j: Int, sizes: seq Int) {
  let c = Int2Col[j] | some rs: seq Row {
    #sizes = #rs
    headsSeqInCol [c, rs]
    all i: sizes.inds {
      let start = rs [i], end = Row & get_block_end[start, sizes[i]] {
      	some end
      	all r: range[start, end, rows/next] | cell [c, r] in Black
      	no end.next or cell [c, end.next] in White
    	}
		}
  }
}
-- riddle from http://homepage1.nifty.com/sabo10/rulelog/illust.html
solve: run {
  rowHint [0, 0 -> 3]
  rowHint [1, 0 -> 2 + 1 -> 2]
  rowHint [2, 0 -> 1 + 1 -> 1 + 2 -> 1]
  rowHint [3, 0 -> 3 + 1 -> 3]
  rowHint [4, 0 -> 5]
  rowHint [5, 0 -> 7]
  rowHint [6, 0 -> 7]
  rowHint [7, 0 -> 7]
  rowHint [8, 0 -> 7]
  rowHint [9, 0 -> 5]

  colHint [0, 0 -> 4]
  colHint [1, 0 -> 6]
  colHint [2, 0 -> 7]
  colHint [3, 0 -> 9]
  colHint [4, 0 -> 2 + 1 -> 7]
  colHint [5, 0 -> 1 + 1 -> 6]
  colHint [6, 0 -> 2 + 1 -> 4]
  colHint [7, 0 -> 3]
  colHint [8, 0 -> 1]
  colHint [9, 0 -> 2]
} for 10 but 5 Int

open util/ordering[Col] as cols
open util/ordering[Row] as rows

abstract sig Region {
	index: Int
}
sig Col extends Region {
  cell: Row -> Color
}{
	index >= 0
	index <= 9
}
sig Row extends Region {}{
	index >= 0
	index <= 9
}

fact {
	all r: Col - last {
		add[r.index, 1] = r.next.index
	}
	all r: Row - last {
		add[r.index, 1] = r.next.index
	}
}

enum Color { Black, White }

fact {
  all c: Col, r: Row | one cell [c, r]
}

-- both Row and Col
pred prev_is_white(c: Col, r: Row, prev: Region->Region) {
	// トリック: prevがCol->ColでもRowに使ってよい
	// なぜなら空集合が返るのでin Whiteが成立するから
	cell[prev[c], r] + cell[c, prev[r]] in White
}

pred no_prev(c: Col, r: Row, prev: Region->Region) {
	// トリック: nextがCol->ColでもRowに使ってよい
	// なぜなら空集合が返るのでnoが成立するから
	no prev[c] and no prev[r]
}

// c, rがブロックの先頭であるかどうか
pred is_black_head(c: Col, r: Row, prev: Region->Region) {
	// 最初のRowであるか、または前のRowのセルが白い
  no_prev[c, r, prev] or prev_is_white[c, r, prev]
	// このセルは黒い
  cell[c, r] in Black
}
fun range(start, end: Region, next: Region -> Region): Region{
	start.*next - end.^next
}

fun get_block_end(start: Region, size: Int): Region{
	plus[start.index, minus[size, 1]][index]
}

-- about rows

fun headsInRow (r: Row): set Col {
  { c: Col | blackHeadInRow[c, r] }
}

fact noOtherHeadsInRow {
  no c: Col, r: Row | c not in headsInRow[r] and blackHeadInRow[c, r]
}

pred headsSeqInRow (r: Row, s: seq Col) {
  s.elems = headsInRow[r]
  all i: s.butlast.inds | lt [s[i], s[plus[i, 1]]]
}

fun Int2Row (i: Int): Row {
	index.i & Row
}

pred rowHint (j: Int, sizes: seq Int) {
  let r = Int2Row[j] | some cs: seq Col {
    #sizes = #cs
    // csは黒ブロックの先頭の位置のソートされたシークエンス
    headsSeqInRow [r, cs]
    all i: sizes.inds {
      // cs[i]をstart, startの位置にsize[i]を足して1を引いた位置にあるColをendと呼ぶ
      let start = cs [i], end = Col & get_block_end[start, sizes[i]] {

        // endが存在する
        some end
        // startからendまで全部黒
        all c: range[start, end, cols/next] | cell [c, r] in Black
        // endの次がないか、または白
        no end.next or cell [end.next, r] in White
      }
    }
  }
}

pred blackHeadInCol (c: Col, r: Row) {
	is_black_head[c, r, rows/prev]
}
pred blackHeadInRow (c: Col, r: Row) {
	is_black_head[c, r, cols/prev]
}

-- about cols
// Col cの中の、ブロックの頭であるRowの集合
fun headsInCol (c: Col): set Row {
  { r: Row | blackHeadInCol[c, r] }
}

fact noOtherHeadsInCol {
  no c: Col, r: Row | r not in headsInCol[c] and blackHeadInCol[c, r]
}

pred headsSeqInCol (c: Col, s: seq Row) {
	// sの要素はブロック先頭の集合と同一
  s.elems = headsInCol[c]
	// sは単調増加
  all i: s.butlast.inds | lt [s[i], s[plus[i, 1]]]
}

fun Int2Col (i: Int): Col {
	index.i & Col
}

pred colHint (j: Int, sizes: seq Int) {
  let c = Int2Col[j] | some rs: seq Row {
    #sizes = #rs
    headsSeqInCol [c, rs]
    all i: sizes.inds {
      let start = rs [i], end = Row & get_block_end[start, sizes[i]] {
      	some end
      	all r: range[start, end, rows/next] | cell [c, r] in Black
      	no end.next or cell [c, end.next] in White
    	}
		}
  }
}
-- riddle from http://homepage1.nifty.com/sabo10/rulelog/illust.html
solve: run {
  rowHint [0, 0 -> 3]
  rowHint [1, 0 -> 2 + 1 -> 2]
  rowHint [2, 0 -> 1 + 1 -> 1 + 2 -> 1]
  rowHint [3, 0 -> 3 + 1 -> 3]
  rowHint [4, 0 -> 5]
  rowHint [5, 0 -> 7]
  rowHint [6, 0 -> 7]
  rowHint [7, 0 -> 7]
  rowHint [8, 0 -> 7]
  rowHint [9, 0 -> 5]

  colHint [0, 0 -> 4]
  colHint [1, 0 -> 6]
  colHint [2, 0 -> 7]
  colHint [3, 0 -> 9]
  colHint [4, 0 -> 2 + 1 -> 7]
  colHint [5, 0 -> 1 + 1 -> 6]
  colHint [6, 0 -> 2 + 1 -> 4]
  colHint [7, 0 -> 3]
  colHint [8, 0 -> 1]
  colHint [9, 0 -> 2]
} for 10 but 5 Int


tidied up template

tidied up template

/****************************************************/
/* Inclusion checking code.                         */
/* Template: ./alloy/checkTemplate.als              */
/****************************************************/

pred histIncl() {
  all dom, dom' : set Action,
      kind, kind' : Action -> Kind,
      gloc, gloc' : Action -> Glob,
      lloc1, lloc1' : Intern -> Thr,
      lloc2, lloc2' : Intern -> Thr,
      callmap, retmap : Thr -> Val,
      wv, rv : Action -> Val,
      sb, sb' : Action -> Action,
      hb, mo, rf, guar, deny : Action -> Action
    when {
      // Optimisation definition
      optPred[dom, dom', kind, kind', gloc, gloc', lloc1, lloc1', lloc2, lloc2', ^sb, ^sb']

      // Enforce validity for LHS
      valid[dom, kind, gloc, lloc1, lloc2, callmap, retmap, wv, rv, ^hb, ^sb, mo, rf]

      // Interfaces are the same
      Extern & dom = Extern & dom'
      Extern <: gloc = Extern <: gloc'
      Extern <: kind = Extern <: kind'

      // Nonatomics disabled
      // DRF[dom, kind, loc, wv, rv, ^hb, ^sb, mo, rf]

      guar = getguar[dom, ^hb]
      deny = getdeny[dom, kind, gloc, wv, rv, ^hb, ^sb, ^mo, rf]

      // Cut irrelevant executions.
      cutR[dom, kind, gloc, wv, rv, ^hb, ^sb, ^mo, rf]
      cutW[dom, kind, gloc, wv, rv, ^hb, ^sb, ^mo, rf]
      cutF[dom, kind, ^hb, ^sb, ^mo, rf]

      // Sanity conditions
      Action = dom + dom'

      // Make the relations nicer to display
      is_core[hb]
      is_core[sb]
      is_core[sb']
  } |
  some wv', rv' : Action -> Val,
       hb', mo', rf' : dom' -> dom' | {
    (Extern <: wv) = (Extern <: wv')
    (Extern <: rv) = (Extern <: rv')

    // Enforce validity for RHS
    valid[dom', kind', gloc', lloc1', lloc2', callmap, retmap, wv', rv', ^hb', ^sb', ^mo', rf']

    // Nonatomics disabled
    //DRF[dom', kind', loc', wv', rv', ^hb', sb', mo', rf']

    // Histories are related
    getguar[dom', ^hb'] in guar
    getdeny[dom', kind', gloc', wv', rv', ^hb', ^sb', mo', rf'] in deny
  }
}

/****************************************************/
/* Debugging code.                                  */
/* Generate LHS / RHS of the inclusion.             */
/****************************************************/

pred histInclRun() {
  some dom, dom' : set Action,
      kind, kind' : Action -> Kind,
      gloc, gloc' : Action -> Glob,
      lloc1, lloc1' : Intern -> Thr,
      lloc2, lloc2' : Intern -> Thr,
      callmap, retmap : Thr -> Val,
      wv, rv : Action -> Val,
      sb, sb' : Action -> Action,
      hb, mo, rf, guar, deny : Action -> Action,
      wv', rv' : Action -> Val,
      hb', mo', rf' : dom' -> dom' | {

    // Optimisation definition
    optPred[dom, dom', kind, kind', gloc, gloc', lloc1, lloc1', lloc2, lloc2', ^sb, ^sb']

    // Enforce validity for LHS
    valid[dom, kind, gloc, lloc1, lloc2, callmap, retmap, wv, rv, ^hb, ^sb, mo, rf]

    // Interfaces are the same
    Extern & dom = Extern & dom'
    Extern <: gloc = Extern <: gloc'
    Extern <: kind = Extern <: kind'

    // Nonatomics disabled
    // DRF[dom, kind, loc, wv, rv, ^hb, ^sb, mo, rf]

    guar = getguar[dom, ^hb]
    deny = getdeny[dom, kind, gloc, wv, rv, ^hb, ^sb, ^mo, rf]

    // Cut irrelevant executions.
    cutR[dom, kind, gloc, wv, rv, ^hb, ^sb, ^mo, rf]
    cutW[dom, kind, gloc, wv, rv, ^hb, ^sb, ^mo, rf]
    cutF[dom, kind, ^hb, ^sb, ^mo, rf]

    // Sanity conditions
    Action = dom + dom'

    // Make the relations nicer to display
    is_core[hb]
    is_core[sb]
    is_core[sb']

    (Extern <: wv) = (Extern <: wv')
    (Extern <: rv) = (Extern <: rv')

    // Enforce validity for RHS
    valid[dom', kind', gloc', lloc1', lloc2', callmap, retmap, wv', rv', ^hb', ^sb', ^mo', rf']

    // Nonatomics disabled
    //DRF[dom', kind', loc', wv', rv', ^hb', sb', mo', rf']

    // Histories are related
    getguar[dom', ^hb'] in guar
    getdeny[dom', kind', gloc', wv', rv', ^hb', ^sb', mo', rf'] in deny

  }
}

// pred histInclRunLHS() {
//   some dom : set Action,
//        kind : Action -> Kind,
//        gloc, lloc1, lloc2 : Action -> Loc,
//        callmap, retmap : Thr -> Val,
//        wv, rv : Action -> Val,
//        sb : Action -> Action,
//        hb, mo, rf, guar, deny : Action -> Action | {
//       // Optimisation definition
//       some x: Glob, l : Thr | {
//       optLHS[dom - Extern, kind, gloc, lloc1, lloc2, ^sb, x, l]
//       preexecWF[dom, kind, gloc, lloc1, lloc2, sb]
//
//       valid[dom, kind, gloc, lloc1, lloc2, callmap, retmap, wv, rv, ^hb, ^sb, mo, rf]
//
//       // Nonatomics disabled
//       // DRF[dom, kind, loc, wv, rv, ^hb, ^sb, mo, rf]
//
//       guar = getguar[dom, ^hb]
//       deny = getdeny[dom, kind, gloc, wv, rv, ^hb, ^sb, mo, rf]
//
//       // Cut irrelevant executions.
//       cutR[dom, kind, gloc, wv, rv, ^hb, ^sb, mo, rf]
//       cutW[dom, kind, gloc, wv, rv, ^hb, ^sb, mo, rf]
//
//       // Sanity conditions
//       Action = dom
//       Loc = dom.(lloc1 + lloc2 + gloc)
//
//       // Make the relations nicer to display
//       is_core[hb]
//       is_core[sb]
//     }
//   }
// }
//

//run { histInclRun } for 4
//run { histInclRunLHS } for 6 but exactly 1 Call, 1 Ret

/****************************************************/
/* Inclusion checking code.                         */
/* Template: ./alloy/checkTemplate.als              */
/****************************************************/

pred histIncl() {
  all dom, dom' : set Action,
      kind, kind' : Action -> Kind,
      gloc, gloc' : Action -> Glob,
      lloc1, lloc1' : Intern -> Thr,
      lloc2, lloc2' : Intern -> Thr,
      callmap, retmap : Thr -> Val,
      wv, rv : Action -> Val,
      sb, sb' : Action -> Action,
      hb, mo, rf, guar, deny : Action -> Action
    when {
      // Optimisation definition
      optPred[dom, dom', kind, kind', gloc, gloc', lloc1, lloc1', lloc2, lloc2', ^sb, ^sb']

      // Enforce validity for LHS
      valid[dom, kind, gloc, lloc1, lloc2, callmap, retmap, wv, rv, ^hb, ^sb, mo, rf]

      // Interfaces are the same
      Extern & dom = Extern & dom'
      Extern <: gloc = Extern <: gloc'
      Extern <: kind = Extern <: kind'

      // Nonatomics disabled
      // DRF[dom, kind, loc, wv, rv, ^hb, ^sb, mo, rf]

      guar = getguar[dom, ^hb]
      deny = getdeny[dom, kind, gloc, wv, rv, ^hb, ^sb, ^mo, rf]

      // Cut irrelevant executions.
      cutR[dom, kind, gloc, wv, rv, ^hb, ^sb, ^mo, rf]
      cutW[dom, kind, gloc, wv, rv, ^hb, ^sb, ^mo, rf]
      cutF[dom, kind, ^hb, ^sb, ^mo, rf]

      // Sanity conditions
      Action = dom + dom'

      // Make the relations nicer to display
      is_core[hb]
      is_core[sb]
      is_core[sb']
  } |
  some wv', rv' : Action -> Val,
       mo', rf', hb' : dom' -> dom' | {
   // TODO: fix this for non-atomics
   //let //sc' = mo' & (kind.FenceSC -> kind.FenceSC),
   //    //hb' = ^(sb' + rf' + sc'),
   //    wv' = wvi + (Extern <: wv),
   //    rv' = rvi + (Extern <: rv) |
  {
      (Extern <: wv) = (Extern <: wv')
      (Extern <: rv) = (Extern <: rv')

      // Enforce validity for RHS
      valid[dom', kind', gloc', lloc1', lloc2', callmap, retmap, wv', rv', ^hb', ^sb', ^mo', rf']

      // Atomics disabled
      //DRF[dom', kind', loc', wv', rv', ^hb', sb', mo', rf']

      // Histories are related
      getguar[dom', ^hb'] in guar
      getdeny[dom', kind', gloc', wv', rv', ^hb', ^sb', mo', rf'] in deny
    }
  }
}

// check { histIncl } for 7

/****************************************************/
/* Debugging code.                                  */
/* Generate LHS / RHS of the inclusion.             */
/****************************************************/

// pred histInclRun() {
//   some dom, dom' : set Action, kind, kind' : Action -> Kind,
//        gloc, gloc', lloc, lloc' : Action -> Loc,
//        callmap, retmap : Thr -> Val,
//        wv, rv : Action -> Val,
//        sb, sb' : Action -> Action,
//        hb, mo, rf, guar, deny : Action -> Action,
//        wvi, rvi : Intern -> Val,
//        mo', rf' : Action -> Action | {
//    let hb' = ^(sb' + rf'),
//        wv' = wvi + (Extern <: wv),
//        rv' = rvi + (Extern <: rv) | {
//       // Optimisation definition
//       optPred[dom, dom', kind, kind', gloc, gloc', lloc, lloc', ^sb, ^sb']
//
//       valid[dom, kind, gloc, lloc, callmap, retmap, wv, rv, ^hb, ^sb, mo, rf]
//
//       // Nonatomics disabled
//       // DRF[dom, kind, loc, wv, rv, ^hb, ^sb, mo, rf]
//
//       guar = getguar[dom, ^hb]
//       deny = getdeny[dom, kind, gloc, wv, rv, ^hb, ^sb, mo, rf]
//
//       // Cut irrelevant executions.
//       cutR[dom, kind, gloc, wv, rv, ^hb, ^sb, mo, rf]
//       cutW[dom, kind, gloc, wv, rv, ^hb, ^sb, mo, rf]
//
//       // Sanity conditions
//       Action = dom + dom'
//       Loc = dom.(lloc + gloc) + dom'.(lloc' + gloc')
//
//       // Make the relations nicer to display
//       is_core[hb]
//       is_core[sb]
//       is_core[sb']
//
//       // one Call & (dom + dom')
//       // one Ret & (dom + dom')
//
//       // // Pre-execution structure
//       // preexecWF[dom, kind, gloc, lloc, sb]
//       // preexecWF[dom', kind', gloc', lloc', ^sb']
//
//       Extern & dom = Extern & dom'
//       Extern <: gloc = Extern <: gloc'
//       Extern <: kind = Extern <: kind'
//       valid[dom', kind', gloc', lloc', callmap, retmap, wv', rv', ^hb', ^sb', mo', rf']
//
//       // Atomics disabled
//       //DRF[dom', kind', loc', wv', rv', ^hb', ^sb', mo', rf']
//
//       getguar[dom', ^hb'] in guar
//       getdeny[dom', kind', gloc', wv', rv', ^hb', ^sb', mo', rf'] in deny
//     }
//   }
// }

// pred histInclRunLHS() {
//   some dom : set Action,
//        kind : Action -> Kind,
//        gloc, lloc1, lloc2 : Action -> Loc,
//        callmap, retmap : Thr -> Val,
//        wv, rv : Action -> Val,
//        sb : Action -> Action,
//        hb, mo, rf, guar, deny : Action -> Action | {
//       // Optimisation definition
//       some x: Glob, l : Thr | {
//       optLHS[dom - Extern, kind, gloc, lloc1, lloc2, ^sb, x, l]
//       preexecWF[dom, kind, gloc, lloc1, lloc2, sb]
//
//       valid[dom, kind, gloc, lloc1, lloc2, callmap, retmap, wv, rv, ^hb, ^sb, mo, rf]
//
//       // Nonatomics disabled
//       // DRF[dom, kind, loc, wv, rv, ^hb, ^sb, mo, rf]
//
//       guar = getguar[dom, ^hb]
//       deny = getdeny[dom, kind, gloc, wv, rv, ^hb, ^sb, mo, rf]
//
//       // Cut irrelevant executions.
//       cutR[dom, kind, gloc, wv, rv, ^hb, ^sb, mo, rf]
//       cutW[dom, kind, gloc, wv, rv, ^hb, ^sb, mo, rf]
//
//       // Sanity conditions
//       Action = dom
//       Loc = dom.(lloc1 + lloc2 + gloc)
//
//       // Make the relations nicer to display
//       is_core[hb]
//       is_core[sb]
//     }
//   }
// }
//

//run { histInclRun } for 4
//run { histInclRunLHS } for 6 but exactly 1 Call, 1 Ret


multiple drum tracks, one less constrained

error: pathspec 'ableton/yyn-piano' did not match any file(s) known to git
error: pathspec 'Project/yyn-piano.als' did not match any file(s) known to git


Rename a fact

Rename a fact

remote: Support for password authentication was removed on August 13, 2021.
remote: Please see https://docs.github.com/en/get-started/getting-started-with-git/about-remote-repositories#cloning-with-https-urls for information on currently recommended modes of authentication.
fatal: Authentication failed for 'https://github.com/pirapira/pos.git/'


Add nodes

Add nodes


brass section for stomp notes in piano mode


Updated track

Updated track

ableton/Fault Trace Project/Fault Trace.als

error: pathspec 'ableton/Fault' did not match any file(s) known to git
error: pathspec 'Trace' did not match any file(s) known to git
error: pathspec 'Project/Fault' did not match any file(s) known to git
error: pathspec 'Trace.als' did not match any file(s) known to git


First pass of deep house track

First pass of deep house track


Added 9 channels

Added 9 channels


Updated track

Updated track


Finalised song

Finalised song


Updated test project

Updated test project

error: pathspec 'Other/test' did not match any file(s) known to git
error: pathspec 'Project/test.als' did not match any file(s) known to git


DBの設計をAlloyで検証した refs #219

DBの設計をAlloyで検証した refs #219

sig Room {
 owener : User
}
sig User {}
sig Message {
 user : User,
 belong : Room
}

sig Member {
 room : Room,
 user : User
}

fact {
 all disj a, b : Member | (no a.room & b.room) or (no a.user & b.user)
}

pred show () {}
run show for 5 but
  exactly 2 Room,
  exactly 3 User,
  exactly 4 Message

error: pathspec 'verification/db.als' did not match any file(s) known to git


view_src and view can point to the same thing, weird


more music work

more music work

error: pathspec 'Music/tharsis' did not match any file(s) known to git
error: pathspec 'Project/tharsis.als' did not match any file(s) known to git


Update live set

Update live set

error: pathspec 'ableton/Poseidon' did not match any file(s) known to git
error: pathspec 'Live' did not match any file(s) known to git
error: pathspec 'Set.als' did not match any file(s) known to git


Final set

Final set

ableton/Poseidon Live Set Project/Poseidon Live Set.als

error: pathspec 'ableton/Poseidon' did not match any file(s) known to git
error: pathspec 'Live' did not match any file(s) known to git
error: pathspec 'Set' did not match any file(s) known to git
error: pathspec 'Project/Poseidon' did not match any file(s) known to git
error: pathspec 'Live' did not match any file(s) known to git
error: pathspec 'Set.als' did not match any file(s) known to git


minor changes

minor changes

error: pathspec 'eu.modelwriter.demonstration.alloyinecore/harun/Alloy/Improved' did not match any file(s) known to git
error: pathspec 'Feature' did not match any file(s) known to git
error: pathspec 'Model/Model_3/feature_model_3.als' did not match any file(s) known to git


Finished track

Finished track


more work on boot track

more work on boot track

error: pathspec 'Music/boot' did not match any file(s) known to git
error: pathspec 'Project/boot.als' did not match any file(s) known to git


Updated track

Updated track

fatal: unable to access 'https://github.com/struct78/fault-trace.git/': The requested URL returned error: 403


Updated test file for filters

Updated test file for filters


Introduced slash condition 1

Introduced slash condition 1


Reflect the fix in the protocol

Reflect the fix in the protocol


Minor modifications on Feature Model modulo Requirements Theory

fatal: unable to access 'https://github.com/ModelWriter/Demonstrations.git/': The requested URL returned error: 403


Started modelling the votes consensus

Started modelling the votes consensus

http://ethereumresearch.trydiscourse.com/t/casper-ffg-with-one-message-type-and-simpler-fork-choice-rule/103


Updated track

Updated track


Formulating slashing condition [ii]

Formulating slashing condition [ii]


If the sender of the commit message is slashed, prepare is not necessary


Made track more bassy

Made track more bassy


Adjusted limiter value

Adjusted limiter value


Make the slashing condition exact

Make the slashing condition exact

Fixes #1


Test file works!

Test file works!

3 instruments, all with individual loopers


"final" mix for day 1

"final" mix for day 1


Added more instruments

Added more instruments


Finalised March track

Finalised March track


There can be only one geneis

There can be only one geneis


Updated Ableton project

Updated Ableton project


Updated Ableton Live Set

Updated Ableton Live Set


Finalised track

Finalised track


Slashing condition iv can be weakened a bit


sound mix on on-site speakers

sound mix on on-site speakers


Modelled double vote

Modelled double vote


Updated song

Updated song


Updated track

Updated track


Upgraded to Ableton 9

Upgraded to Ableton 9


scene

scene

error: pathspec 'jibberwocky' did not match any file(s) known to git
error: pathspec 'Project/jibberwocky.als' did not match any file(s) known to git


Now, cannot be own prev

Now, cannot be own prev


Classify nodes into sane nodes and slashed nodes


Fix the Alloy conditions to reflect the accountable safety


Seeing another issue.  [ii], has different ancestors


sound tweaks from second day

sound tweaks from second day


midi control of vocoder on drums

midi control of vocoder on drums


- Added initial attempt at modeling Brehon Contract in alloy

fatal: unable to access 'https://github.com/prashantpawar/DisputeResolution.git/': The requested URL returned error: 403


Adidionado especificacao Alloy - WIP

Adidionado especificacao Alloy - WIP

remote: Support for password authentication was removed on August 13, 2021.
remote: Please see https://docs.github.com/en/get-started/getting-started-with-git/about-remote-repositories#cloning-with-https-urls for information on currently recommended modes of authentication.
fatal: Authentication failed for 'https://github.com/monkshorin/projeto-es.git/'


updating spec

updating spec


This is how to force prepare, now I see v_prev pointing to itself


Request that h_prev and v_prev are consistent


modifications to ableton

modifications to ableton


First working Alloy model

First working Alloy model


Pair of Hash and View should be a signature


Made view_pred acyclic

Made view_pred acyclic


Declaring bunch of signatures

Declaring bunch of signatures


Removed version 8 set

Removed version 8 set


Found a problem with hash and view and prev


Maybe got the safety case1

Maybe got the safety case1


Saw a counterexample, adding a condition in [ii]


Made a mistake, now a nice picture

Made a mistake, now a nice picture


Updated song

Updated song


I guess the slashing condition [ii] has been done

fatal: unable to access 'https://github.com/pirapira/pos.git/': The requested URL returned error: 403


Implemented all slashing conditions

Implemented all slashing conditions


Updated ableton song

Updated ableton song


Finalised track

Finalised track


Updated live set

Updated live set


more work on tharsis

more work on tharsis


Now trying a sane committer

Now trying a sane committer


Tweaks to EQ

Tweaks to EQ


Updated track

Updated track


Update ableton test file

Update ableton test file