This is an interactive, web-based environment for exploring and sharing TLA+ specifications. The motivation is to have a better way to quickly interact with a TLA+ spec and easily share results. For example, having a way to share counterexample traces in a convenient, portable, and repeatable manner.
A live version of the tool is currently hosted here, and below are some example specs to try out:
- Lock server
- Two phase commit (animated)
- Paxos
- Raft (animated)
- EWD998 (animated)
The current version of the tool utilizes the TLA+ tree-sitter grammar for parsing TLA+ specs and implements a TLA+ interpreter/executor on top of this in Javascript. This allows the tool to interpret specs natively in the browser, without relying on an external language server. The Javascript interpreter is likely much slower than TLC, but efficient model checking isn't currently a goal of the tool.
The current tool expects that a specification has defined its initial state predicate and next state relation as Init and Next definitions, respectively. If your specification has these defined under different names, an error will be reported and spec evaluation will fail. Eventually this will be made configurable, but the current tool looks for these hard-coded definitions. Also, there is currently no support for user module imports, so specs are expected to be written in a single module. The interpreter does, however, by default support most operators from the TLA+ standard modules.
You can also see a live demo of the tool and its features in this presentation, which also gives a very high level overview of the tool architecture and implementation details.
