Proving liveness with TLA

The TLA Toolbox now has support for proving liveness properties (i.e. that something will eventually happen). I try it out on the Xen vchan protocol. Working on a liveness proof with the TLA+ Toolbox. Table of Contents Background A simple channel specification Specification in terms of actions Invariants Temporal logic Proving temporal claims with TLAPS Generalising Hiding definitions Proving…