System/SystemMC规格实例化层级错误求助：Def解析错误排查

Let's break down your problem and walk through how to fix those level-related parse errors.

First, let's clarify what's causing these issues: TLA+ enforces strict rules around operator "levels"—this refers to how an operator interacts with other expressions (e.g., whether it takes parameters, returns values vs. other operators). Your errors stem from a mismatch between the level of the MessyAction(_) constant declared in System and the operator you're substituting for it in SystemMC.

Step 1: Verify the Original Constant's Level #

In your System module, you declared CONSTANT MessyAction(_)—this tells TLA+ that MessyAction is a level-1 operator: it takes a single level-0 parameter (a value like a number, string, or finite set) and returns a level-0 value. If your original declaration was missing the (_) (making it a level-0 constant instead), that's a common source of mismatches.

Step 2: Fix the Substituted Operator in SystemMC #

The errors you're seeing mean the operator you defined in SystemMC to replace MessyAction either has the wrong level, or you're using it incorrectly in the instantiation. Here's how to fix it with concrete examples:

Example Correct System Module #

First, ensure your System module makes the operator level explicit:

------------------------------ MODULE System ------------------------------
CONSTANT MessyAction(_)  \* Explicit level-1 operator: takes 0-level param, returns 0-level value
VARIABLES state, outgoingMsgs

Next == 
  \* Example usage of MessyAction (adjust to match your actual spec)
  \E msg \in outgoingMsgs:
    state' = MessyAction(state) /\ outgoingMsgs' = outgoingMsgs \ {msg}
=============================================================================

Example Correct SystemMC Module #

Then, define a level-1 operator that matches the original constant's signature, and instantiate System correctly:

------------------------------ MODULE SystemMC ------------------------------
EXTENDS System, TLC

\* Define a finite, model-checkable version of MessyAction
\* Ensure this is a level-1 operator (takes 0-level param, returns 0-level value)
LOCAL DEFINE MessyAction(x) == 
  \* Example: Hash x to a finite range (adjust to your actual hash logic)
  IF x = "init" THEN "hashed_init"
  ELSE IF x = "processing" THEN "hashed_processing"
  ELSE "default_hash"  \* Keep all outputs finite for TLC

\* Instantiate System with the correct operator substitution
INSTANCE System WITH MessyAction <- MessyAction

\* Configure TLC for model checking
SPECIFICATION Spec
INVARIANT StateInvariant  \* Replace with your actual invariant
=============================================================================

Why Your Original Errors Occurred #

1. "Parse error: The level of the expression or operator substituted for 'Def' must be at most 0":
   This happens when you try to substitute a level-0 constant (no parameters) with a level-1+ operator (with parameters), or vice versa. For example, if you declared MessyAction as a plain CONSTANT MessyAction (level 0) in System, but tried to replace it with a parameterized operator in SystemMC, you'd hit this error.

2. "Level error in instantiation...":
   This is a broader mismatch between the level of the original constant and the substituted operator. For instance, if your System MessyAction was a level-1 operator, but your SystemMC implementation returned another operator (making it level 2), TLC would reject the instantiation.

Key Tips for Model-Checkable Hash Functions #

• Keep outputs finite: TLC can only handle finite state spaces, so your hash function must map inputs to a finite set of values (avoid infinite domains like unbounded integers).
• Avoid higher-order operators: Stick to level-1 operators (single parameter, returns a value) for model checking—TLC has limited support for higher-order logic.
• Use LOCAL for definitions: This prevents your model-checking-specific operators from leaking into other modules.

内容的提问来源于stack exchange，提问作者user2852699