APALACHE

A symbolic model checker for TLA+

Apalache translates TLA+ into the logic supported by SMT solvers such as Microsoft Z3. Apalache can check inductive invariants (for fixed or bounded parameters) and check safety of bounded executions (bounded model checking). To see the list of supported TLA+ constructs, check the supported features. In general, Apalache runs under the same assumptions as TLC.

To learn more about TLA+, visit Leslie Lamport's page on TLA+ and his Video course.

Check the releases page for our latest release.

For a stable release, we recommend that you pull the latest docker image with docker pull ghcr.io/informalsystems/apalache:main, use the jar from the most recent release, or checkout the source code from the most recent release tag.

To try the latest cool features, check out the head of the main branch.

For more information on installation options, see the manual.

• Read the Beginner's tutorial.
• Check the material at TLA-Apalache workshop.
• Read the Apalache user manual.
• Consult the (WIP) Idioms for writing better TLA+.
• Consult the (WIP) TLA+ language manual for engineers.

Our current website is served at https://apalache.informal.systems .

The site is hosted by github, and changes can be made through PRs into the gh-pages branch of this repository. See the README.md on that branch for more information.

The user documentation is automatically deployed to the website branch as per the CI configuration.

Our old website is still available at https://forsyte.at/research/apalache/ .

• Join the chat in the Apalache zulip stream.
• Contribute to the development of Apalache.

Want to contribute? Here is a list of issues that could be solved without knowing too much about the internals of Apalache. Solving these issues would improve usability! Please comment in the relevant issue, if you are going to solve it.

• Writing annotations in the JSON format: #804
• Add support for VIEW in the TLC config: #851
• Translate \E x \in STRING: P and \A x \in STRING: P: #844
• Interval analysis for a..b: #446

• Check Light client specs and Model-based testing of the Tendermint light client.

• Check Tendermint specs to see how we use TLA+ and Apalache at Informal to design and specify protocols for the Tendermint blockchain.

• To see more examples, check the standard repository of TLA+ examples.

• Informal Systems Tutorial: TLA+ Basics

• Extended version of the Apalache tutorial. TLA+ tutorial at DISC 2021 (October 2021).

• How TLA+ and Apalache Helped Us to Design the Tendermint Light Client. Interchain Conversations 2020 (December 2020).

• Model-based testing with TLA+ and Apalache. TLA+ Community Event 2020 (October 2020).

• Type inference for TLA+ in Apalache. TLA+ Community Event 2020 (October 2020).

• Formal Spec and Model Checking of the Tendermint Blockchain Synchronization Protocol 2nd Workshop on Formal Methods for Blockchains (July 2020).

• Showing safety of Tendermint Consensus with TLA+ and Apalache. Dev session at Informal Systems (May 2020).

• TLA+ model checking made symbolic OOPSLA 2019 (October 2019).

• Bounded model checking of TLA+ specifications with SMT TLA+ Community Event 2018 (July 2018).

We are collecting apalache benchmarks. See the Apalache performance when checking inductive invariants and running bounded model checking. Versions 0.6.0 and 0.7.2 are a major improvement over version 0.5.2 (the version reported at OOPSLA19).

To read an academic paper about the theory behind Apalache, check our paper at OOPSLA19. Related reports and publications can be found at the Apalache page at TU Wien.

Apalache is developed at Informal Systems.

With additional funding from
.

Past funding from Der Wiener Wissenschafts-, Forschungs- und Technologiefonds.