The internet discovers TLA+. Now what?
A blog post explores how AI agents can bridge the gap between TLA+ formal models, modern proof systems like Verus, and real code implementations.
summary is enough The post offers a high-level look at combining TLA+ and AI-generated proofs, but the core ideas are easily grasped without reading the full text.
summary
Triggered by a viral tweet showing AI generating TLA+ and Lean models, this post explores the future of formal verification combined with LLMs. It explains the basics of TLA+, outlines its limitations regarding the spec-to-implementation gap, and teases Reasonable's upcoming pipeline for translating TLA+ specs into machine-checked Verus proofs. Commenters share mixed reactions, ranging from excitement over using LLMs to find state-machine bugs to skepticism about end-to-end formal verification.
key points
- TLA+ models transition systems and temporal properties to check safety and liveness, but it checks models rather than actual code implementations.
- Modern proof systems like Verus and Lean allow specifications and proofs to live alongside real code, but writing them manually is tedious.
- Reasonable built an agentic pipeline that transpiles 16,000+ TLA+ specs into over 3,000 machine-checked Verus proofs.
who should read it
Software engineers and distributed systems developers interested in formal verification, TLA+, and AI-assisted software correctness.
discussion mixed
consensus
Commenters widely agree that using AI combined with TLA+ or Quint is a surprisingly effective way to find tricky distributed systems bugs, even for developers who aren't formal methods experts.
pushback
Skeptics question whether end-to-end formal verification via AI is practical, noting that closing the gap between abstract models and real implementation code remains exceptionally difficult.
I would encourage everyone to try this on some self-contained, state-machine like problems, if they have them. At my company, some experts were optimizing our clustering and failover logic by adding a bit more state (and hence complexity). Despite me not being an expert in that area, I was able to find and prevent a catastrophic bug by pointing Opus armed with TLA+ at the problem. It was a bug that was not possible in the prior implementation of the system and no one thought to write unit tests for the sequence of steps that triggers it, so initially went unnoticed. The only thing that caught …
It provides a concrete, real-world success story of using an LLM with TLA+ to catch a catastrophic bug that unit tests missed.
Generated by an LLM from the article and thread. Check the sources before relying on it.