{"slug": "tlaplus", "name": "TLA+", "category": "other", "category_name": "Other software", "description": "Leslie Lamport's formal specification language for modeling and checking concurrent and distributed systems.", "recommenders": 10, "commenters": 15, "warners": 0, "score": 10.926, "rising": 5.69, "first": "2025-11-02", "latest": "2026-10-31", "why": "HN commenters like TLA+ for describing systems precisely and succinctly and for finding deadlocks, concurrency and state bugs through counterexamples, increasingly with LLMs helping to write the models.", "why_is_quote": false, "has_verdict": true, "sentiment": {"recommend": 12, "neutral": 5, "compare": 0, "warn": 0}, "spark": [1, 2, 0, 0, 0, 0, 1, 0, 1, 0, 5, 2], "listed": true, "loved": ["Precise specification", "Finds subtle bugs"], "caveat": "Spec-code drift", "short_quote": "The times I've used TLA+ in anger have been generally related to lower-level \"communicating state machines\".", "icon": false, "domain": null, "github_repo": null, "official_url": "https://lamport.azurewebsites.net/tla/tla.html", "pricing": "open source", "aliases": ["TLA+"], "verdict": [{"text": "HN commenters like TLA+ for describing systems precisely and succinctly", "cites": [{"id": 797881168, "item_id": 49867573, "url": "https://news.ycombinator.com/item?id=49867573", "by": "pron", "date": "2026-09-27", "stance": "recommend", "quote": "I love TLA+ to describe systems precisely yet succinctly and reason about them.", "excerpt": "I love TLA+ to describe systems precisely yet succinctly and reason about them. But as someone who's been using formal methods to help software development for many years, this whole industry around tools to connect such a wonderful mathematical language and others like it, like Lean, with AI, to the point of hiding the reasoning from people, confuses me. Proving programs correct end-to-end (i.e. code to high-level p", "context": "uses formal methods for many years", "use_case": "formal specification", "switched_from": "", "story": "The internet discovers TLA+. Now what?"}, {"id": 797872208, "item_id": 49867013, "url": "https://news.ycombinator.com/item?id=49867013", "by": "thadt", "date": "2026-09-27", "stance": "recommend", "quote": "TLA is pretty excellent for the job it does.", "excerpt": "TLA is pretty excellent for the job it does. In the past, the general issue with tools like this has been keeping the implementation code in sync with the model. Implementing verification tests from model across to the implementation can be tedious and very time consuming. Now that we have assistants that excel at tedious and time consuming tasks, it\u2019ll be interesting to see if the dominant approach is still using de", "context": "", "use_case": "formal modeling", "switched_from": "", "story": "The internet discovers TLA+. Now what?"}, {"id": 798689488, "item_id": 49918093, "url": "https://news.ycombinator.com/item?id=49918093", "by": "spaintech", "date": "2026-10-01", "stance": "recommend", "quote": "For some critical software we developed, we used TLA+ for high-level formal specification.", "excerpt": "While both TLA+ and ADA/Spark might be necessary, I haven\u2019t noticed much mention of ADA/SPARK here, which kind of surprised me that they are not used in conjunction as frequent as I might have thought. For some critical software we developed, we used TLA+ for high-level formal specification. As mentioned earlier, transitioning the actual implementation to another language can be challenging, especially if partial har", "context": "", "use_case": "formal specification", "switched_from": "", "story": "What TLA+ can and can't check"}]}, {"text": " and for finding deadlocks, concurrency and state bugs through counterexamples,", "cites": [{"id": 740848432, "item_id": 46303027, "url": "https://news.ycombinator.com/item?id=46303027", "by": "tonyarkles", "date": "2025-12-17", "stance": "recommend", "quote": "The times I've used TLA+ in anger have been generally related to lower-level \"communicating state machines\".", "excerpt": "The times I've used TLA+ in anger have been generally related to lower-level \"communicating state machines\". One was a LoRaWAN handshake with the possibility of lost radio packets, another was a slightly-higher-level Bluetooth message exchange between a phone and a device. In the first situation I wanted to ensure that the state machine I'd put together couldn't ever deadlock. There's a fairness constraint you can tu", "context": "", "use_case": "modeling protocols and state machines", "switched_from": "", "story": "TLA+ Modeling Tips"}, {"id": 797851521, "item_id": 49865720, "url": "https://news.ycombinator.com/item?id=49865720", "by": "stevefan1999", "date": "2026-09-27", "stance": "neutral", "quote": "I indirectly use TLA+ through", "excerpt": "I indirectly use TLA+ through https://github.com/quint-co/quint. I added instructions that \"before you implement any feature, please use Quint to model it and make sure no counterexample for the system as a whole, reiterate the design with Quint as well and make sure your documents and implementation follows the formal model and docs\". The result, while takes much longer, is quite magical. A lot of transaction and at", "context": "", "use_case": "formal specification", "switched_from": "", "story": "The internet discovers TLA+. Now what?"}, {"id": 798314288, "item_id": 49894643, "url": "https://news.ycombinator.com/item?id=49894643", "by": "tarasyarema", "date": "2026-09-29", "stance": "recommend", "quote": "I think this pattern is super nice tbh, and it helps a lot on reasoning around the code and implementation", "excerpt": "Hi there! A few weeks ago, Boris posted how formal verification helped fix issues in their codebase (https://x.com/bcherny/status/2102543349102338309) and I definitely wanted to try it out in the swarm codebase. The idea was simple: 1. Go over the codebase and fine most critical parts that could be modelled 2. Pick the first few and try to model them based on main code 3. Find counterexamples 4. Generate failing test", "context": "", "use_case": "formal verification of codebase", "switched_from": "", "story": "TLA+ helped us fix and10 issues in our OSS project"}]}, {"text": " increasingly with LLMs helping to write the models.", "cites": [{"id": 798600656, "item_id": 49912541, "url": "https://news.ycombinator.com/item?id=49912541", "by": "_flux", "date": "2026-09-30", "stance": "recommend", "quote": "These probabilistic guessing machines are pretty great for creating these formal models, e.g. TLA+", "excerpt": "These probabilistic guessing machines are pretty great for creating these formal models, e.g. TLA+, and then guessing if the implementation aligns with the spec.. In fact, it's my go-to tool for constructing soft guardrails for the model, so the design it's going to implement is logically sound. Same as for people: it's easier to make something working when you have a spec that is working. Of course, it still allows ", "context": "", "use_case": "spec and design validation with LLMs", "switched_from": "", "story": "What TLA+ can and can't check"}, {"id": 798314288, "item_id": 49894643, "url": "https://news.ycombinator.com/item?id=49894643", "by": "tarasyarema", "date": "2026-09-29", "stance": "recommend", "quote": "I think this pattern is super nice tbh, and it helps a lot on reasoning around the code and implementation", "excerpt": "Hi there! A few weeks ago, Boris posted how formal verification helped fix issues in their codebase (https://x.com/bcherny/status/2102543349102338309) and I definitely wanted to try it out in the swarm codebase. The idea was simple: 1. Go over the codebase and fine most critical parts that could be modelled 2. Pick the first few and try to model them based on main code 3. Find counterexamples 4. Generate failing test", "context": "", "use_case": "formal verification of codebase", "switched_from": "", "story": "TLA+ helped us fix and10 issues in our OSS project"}, {"id": 797851521, "item_id": 49865720, "url": "https://news.ycombinator.com/item?id=49865720", "by": "stevefan1999", "date": "2026-09-27", "stance": "neutral", "quote": "I indirectly use TLA+ through", "excerpt": "I indirectly use TLA+ through https://github.com/quint-co/quint. I added instructions that \"before you implement any feature, please use Quint to model it and make sure no counterexample for the system as a whole, reiterate the design with Quint as well and make sure your documents and implementation follows the formal model and docs\". The result, while takes much longer, is quite magical. A lot of transaction and at", "context": "", "use_case": "formal specification", "switched_from": "", "story": "The internet discovers TLA+. Now what?"}]}, {"text": " The most common caveat is that keeping the implementation in sync with the model is tedious and hard,", "cites": [{"id": 797872208, "item_id": 49867013, "url": "https://news.ycombinator.com/item?id=49867013", "by": "thadt", "date": "2026-09-27", "stance": "recommend", "quote": "TLA is pretty excellent for the job it does.", "excerpt": "TLA is pretty excellent for the job it does. In the past, the general issue with tools like this has been keeping the implementation code in sync with the model. Implementing verification tests from model across to the implementation can be tedious and very time consuming. Now that we have assistants that excel at tedious and time consuming tasks, it\u2019ll be interesting to see if the dominant approach is still using de", "context": "", "use_case": "formal modeling", "switched_from": "", "story": "The internet discovers TLA+. Now what?"}, {"id": 798689488, "item_id": 49918093, "url": "https://news.ycombinator.com/item?id=49918093", "by": "spaintech", "date": "2026-10-01", "stance": "recommend", "quote": "For some critical software we developed, we used TLA+ for high-level formal specification.", "excerpt": "While both TLA+ and ADA/Spark might be necessary, I haven\u2019t noticed much mention of ADA/SPARK here, which kind of surprised me that they are not used in conjunction as frequent as I might have thought. For some critical software we developed, we used TLA+ for high-level formal specification. As mentioned earlier, transitioning the actual implementation to another language can be challenging, especially if partial har", "context": "", "use_case": "formal specification", "switched_from": "", "story": "What TLA+ can and can't check"}]}, {"text": " and it handles weak-memory semantics poorly.", "cites": [{"id": 798598656, "item_id": 49912416, "url": "https://news.ycombinator.com/item?id=49912416", "by": "singron", "date": "2026-09-30", "stance": "neutral", "quote": "another thing TLA+ isn't great at is modeling atomics and in particular weak-memory semantics", "excerpt": "I love this. This is great to read if you are trying to use TLA+ for something. In a different vein, another thing TLA+ isn't great at is modeling atomics and in particular weak-memory semantics or anything that's not sequentially consistent. If you translate your algorithm to pcal, it will run as if it was sequentially consistent. If you need to model non-sequential-consistency, then that needs to be spelled out wit", "context": "", "use_case": "formal modeling", "switched_from": "", "story": "What TLA+ can and can't check"}]}], "praise": [{"label": "Precise specification", "summary": "Describes systems precisely yet succinctly so you can reason about them before and during implementation.", "quotes": [{"id": 797881168, "item_id": 49867573, "url": "https://news.ycombinator.com/item?id=49867573", "by": "pron", "date": "2026-09-27", "stance": "recommend", "quote": "I love TLA+ to describe systems precisely yet succinctly and reason about them.", "excerpt": "I love TLA+ to describe systems precisely yet succinctly and reason about them. But as someone who's been using formal methods to help software development for many years, this whole industry around tools to connect such a wonderful mathematical language and others like it, like Lean, with AI, to the point of hiding the reasoning from people, confuses me. Proving programs correct end-to-end (i.e. code to high-level p", "context": "uses formal methods for many years", "use_case": "formal specification", "switched_from": "", "story": "The internet discovers TLA+. Now what?"}, {"id": 797872208, "item_id": 49867013, "url": "https://news.ycombinator.com/item?id=49867013", "by": "thadt", "date": "2026-09-27", "stance": "recommend", "quote": "TLA is pretty excellent for the job it does.", "excerpt": "TLA is pretty excellent for the job it does. In the past, the general issue with tools like this has been keeping the implementation code in sync with the model. Implementing verification tests from model across to the implementation can be tedious and very time consuming. Now that we have assistants that excel at tedious and time consuming tasks, it\u2019ll be interesting to see if the dominant approach is still using de", "context": "", "use_case": "formal modeling", "switched_from": "", "story": "The internet discovers TLA+. Now what?"}, {"id": 798689488, "item_id": 49918093, "url": "https://news.ycombinator.com/item?id=49918093", "by": "spaintech", "date": "2026-10-01", "stance": "recommend", "quote": "For some critical software we developed, we used TLA+ for high-level formal specification.", "excerpt": "While both TLA+ and ADA/Spark might be necessary, I haven\u2019t noticed much mention of ADA/SPARK here, which kind of surprised me that they are not used in conjunction as frequent as I might have thought. For some critical software we developed, we used TLA+ for high-level formal specification. As mentioned earlier, transitioning the actual implementation to another language can be challenging, especially if partial har", "context": "", "use_case": "formal specification", "switched_from": "", "story": "What TLA+ can and can't check"}]}, {"label": "Finds subtle bugs", "summary": "Model checking turns up deadlocks, transaction and atomic bugs, and counterexamples that become failing tests.", "quotes": [{"id": 740848432, "item_id": 46303027, "url": "https://news.ycombinator.com/item?id=46303027", "by": "tonyarkles", "date": "2025-12-17", "stance": "recommend", "quote": "The times I've used TLA+ in anger have been generally related to lower-level \"communicating state machines\".", "excerpt": "The times I've used TLA+ in anger have been generally related to lower-level \"communicating state machines\". One was a LoRaWAN handshake with the possibility of lost radio packets, another was a slightly-higher-level Bluetooth message exchange between a phone and a device. In the first situation I wanted to ensure that the state machine I'd put together couldn't ever deadlock. There's a fairness constraint you can tu", "context": "", "use_case": "modeling protocols and state machines", "switched_from": "", "story": "TLA+ Modeling Tips"}, {"id": 797851521, "item_id": 49865720, "url": "https://news.ycombinator.com/item?id=49865720", "by": "stevefan1999", "date": "2026-09-27", "stance": "neutral", "quote": "I indirectly use TLA+ through", "excerpt": "I indirectly use TLA+ through https://github.com/quint-co/quint. I added instructions that \"before you implement any feature, please use Quint to model it and make sure no counterexample for the system as a whole, reiterate the design with Quint as well and make sure your documents and implementation follows the formal model and docs\". The result, while takes much longer, is quite magical. A lot of transaction and at", "context": "", "use_case": "formal specification", "switched_from": "", "story": "The internet discovers TLA+. Now what?"}, {"id": 798314288, "item_id": 49894643, "url": "https://news.ycombinator.com/item?id=49894643", "by": "tarasyarema", "date": "2026-09-29", "stance": "recommend", "quote": "I think this pattern is super nice tbh, and it helps a lot on reasoning around the code and implementation", "excerpt": "Hi there! A few weeks ago, Boris posted how formal verification helped fix issues in their codebase (https://x.com/bcherny/status/2102543349102338309) and I definitely wanted to try it out in the swarm codebase. The idea was simple: 1. Go over the codebase and fine most critical parts that could be modelled 2. Pick the first few and try to model them based on main code 3. Find counterexamples 4. Generate failing test", "context": "", "use_case": "formal verification of codebase", "switched_from": "", "story": "TLA+ helped us fix and10 issues in our OSS project"}]}, {"label": "Works with LLMs", "summary": "LLMs are good at drafting TLA+ models that act as guardrails for the code they generate.", "quotes": [{"id": 798600656, "item_id": 49912541, "url": "https://news.ycombinator.com/item?id=49912541", "by": "_flux", "date": "2026-09-30", "stance": "recommend", "quote": "These probabilistic guessing machines are pretty great for creating these formal models, e.g. TLA+", "excerpt": "These probabilistic guessing machines are pretty great for creating these formal models, e.g. TLA+, and then guessing if the implementation aligns with the spec.. In fact, it's my go-to tool for constructing soft guardrails for the model, so the design it's going to implement is logically sound. Same as for people: it's easier to make something working when you have a spec that is working. Of course, it still allows ", "context": "", "use_case": "spec and design validation with LLMs", "switched_from": "", "story": "What TLA+ can and can't check"}, {"id": 798314288, "item_id": 49894643, "url": "https://news.ycombinator.com/item?id=49894643", "by": "tarasyarema", "date": "2026-09-29", "stance": "recommend", "quote": "I think this pattern is super nice tbh, and it helps a lot on reasoning around the code and implementation", "excerpt": "Hi there! A few weeks ago, Boris posted how formal verification helped fix issues in their codebase (https://x.com/bcherny/status/2102543349102338309) and I definitely wanted to try it out in the swarm codebase. The idea was simple: 1. Go over the codebase and fine most critical parts that could be modelled 2. Pick the first few and try to model them based on main code 3. Find counterexamples 4. Generate failing test", "context": "", "use_case": "formal verification of codebase", "switched_from": "", "story": "TLA+ helped us fix and10 issues in our OSS project"}, {"id": 797851521, "item_id": 49865720, "url": "https://news.ycombinator.com/item?id=49865720", "by": "stevefan1999", "date": "2026-09-27", "stance": "neutral", "quote": "I indirectly use TLA+ through", "excerpt": "I indirectly use TLA+ through https://github.com/quint-co/quint. I added instructions that \"before you implement any feature, please use Quint to model it and make sure no counterexample for the system as a whole, reiterate the design with Quint as well and make sure your documents and implementation follows the formal model and docs\". The result, while takes much longer, is quite magical. A lot of transaction and at", "context": "", "use_case": "formal specification", "switched_from": "", "story": "The internet discovers TLA+. Now what?"}]}, {"label": "Better debugging mindset", "summary": "Encourages treating crashes as state problems and asking how the system reached that state.", "quotes": [{"id": 740978160, "item_id": 46311135, "url": "https://news.ycombinator.com/item?id=46311135", "by": "dhavalt", "date": "2025-12-18", "stance": "recommend", "quote": "TLA+ gave me new prespective towards debugging, and started treating system crashes as a state problems rather than just code errors.", "excerpt": "While debugging a crash or incident, I used to get lost in the specific line of code and trying to fixing symptoms. TLA+ gave me new prespective towards debugging, and started treating system crashes as a state problems rather than just code errors. I stop asking 'Why is this line failing?' and start asking 'How did the system get into this state?'. And whenever a fix or patch feel like a duct-tape to me, start looki", "context": "", "use_case": "debugging production incidents", "switched_from": "", "story": "Ask HN: How did you learn to debug production incidents?"}]}, {"label": "Learning resources", "summary": "Lamport's video series and the example specs, such as the elevator model, are good places to start.", "quotes": [{"id": 769569248, "item_id": 48098078, "url": "https://news.ycombinator.com/item?id=48098078", "by": "tombert", "date": "2026-05-11", "stance": "recommend", "quote": "TLA+ is a decent enough language.  I recommend going through Lamport's video series on it to start", "excerpt": "FizzBee is likely a good place to start, but since I have never really used it I'm afraid I can't recommend good resources for it. ------ If you're just getting started, I recommend checking out my former advisor's book: https://www.amazon.com/Software-Engineering-Mathematics-Sei/dp/0201504243 I found this book to be fairly easy to read through, and gives you a rundown of a lot of the notation and concepts that prett", "context": "formal methods PhD background", "use_case": "formal methods for distributed systems", "switched_from": "", "story": "Ask HN: What Are You Working On? (May 2026)"}, {"id": 786074624, "item_id": 49129664, "url": "https://news.ycombinator.com/item?id=49129664", "by": "agentultra", "date": "2026-07-31", "stance": "recommend", "quote": "Simulating Elevators in TLA+ is a fun exercise.", "excerpt": "Simulating Elevators in TLA+ is a fun exercise. https://github.com/tlaplus/Examples/blob/master/specifications/MultiCarElevator/Elevator.tla Another interesting, and underrated one: hotel keys.", "context": "", "use_case": "modeling elevator systems", "switched_from": "", "story": "Elevators"}]}, {"label": "PlusCal option", "summary": "PlusCal complements TLA+ for modeling sequential, order-dependent algorithms.", "quotes": [{"id": 798638977, "item_id": 49914936, "url": "https://news.ycombinator.com/item?id=49914936", "by": "tombert", "date": "2026-09-30", "stance": "recommend", "quote": "When I write regular TLA+, it's usually for things that aren't nearly as \"order-dependent\".", "excerpt": "I feel like PlusCal and TLA+ operate at a different level. I use PlusCal primarily when what I'm modeling has a lot of sequential \"A then B then C...\" steps. With PlusCal a program counter is implied and it maps more directly to sequential algorithms. When I write regular TLA+, it's usually for things that aren't nearly as \"order-dependent\".", "context": "", "use_case": "modeling non-sequential systems", "switched_from": "", "story": "What TLA+ can and can't check"}]}], "caveats": [{"label": "Spec-code drift", "summary": "Keeping implementation code in sync with the model and carrying the spec into real code can be tedious and challenging.", "quotes": [{"id": 797872208, "item_id": 49867013, "url": "https://news.ycombinator.com/item?id=49867013", "by": "thadt", "date": "2026-09-27", "stance": "recommend", "quote": "TLA is pretty excellent for the job it does.", "excerpt": "TLA is pretty excellent for the job it does. In the past, the general issue with tools like this has been keeping the implementation code in sync with the model. Implementing verification tests from model across to the implementation can be tedious and very time consuming. Now that we have assistants that excel at tedious and time consuming tasks, it\u2019ll be interesting to see if the dominant approach is still using de", "context": "", "use_case": "formal modeling", "switched_from": "", "story": "The internet discovers TLA+. Now what?"}, {"id": 798689488, "item_id": 49918093, "url": "https://news.ycombinator.com/item?id=49918093", "by": "spaintech", "date": "2026-10-01", "stance": "recommend", "quote": "For some critical software we developed, we used TLA+ for high-level formal specification.", "excerpt": "While both TLA+ and ADA/Spark might be necessary, I haven\u2019t noticed much mention of ADA/SPARK here, which kind of surprised me that they are not used in conjunction as frequent as I might have thought. For some critical software we developed, we used TLA+ for high-level formal specification. As mentioned earlier, transitioning the actual implementation to another language can be challenging, especially if partial har", "context": "", "use_case": "formal specification", "switched_from": "", "story": "What TLA+ can and can't check"}]}, {"label": "Weak memory models", "summary": "Not good at modeling atomics or non-sequentially-consistent memory semantics.", "quotes": [{"id": 798598656, "item_id": 49912416, "url": "https://news.ycombinator.com/item?id=49912416", "by": "singron", "date": "2026-09-30", "stance": "neutral", "quote": "another thing TLA+ isn't great at is modeling atomics and in particular weak-memory semantics", "excerpt": "I love this. This is great to read if you are trying to use TLA+ for something. In a different vein, another thing TLA+ isn't great at is modeling atomics and in particular weak-memory semantics or anything that's not sequentially consistent. If you translate your algorithm to pcal, it will run as if it was sequentially consistent. If you need to model non-sequential-consistency, then that needs to be spelled out wit", "context": "", "use_case": "formal modeling", "switched_from": "", "story": "What TLA+ can and can't check"}]}, {"label": "Understanding risk", "summary": "Leaning on AI to produce models or proofs can hide the reasoning from the people involved.", "quotes": [{"id": 797881168, "item_id": 49867573, "url": "https://news.ycombinator.com/item?id=49867573", "by": "pron", "date": "2026-09-27", "stance": "recommend", "quote": "I love TLA+ to describe systems precisely yet succinctly and reason about them.", "excerpt": "I love TLA+ to describe systems precisely yet succinctly and reason about them. But as someone who's been using formal methods to help software development for many years, this whole industry around tools to connect such a wonderful mathematical language and others like it, like Lean, with AI, to the point of hiding the reasoning from people, confuses me. Proving programs correct end-to-end (i.e. code to high-level p", "context": "uses formal methods for many years", "use_case": "formal specification", "switched_from": "", "story": "The internet discovers TLA+. Now what?"}, {"id": 798600656, "item_id": 49912541, "url": "https://news.ycombinator.com/item?id=49912541", "by": "_flux", "date": "2026-09-30", "stance": "recommend", "quote": "These probabilistic guessing machines are pretty great for creating these formal models, e.g. TLA+", "excerpt": "These probabilistic guessing machines are pretty great for creating these formal models, e.g. TLA+, and then guessing if the implementation aligns with the spec.. In fact, it's my go-to tool for constructing soft guardrails for the model, so the design it's going to implement is logically sound. Same as for people: it's easier to make something working when you have a spec that is working. Of course, it still allows ", "context": "", "use_case": "spec and design validation with LLMs", "switched_from": "", "story": "What TLA+ can and can't check"}]}, {"label": "Slower workflow", "summary": "Modeling every feature first takes much longer and helps less around external resources.", "quotes": [{"id": 797851521, "item_id": 49865720, "url": "https://news.ycombinator.com/item?id=49865720", "by": "stevefan1999", "date": "2026-09-27", "stance": "neutral", "quote": "I indirectly use TLA+ through", "excerpt": "I indirectly use TLA+ through https://github.com/quint-co/quint. I added instructions that \"before you implement any feature, please use Quint to model it and make sure no counterexample for the system as a whole, reiterate the design with Quint as well and make sure your documents and implementation follows the formal model and docs\". The result, while takes much longer, is quite magical. A lot of transaction and at", "context": "", "use_case": "formal specification", "switched_from": "", "story": "The internet discovers TLA+. Now what?"}]}], "who": [{"by": "wbeckler", "context": "works on the Open Markets Initiative", "url": "https://news.ycombinator.com/item?id=50316022", "date": "2026-10-31"}, {"by": "_flux", "context": "hobby web app developer", "url": "https://news.ycombinator.com/item?id=49912576", "date": "2026-09-30"}, {"by": "pron", "context": "uses formal methods for many years", "url": "https://news.ycombinator.com/item?id=49867573", "date": "2026-09-27"}, {"by": "dboreham", "context": "engineer", "url": "https://news.ycombinator.com/item?id=49866686", "date": "2026-09-27"}, {"by": "dwohnitmok", "context": "has done work in formal verification", "url": "https://news.ycombinator.com/item?id=49756577", "date": "2026-09-18"}, {"by": "tombert", "context": "formal methods PhD background", "url": "https://news.ycombinator.com/item?id=48098078", "date": "2026-05-11"}], "tags": ["for distributed systems", "for protocol design", "for critical software", "for AI-assisted coding", "for hobby projects"], "use_cases": ["formal specification", "formal verification", "formal modeling", "guiding ai-written code", "modeling non-sequential systems", "modeling web app access control"], "compared": [{"slug": "quint", "name": "Quint", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=49863600", "title": "The internet discovers TLA+. Now what?", "mentions": 5}, {"url": "https://news.ycombinator.com/item?id=49909056", "title": "What TLA+ can and can't check", "mentions": 4}, {"url": "https://news.ycombinator.com/item?id=50290652", "title": "AI, Lean, and the Future of Formal Verification, with Lean Creator Leo de Moura", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=50175574", "title": "Blueprints, Not Prompts: Using TLA+ to Guide AI-Written Code", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49894642", "title": "TLA+ helped us fix and10 issues in our OSS project", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49753179", "title": "Bend 2 and the Vibe-Coding Trap", "mentions": 1}], "sentiment_by_month": {"2025-11": {"recommend": 1}, "2025-12": {"recommend": 2}, "2026-01": {}, "2026-02": {}, "2026-03": {}, "2026-04": {}, "2026-05": {"recommend": 1}, "2026-06": {}, "2026-07": {"recommend": 1}, "2026-08": {}, "2026-09": {"neutral": 4, "recommend": 5}, "2026-10": {"recommend": 2, "neutral": 1}}, "quotes": [{"id": 805056353, "item_id": 50316022, "url": "https://news.ycombinator.com/item?id=50316022", "by": "wbeckler", "date": "2026-10-31", "stance": "neutral", "quote": "we've generated millions of lines of Lean 4, TLA+, and Rocq", "excerpt": "I think the royal combo is Lean 4/TLA+/etc. plus AI plus a deterministic generator. For large systems formal method assertions need to be compressed down to a human comprehensible size. This can happen when the assertions are confirming the accuracy of a model and its attached code generators. The generator can generate proofs of the generated code and a human only needs to ensure that the generator provably generate", "context": "works on the Open Markets Initiative", "use_case": "formal verification", "switched_from": "", "story": "AI, Lean, and the Future of Formal Verification, with Lean Creator Leo de Moura"}, {"id": 802809200, "item_id": 50175575, "url": "https://news.ycombinator.com/item?id=50175575", "by": "InsideStick", "date": "2026-10-21", "stance": "recommend", "quote": "I've been working with formal methods in my software engineering practices for a while now", "excerpt": "I've been working with formal methods in my software engineering practices for a while now, and thought I'd try to spread some of what I've learnt into the wider community. In the hope that it will inspire some creativity around the use of LLMs as a complimentary force, instead of the slop cannon we have now. I think we're still all stuck in the early stages of adopting a new major tech (AI), where we use it do the e", "context": "", "use_case": "guiding AI-written code", "switched_from": "", "story": "Blueprints, Not Prompts: Using TLA+ to Guide AI-Written Code"}, {"id": 798689488, "item_id": 49918093, "url": "https://news.ycombinator.com/item?id=49918093", "by": "spaintech", "date": "2026-10-01", "stance": "recommend", "quote": "For some critical software we developed, we used TLA+ for high-level formal specification.", "excerpt": "While both TLA+ and ADA/Spark might be necessary, I haven\u2019t noticed much mention of ADA/SPARK here, which kind of surprised me that they are not used in conjunction as frequent as I might have thought. For some critical software we developed, we used TLA+ for high-level formal specification. As mentioned earlier, transitioning the actual implementation to another language can be challenging, especially if partial har", "context": "", "use_case": "formal specification", "switched_from": "", "story": "What TLA+ can and can't check"}, {"id": 798638977, "item_id": 49914936, "url": "https://news.ycombinator.com/item?id=49914936", "by": "tombert", "date": "2026-09-30", "stance": "recommend", "quote": "When I write regular TLA+, it's usually for things that aren't nearly as \"order-dependent\".", "excerpt": "I feel like PlusCal and TLA+ operate at a different level. I use PlusCal primarily when what I'm modeling has a lot of sequential \"A then B then C...\" steps. With PlusCal a program counter is implied and it maps more directly to sequential algorithms. When I write regular TLA+, it's usually for things that aren't nearly as \"order-dependent\".", "context": "", "use_case": "modeling non-sequential systems", "switched_from": "", "story": "What TLA+ can and can't check"}, {"id": 798601216, "item_id": 49912576, "url": "https://news.ycombinator.com/item?id=49912576", "by": "_flux", "date": "2026-09-30", "stance": "recommend", "quote": "I used TLA+ in a (hobby) web app by asking it to model the endpoints and the data user can get from them", "excerpt": "I used TLA+ in a (hobby) web app by asking it to model the endpoints and the data user can get from them, and then what kind of access that data can grant in the system, and then implement some properties over that kind of data. I suppose basically like \"you can't get access to another user's shopping basket\", although mine was maybe a bit more convoluted.", "context": "hobby web app developer", "use_case": "modeling web app access control", "switched_from": "", "story": "The internet discovers TLA+. Now what?"}, {"id": 798600656, "item_id": 49912541, "url": "https://news.ycombinator.com/item?id=49912541", "by": "_flux", "date": "2026-09-30", "stance": "recommend", "quote": "These probabilistic guessing machines are pretty great for creating these formal models, e.g. TLA+", "excerpt": "These probabilistic guessing machines are pretty great for creating these formal models, e.g. TLA+, and then guessing if the implementation aligns with the spec.. In fact, it's my go-to tool for constructing soft guardrails for the model, so the design it's going to implement is logically sound. Same as for people: it's easier to make something working when you have a spec that is working. Of course, it still allows ", "context": "", "use_case": "spec and design validation with LLMs", "switched_from": "", "story": "What TLA+ can and can't check"}, {"id": 798598656, "item_id": 49912416, "url": "https://news.ycombinator.com/item?id=49912416", "by": "singron", "date": "2026-09-30", "stance": "neutral", "quote": "another thing TLA+ isn't great at is modeling atomics and in particular weak-memory semantics", "excerpt": "I love this. This is great to read if you are trying to use TLA+ for something. In a different vein, another thing TLA+ isn't great at is modeling atomics and in particular weak-memory semantics or anything that's not sequentially consistent. If you translate your algorithm to pcal, it will run as if it was sequentially consistent. If you need to model non-sequential-consistency, then that needs to be spelled out wit", "context": "", "use_case": "formal modeling", "switched_from": "", "story": "What TLA+ can and can't check"}, {"id": 798314288, "item_id": 49894643, "url": "https://news.ycombinator.com/item?id=49894643", "by": "tarasyarema", "date": "2026-09-29", "stance": "recommend", "quote": "I think this pattern is super nice tbh, and it helps a lot on reasoning around the code and implementation", "excerpt": "Hi there! A few weeks ago, Boris posted how formal verification helped fix issues in their codebase (https://x.com/bcherny/status/2102543349102338309) and I definitely wanted to try it out in the swarm codebase. The idea was simple: 1. Go over the codebase and fine most critical parts that could be modelled 2. Pick the first few and try to model them based on main code 3. Find counterexamples 4. Generate failing test", "context": "", "use_case": "formal verification of codebase", "switched_from": "", "story": "TLA+ helped us fix and10 issues in our OSS project"}, {"id": 797881168, "item_id": 49867573, "url": "https://news.ycombinator.com/item?id=49867573", "by": "pron", "date": "2026-09-27", "stance": "recommend", "quote": "I love TLA+ to describe systems precisely yet succinctly and reason about them.", "excerpt": "I love TLA+ to describe systems precisely yet succinctly and reason about them. But as someone who's been using formal methods to help software development for many years, this whole industry around tools to connect such a wonderful mathematical language and others like it, like Lean, with AI, to the point of hiding the reasoning from people, confuses me. Proving programs correct end-to-end (i.e. code to high-level p", "context": "uses formal methods for many years", "use_case": "formal specification", "switched_from": "", "story": "The internet discovers TLA+. Now what?"}, {"id": 797872208, "item_id": 49867013, "url": "https://news.ycombinator.com/item?id=49867013", "by": "thadt", "date": "2026-09-27", "stance": "recommend", "quote": "TLA is pretty excellent for the job it does.", "excerpt": "TLA is pretty excellent for the job it does. In the past, the general issue with tools like this has been keeping the implementation code in sync with the model. Implementing verification tests from model across to the implementation can be tedious and very time consuming. Now that we have assistants that excel at tedious and time consuming tasks, it\u2019ll be interesting to see if the dominant approach is still using de", "context": "", "use_case": "formal modeling", "switched_from": "", "story": "The internet discovers TLA+. Now what?"}, {"id": 797866976, "item_id": 49866686, "url": "https://news.ycombinator.com/item?id=49866686", "by": "dboreham", "date": "2026-09-27", "stance": "neutral", "quote": "TLA+ is a specific kind of formal verification framework for software.", "excerpt": "Here's my regular engineer explanation: TLA+ is a specific kind of formal verification framework for software. The overall idea is that you can \"prove\" that some software works, rather than the typical \"seems like it works\" we aim for. But under the covers, all formal verification schemes are (imho) best viewed as \"very fancy testing\". There are a few kinds of this fancy testing. TLA+ is the kind that can auto-genera", "context": "engineer", "use_case": "verifying risky code like quorum voting", "switched_from": "", "story": "The internet discovers TLA+. Now what?"}, {"id": 797851521, "item_id": 49865720, "url": "https://news.ycombinator.com/item?id=49865720", "by": "stevefan1999", "date": "2026-09-27", "stance": "neutral", "quote": "I indirectly use TLA+ through", "excerpt": "I indirectly use TLA+ through https://github.com/quint-co/quint. I added instructions that \"before you implement any feature, please use Quint to model it and make sure no counterexample for the system as a whole, reiterate the design with Quint as well and make sure your documents and implementation follows the formal model and docs\". The result, while takes much longer, is quite magical. A lot of transaction and at", "context": "", "use_case": "formal specification", "switched_from": "", "story": "The internet discovers TLA+. Now what?"}, {"id": 796105235, "item_id": 49756577, "url": "https://news.ycombinator.com/item?id=49756577", "by": "dwohnitmok", "date": "2026-09-18", "stance": "neutral", "quote": "my main toolbox of formal verification tools in the past have been Rocq, Idris, Dafny, and TLA+", "excerpt": "I would encourage you to think more deeply about the assertions you're making here. I've done a fair amount of work in this space as well, specifically my main toolbox of formal verification tools in the past have been Rocq, Idris, Dafny, and TLA+, and I can say that I've come away with roughly the same set of tradeoffs as what LightMachine describes in his comment. Current formal verification tools are often very sl", "context": "has done work in formal verification", "use_case": "formal verification", "switched_from": "", "story": "Bend 2 and the Vibe-Coding Trap"}, {"id": 786074624, "item_id": 49129664, "url": "https://news.ycombinator.com/item?id=49129664", "by": "agentultra", "date": "2026-07-31", "stance": "recommend", "quote": "Simulating Elevators in TLA+ is a fun exercise.", "excerpt": "Simulating Elevators in TLA+ is a fun exercise. https://github.com/tlaplus/Examples/blob/master/specifications/MultiCarElevator/Elevator.tla Another interesting, and underrated one: hotel keys.", "context": "", "use_case": "modeling elevator systems", "switched_from": "", "story": "Elevators"}, {"id": 769569248, "item_id": 48098078, "url": "https://news.ycombinator.com/item?id=48098078", "by": "tombert", "date": "2026-05-11", "stance": "recommend", "quote": "TLA+ is a decent enough language.  I recommend going through Lamport's video series on it to start", "excerpt": "FizzBee is likely a good place to start, but since I have never really used it I'm afraid I can't recommend good resources for it. ------ If you're just getting started, I recommend checking out my former advisor's book: https://www.amazon.com/Software-Engineering-Mathematics-Sei/dp/0201504243 I found this book to be fairly easy to read through, and gives you a rundown of a lot of the notation and concepts that prett", "context": "formal methods PhD background", "use_case": "formal methods for distributed systems", "switched_from": "", "story": "Ask HN: What Are You Working On? (May 2026)"}, {"id": 740978160, "item_id": 46311135, "url": "https://news.ycombinator.com/item?id=46311135", "by": "dhavalt", "date": "2025-12-18", "stance": "recommend", "quote": "TLA+ gave me new prespective towards debugging, and started treating system crashes as a state problems rather than just code errors.", "excerpt": "While debugging a crash or incident, I used to get lost in the specific line of code and trying to fixing symptoms. TLA+ gave me new prespective towards debugging, and started treating system crashes as a state problems rather than just code errors. I stop asking 'Why is this line failing?' and start asking 'How did the system get into this state?'. And whenever a fix or patch feel like a duct-tape to me, start looki", "context": "", "use_case": "debugging production incidents", "switched_from": "", "story": "Ask HN: How did you learn to debug production incidents?"}, {"id": 740848432, "item_id": 46303027, "url": "https://news.ycombinator.com/item?id=46303027", "by": "tonyarkles", "date": "2025-12-17", "stance": "recommend", "quote": "The times I've used TLA+ in anger have been generally related to lower-level \"communicating state machines\".", "excerpt": "The times I've used TLA+ in anger have been generally related to lower-level \"communicating state machines\". One was a LoRaWAN handshake with the possibility of lost radio packets, another was a slightly-higher-level Bluetooth message exchange between a phone and a device. In the first situation I wanted to ensure that the state machine I'd put together couldn't ever deadlock. There's a fairness constraint you can tu", "context": "", "use_case": "modeling protocols and state machines", "switched_from": "", "story": "TLA+ Modeling Tips"}, {"id": 732701713, "item_id": 45793857, "url": "https://news.ycombinator.com/item?id=45793857", "by": "tombert", "date": "2025-11-02", "stance": "recommend", "quote": "I'd potentially have more success trying to push people to use TLA+", "excerpt": "My abandoned PhD was in formal methods and I find dependent types to be pretty neat, but every time I've tried using a dependently typed language for anything it's always been an uphill battle. When I used to do F# for a living, I was really pushing for using F*, but it was impossible to get any buy-in from coworkers because the learning curve was comparatively steep. I probably should have pushed a bit more, but I f", "context": "formal methods background", "use_case": "formal specification", "switched_from": "", "story": "Why don't you use dependent types?"}]}