TLA+
Leslie Lamport's formal specification language for modeling and checking concurrent and distributed systems.
HN commenters like TLA+ for describing systems precisely and succinctly123 and for finding deadlocks, concurrency and state bugs through counterexamples,456 increasingly with LLMs helping to write the models.789 The most common caveat is that keeping the implementation in sync with the model is tedious and hard,1011 and it handles weak-memory semantics poorly.12
Why people recommend it
Precise specification · 3
Describes systems precisely yet succinctly so you can reason about them before and during implementation.
“I love TLA+ to describe systems precisely yet succinctly and reason about them.”
“TLA is pretty excellent for the job it does.”
Show 1 more
“For some critical software we developed, we used TLA+ for high-level formal specification.”
Finds subtle bugs · 3
Model checking turns up deadlocks, transaction and atomic bugs, and counterexamples that become failing tests.
“The times I've used TLA+ in anger have been generally related to lower-level "communicating state machines".”
“I indirectly use TLA+ through”
Show 1 more
“I think this pattern is super nice tbh, and it helps a lot on reasoning around the code and implementation”
Works with LLMs · 3
LLMs are good at drafting TLA+ models that act as guardrails for the code they generate.
“These probabilistic guessing machines are pretty great for creating these formal models, e.g. TLA+”
“I think this pattern is super nice tbh, and it helps a lot on reasoning around the code and implementation”
Show 1 more
“I indirectly use TLA+ through”
Better debugging mindset · 1
Encourages treating crashes as state problems and asking how the system reached that state.
“TLA+ gave me new prespective towards debugging, and started treating system crashes as a state problems rather than just code errors.”
Learning resources · 2
Lamport's video series and the example specs, such as the elevator model, are good places to start.
“TLA+ is a decent enough language. I recommend going through Lamport's video series on it to start”
PlusCal option · 1
PlusCal complements TLA+ for modeling sequential, order-dependent algorithms.
“When I write regular TLA+, it's usually for things that aren't nearly as "order-dependent".”
Caveats and dissent
Spec-code drift · 2
Keeping implementation code in sync with the model and carrying the spec into real code can be tedious and challenging.
“TLA is pretty excellent for the job it does.”
“For some critical software we developed, we used TLA+ for high-level formal specification.”
Weak memory models · 1
Not good at modeling atomics or non-sequentially-consistent memory semantics.
“another thing TLA+ isn't great at is modeling atomics and in particular weak-memory semantics”
Understanding risk · 2
Leaning on AI to produce models or proofs can hide the reasoning from the people involved.
“I love TLA+ to describe systems precisely yet succinctly and reason about them.”
“These probabilistic guessing machines are pretty great for creating these formal models, e.g. TLA+”
Slower workflow · 1
Modeling every feature first takes much longer and helps less around external resources.
“I indirectly use TLA+ through”
Often compared with
Who recommends it in their own words
Threads where it came up
- The internet discovers TLA+. Now what? 5 mentions
- What TLA+ can and can't check 4 mentions
- AI, Lean, and the Future of Formal Verification, with Lean Creator Leo de Moura 1 mention
- Blueprints, Not Prompts: Using TLA+ to Guide AI-Written Code 1 mention
- TLA+ helped us fix and10 issues in our OSS project 1 mention
- Bend 2 and the Vibe-Coding Trap 1 mention
Data: tlaplus.json. Quotes are verbatim; the verdict and theme labels are written by a model from these comments, and every clause links to its sources.
All comments 18
“we've generated millions of lines of Lean 4, TLA+, and Rocq”
“I've been working with formal methods in my software engineering practices for a while now”
“For some critical software we developed, we used TLA+ for high-level formal specification.”
“When I write regular TLA+, it's usually for things that aren't nearly as "order-dependent".”
“I used TLA+ in a (hobby) web app by asking it to model the endpoints and the data user can get from them”
“These probabilistic guessing machines are pretty great for creating these formal models, e.g. TLA+”
“another thing TLA+ isn't great at is modeling atomics and in particular weak-memory semantics”
“I think this pattern is super nice tbh, and it helps a lot on reasoning around the code and implementation”
“I love TLA+ to describe systems precisely yet succinctly and reason about them.”
“TLA is pretty excellent for the job it does.”
“TLA+ is a specific kind of formal verification framework for software.”
“I indirectly use TLA+ through”
“my main toolbox of formal verification tools in the past have been Rocq, Idris, Dafny, and TLA+”
“Simulating Elevators in TLA+ is a fun exercise.”
“TLA+ is a decent enough language. I recommend going through Lamport's video series on it to start”
“TLA+ gave me new prespective towards debugging, and started treating system crashes as a state problems rather than just code errors.”
“The times I've used TLA+ in anger have been generally related to lower-level "communicating state machines".”
“I'd potentially have more success trying to push people to use TLA+”