5 ms·
Can LLMs model real-world systems in TLA+?
- dgacmu 5mo agoThis post reads like an accidental advertisement for approaches like Verus [1], which couple the implementation and verification so you can't end up with a model that diverges from the actual implementation. I'm personally much more optimistic about the verus approach, but I freely admit that's my builder bias speaking. [1] https://github.com/verus-lang/verus https://github.com/verus-lang/verus
- dev_arvin2000 5mo ago[dead]
- tmaly 5mo agoI remember NVIDA sponsored a TLA+ challenge last year https://foundation.tlapl.us/challenge/index.html https://foundation.tlapl.us/challenge/index.html
- uptodatenews 5mo agoWhoa didn't even know cool
- uptodatenews 5mo ago[dead]
- asxndu 5mo ago>... we asked Claude to write a TLA+ specification (spec) for Etcd’s Raft implementation. It passed syntax checks, ran through the TLC model checker, and at first glance looked like a polished formal model. This is a mistaken use of TLA+! Leslie Lamport insists that he invented it to be a way of creating "blueprints" for systems. - You are supposed to go from TLA+ Spec to System (codebase or hardware). - Not codebase to TLA+ like the author has done. Otherwise, you may simply model an existing bug properly and the pass all the checks based of its implementation. He (Leslie Lamport) insists that the value AI can provide is in compiling TLA+ specs to a code base.
- tombert 5mo agoClaude has certainly been getting better with TLA+. It's not perfect yet but for laughs I got it to model the rules of Monopoly last night [1]. I haven't done any exhaustive checking on it yet, but it certainly looks passable. It is pretty impressive at how good it's gotten at this, in a relatively short amount of time no less. I still usually write my specs by hand, but who knows how much longer I'll be doing that. [1] https://pdfhost.io/v/KU2j37YKrP_Monopoly https://pdfhost.io/v/KU2j37YKrP_Monopoly
- ofrzeta 5mo agoIt looks quite complicated and I have no idea what it is doing. Obviously, since I don't know about TLA+. But what about someone who knows TLA+? It still seems hard to make sure it is valid. And it's just for a relatively simple game.
- _doctor_love 5mo agoThere is a nice guide to TLA+ from Hillel Wayne here: https://learntla.com/ https://learntla.com/ PlusCal is recommended as the gentler on-ramp to TLA+ for first learning.
- schaefer 5mo agoFrom the link above, I also found Leslie Lamport's Home page[1], The original developer of TLA+. Leslie's home page contains an incredible amount of info about TLA. There's a published Book with pdf available. There are video courses and talks. There are also git repos of examples[2] and tools[3] Thanks for the link, _doctor_love [1] https://lamport.azurewebsites.net/ https://lamport.azurewebsites.net/ [2] https://github.com/tlaplus/Examples https://github.com/tlaplus/Examples [3] https://github.com/tlaplus/tlaplus/ https://github.com/tlaplus/tlaplus/
- _doctor_love 5mo agoWelcome! Just one guy out here trying to be the change
- iFire 5mo agoI don't use tla+ to model real-world systems anymore, Claude is able to model systems in Lean 4 and the binary executable can handle real input or I can directly generate c / rust on proofs with numeric types that have ring structure (integers, rationals, bits). https://github.com/lambdaclass/truth_research_zk https://github.com/lambdaclass/truth_research_zk
- dev_arvin2000 5mo ago[flagged]
- thomasahle 5mo agoI'm currently choosing between the right formalization for a big hardware project. I'm considering between SVA, TLA+ and Lean. With the former being more domain specific and the later more general. Do you think we'll move towards "Lean for everything" or do domain specific formalisms still make sense?
- NooneAtAll3 5mo agowhat's SVA?
- IshKebab 5mo agoSystemVerilog Assertions. Hardware (silicon ASICs, and also FPGAs often) are written in a language called SystemVerilog. It has a feature called "concurrent assertions" which is usually just called SVA. These are sort of temporal regexes, e.g. you can write assert property($fell(rst) |-> foo == 1 ##[1:20] foo == 0) Which means if the rst signal fell (changed to 0) then foo must be 1 and 1-20 cycles later it must be 0. The nice thing about them is that there are a few commercial tools that can formally verify them. They're super expensive (~$100k/year for one license), but fairly widely used because they work really well. It's probably the most successful application of formal verification because it doesn't require much expertise to use. Unlike software formal verification which pretty much immediately requires you to become an expert on loop invariants, termination measures, hoare triples etc. At least that has been my experience.
- atomicnature 5mo agoJust a question to people who may know better than me about this. I thought the whole point of trying to write out TLA+ is so that you get a better idea of what you want and put it into formal language? I get that an LLM can assist/help with expressing what we want in formal language a bit, but if one automates all this there is no human intent/design anymore. If the LLM generates both the design (TLA+) and writes an arbitrary program that satisfies said design -- what exactly have we proved? What assurance do humans get since human doesn't know or cannot specify what they want.
- majormajor 5mo agoAn LLM-generated TLA+ model can be verified for certain things in a way that LLM-generated code can't. It's infamously hard to exhaustively unit-test concurrency. Whether or not you're modeling the right things or verifying the right things, of course... that's always left as an exercise for the user. ;) (How to prove the implementation code is guaranteed to match the spec is a trick I haven't seen generalized yet, either, too.)
- kiwicopple 5mo ago> It's infamously hard to exhaustively unit-test concurrency. a useful example from last week where TLA+ found a bug in pg_rewind: https://multigres.com/blog/2026/05/04/tla-pg-rewind https://multigres.com/blog/2026/05/04/tla-pg-rewind
- pzoln 5mo agoSorry, must be a very naive question, but what if you give LLM just a source code (maybe even obfuscate the names like Raft and Etcd) and ask it to create a TLA+ spec of that?
- _doctor_love 5mo agoThis is already being done by some folks, reverse-engineering existing source into a TLA+ spec. Like other commenters have mentioned, the challenge is in ensuring that the spec and code match each other.
- simplegeek 5mo agoI feel LLMs are indeed getting better at writing models. But, in my experience, they struggle to come up with correct safety and liveness properties unless you closely work with them. And of these two, they struggle the most with correct liveness properties. Also for some problems I observe that models produced by LLMs often cause state space explosion. For simpler models they can fix this when you guide them though. I’m sure LLMs will get even better. That said, I take slightly different approach. Lamport said “If you're thinking without writing, you only think you're thinking.” So taking that advice I always try to write the first draft with hand and once I have the final shape in place I then turn to an LLM for further exploration and experimentation if I have to.
- ElenaDaibunny 5mo ago[dead]
- Ozzie-D 5mo ago[flagged]
- alhazrod 5mo agoHopefully some people find this interesting too: TLAiBench[0]: A dataset and benchmark suite for evaluating Large Language Models (LLMs) on TLA+ formal specification tasks, featuring logic puzzles and real-world scenarios. [0]: https://github.com/tlaplus/TLAiBench https://github.com/tlaplus/TLAiBench
- 7777777phil 5mo ago[dead]
- gr71 5mo agois the training data for these testcases in benchmark not already there ? how do llms perform in novel complex systems spec design ?
- radarkilat 5mo agohmm
- Kab1r 5mo agoI've been building a TLA style Temporal Logic library for Verus (using LLMs). My experience so far is that LLMs are surprisingly useful at generating the mechanical proof scaffolding (when they're not occasionally trying to cheat with `assume(false)` statements), but they are not a substitute for knowing what property you actually want.