TLA+
Hacker ApprovedSpecification language in Developer tools
Lets people precisely model concurrent and distributed systems and catch design bugs before coding. Common caveat: harsh syntax and models that drift from the real code.
Lets people precisely model concurrent and distributed systems and catch design bugs before coding. Common caveat: harsh syntax and models that drift from the real code.
93 people gave an opinion
- recommend it
- 74
- criticize it
- 19
- approval share
- 80%
Recommended in 12 of 13 months
- November 2025: recommended
- December 2025: recommended
- January 2026: recommended
- February 2026: recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: recommended
- July 2026: recommended
- August 2026: recommended
- September 2026: recommended
- October 2026: recommended
- November 2026: not recommended (month in progress)
Owned for 7 months
Median of the 5 owners who said how long they have had it.
Each square is one year.
Why it carries the badge
- 74 people recommend itNeeds 10 or more, met.
- 3.9 recommenders for every criticNeeds 2 to 1 or better, met.
- Recommended in 12 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Precise models of distributed systems
“TLA+ (minus the temporal operators) would be still extremely useful for specifying the behavior of concurrent and distributed systems”
Comment from 17 Dec 2025 in “AI will make formal verification go mainstream” “the advantage of something like TLA+ is that the specs can generally be more abstract and as such the checks can be more exhaustive”
Comment from 30 Jul 2026 in “Why Don't People Use Formal Methods?” “TLA+ is a great way to model certain systems mathematically, because precision in meaning is a great quality”
Comment from 13 Dec 2025 in “50 years of proof assistants” - Comment from 14 Apr 2026 in “Lean proved this program correct; then I found a bug”
- Comment from 27 Sep 2026 in “The internet discovers TLA+. Now what?”
Catches bugs before code ships
“Running TLA+ via coding agents became a productivity hack for me to quickly catch invariant breaks”
Comment from 7 Apr 2026 in “Show HN: Hazmat – I made unrestricted Claude Code safe on macOS” “I was able to find and prevent a catastrophic bug by pointing Opus armed with TLA+ at the problem.”
Comment from 27 Sep 2026 in “The internet discovers TLA+. Now what?” “adding formal verification surfaced 33 classes of bugs, some of which had several instances.”
Comment from 27 Sep 2026 in “The internet discovers TLA+. Now what?” - Comment from 17 Mar 2026 in “Mistral Releases Leanstral”
- Comment from 17 Dec 2025 in “TLA+ Modeling Tips”
Clearer thinking about systems
“TLA+ gave me new prespective towards debugging, and started treating system crashes as a state problems rather than just code errors.”
Comment from 18 Dec 2025 in “Ask HN: How did you learn to debug production incidents?” “If you're after a language that's OSS, has terse notation, and rewires your brain by helping you think more clearly”
Comment from 24 May 2026 in “Mastering Dyalog APL” “TLA+ is much closer to what I'd recommend if what you want is clearer thinking about programs, systems and state.”
Comment from 24 May 2026 in “Mastering Dyalog APL” - Comment from 23 Oct 2026 in “The foolishness of "natural language programming" (1978)”
- Comment from 26 Jan 2026 in “AI Destroys Institutions”
Helps LLM agents write correct code
“LLM agents have none of the attentional and motivational constraints of humans so there's no reason not to do things the right way.”
Comment from 19 Jan 2026 in “Gas Town Decoded” “I view a complete TLA+ specification as a kind of metalanguage that can be used with LLMs to generate code from.”
Comment from 19 May 2026 in “Intro to TLA+ for the LLM Era: Prompt Your Way to Victory” “the act of writing a TLA+ model helps the frontier LLMs to write correct executable code”
Comment from 16 Aug 2026 in “The Case Against Formal Verification, 50 Years Later” - Comment from 5 Apr 2026 in “Eight years of wanting, three months of building with AI”
- Comment from 12 May 2026 in “If AI Writes Your Code, Why Use Python?”
What people warn about
Each mark is one comment
Harsh learning curve and syntax
“the accessibility of TLA+, if you come from traditional programming languages, is quite harsh”
Comment from 17 Dec 2025 in “TLA+ Modeling Tips” “It has super weird syntax, and a whole separate DSL (PlusCal) to give it workable syntax for programs.”
Comment from 30 Sep 2026 in “What TLA+ can and can't check” “It sounds like the syntax just sucks and there's no way to get around it.”
Comment from 19 May 2026 in “Intro to TLA+ for the LLM Era: Prompt Your Way to Victory” Spec drifts from actual code
“in most cases there is no validation if the TLA+ model actually maps to the e.g. C code that was written”
Comment from 7 Jan 2026 in “Formal Methods Only Solve Half My Problems” “It is a headache to write TLA+ and keep the independent spec up2date with the productive code.”
Comment from 26 Nov 2025 in “Cloudflare outage should not have happened” “Problem with TLA+ is that it is a completely unrelated tool to the actual programming”
Comment from 3 Nov 2025 in “Reproducing the AWS Outage Race Condition with a Model Checker” - Comment from 3 Nov 2025 in “Reproducing the AWS Outage Race Condition with a Model Checker”
Weak at atomics and some properties
“another thing TLA+ isn't great at is modeling atomics and in particular weak-memory semantics”
Comment from 30 Sep 2026 in “What TLA+ can and can't check” “Not really, some components like components have a lot of properties that’s very difficult to modelize.”
Comment from 17 Dec 2025 in “AI will make formal verification go mainstream”
What people recommend instead
The same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| TLA+This page | 74 | 19 | 80% | 12 | 7 mo5 owners | Approved |
| Quint | 10 | 0 | 100% | 7 | — | Approved |
What people said
40 of the 129 comments that mention it, newest first. Each links to the original comment.
“Sitting down and formally writing what I want to do helps me better understand the problem”
“It doesn't fully close the specification gap but if it could be made robust it might be a good tool.”
“a single continuum, with a language that's much simpler than both Eiffel's spec language and its program language”
“It has super weird syntax, and a whole separate DSL (PlusCal) to give it workable syntax for programs.”
“another thing TLA+ isn't great at is modeling atomics and in particular weak-memory semantics”
“TLA+ is much simpler than a programming language and obeys simple and intuitive substitution rules”
“adding formal verification surfaced 33 classes of bugs, some of which had several instances.”
“I love TLA+ to describe systems precisely yet succinctly and reason about them”
“I was able to find and prevent a catastrophic bug by pointing Opus armed with TLA+ at the problem.”
“the act of writing a TLA+ model helps the frontier LLMs to write correct executable code”
“formal methods was considered more impactful during software design rather than as software verification”
“the advantage of something like TLA+ is that the specs can generally be more abstract and as such the checks can be more exhaustive”
“I have been able to budget myself a day or two to model some of the less-obvious bits of concurrency.”
“Something like TLA+[1] and Quint[2] specifications can be verified for correctness using Apalache[3].”
“TLA+ is much closer to what I'd recommend if what you want is clearer thinking about programs, systems and state.”
“If you're after a language that's OSS, has terse notation, and rewires your brain by helping you think more clearly”
“It sounds like the syntax just sucks and there's no way to get around it.”
“I view a complete TLA+ specification as a kind of metalanguage that can be used with LLMs to generate code from.”
“ask your agent to verify critical protocols with formal proof in TLA+/lean/coq”
“TLA+ models are cheap now. You should be using them when writing any sort of distributed systems”
“Running TLA+ via coding agents became a productivity hack for me to quickly catch invariant breaks”
“Use tla+ and have it go back and forth with you to spec out your system behavior”
“TLA+ or Lean as a targeted debugging tool for those specific pain points is genuinely practical now”
“the bug was found in seconds, total time to fix from idea to commit - about 15 mins”
“This is what makes literate programs (and TLA+ specs) conceptually crisp and easily communicable.”
“it has been very helpful AFTER I REALIZED that quite often it was proving things that were either trivial or irrelevant”
“Point the user^W dev towards better "tools of thought" that decouple problem-refinements from solutions.”
“LLM agents have none of the attentional and motivational constraints of humans so there's no reason not to do things the right way.”
“in most cases there is no validation if the TLA+ model actually maps to the e.g. C code that was written”
“a comparison to proofs in lean by comparison to TLA+ even though it is not Lamport's personal project”
“TLA+ gave me new prespective towards debugging, and started treating system crashes as a state problems rather than just code errors.”
“Not really, some components like components have a lot of properties that’s very difficult to modelize.”
“I used it to give me the sequence of events that would cause a message to be lost”
“the accessibility of TLA+, if you come from traditional programming languages, is quite harsh”
“TLA+ (minus the temporal operators) would be still extremely useful for specifying the behavior of concurrent and distributed systems”
“TLA+ is a great way to model certain systems mathematically, because precision in meaning is a great quality”
“It is a headache to write TLA+ and keep the independent spec up2date with the productive code.”
“I was delighted at the time at the degree to which Iulian was able to specify the protocol in TLA+”
“The problem is afaict there's no way to insert a TLA+ oracle into e.g. a rust proptest suite.”
“Problem with TLA+ is that it is a completely unrelated tool to the actual programming”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.