‹ BackHN Continuity

Thread

What TLA+ can and can't check

243 points · 51 comments · b-man

  1. adamddev1 · · focus · HN ↗
    Great write-up. People keep saying "we can just write tests" or more recently "we can use formal verification," thinking these are sufficient safeguards we can use and then relegate all the implementation to LLMs. But the fact is that probabilistic guessing machines can't save them. People can't escape the need to actually understand the things they are building.
    1. nonethewiser · · focus · HN ↗
      I wonder if asking an LLM to model their implementation in TLA+ first would improve their implementations.
      1. baq · · focus · HN ↗
        It does somewhat, or at least used to for a few months. Nowadays it kinda seems that the models have internalized something like TLA and are thinking in it in parallel to thinking in the language they’re writing, so it doesn’t help as much. This is all educated guesses from me, I’ve been telling models to do TLA back in the stone age around February and stopped seeing improvements when telling them to start with specs.

        I’m however pretty sure that if you push a good model hard enough on a code base complex enough it’ll find stuff it wouldn’t have otherwise, the Specula folks have some experience with this.

        <a href="https:&#x2F;&#x2F;github.com&#x2F;specula-org&#x2F;Specula" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;specula-org&#x2F;Specula

      2. senderista · · focus · HN ↗
        A TLA+ spec defines both a model and properties (global invariants). How do you know that the properties the LLM specifies are the ones you care about?
        1. nonethewiser · · focus · HN ↗
          My question is concerned with improving quality of AI implementations. Its plainly true, uninteresting, and beside the point to observe that AI cannot read minds.
Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.