Following recent discussions about AI agents using formal methods like TLA+ to find race conditions, educators and practitioners are highlighting the inherent limitations of such tools. While TLA+ is highly effective at ensuring safety and liveness in complex concurrent systems, it cannot inherently verify all types of properties.
Understanding the Limitations of TLA+ in Formal Verification
One primary limitation is that TLA+ requires a logical formula to represent a property. If a human concept—such as whether an application correctly "recognizes birds"—cannot be formalized, the tool cannot prove it. Additionally, TLA+ cannot natively define properties over multiple steps (such as a specific sequence of two distinct actions) or over continuous domains like real time and floating-point operations.
More significant are the limitations regarding "reachability" and "hyperproperties." TLA+ properties are implicitly quantified over all behaviors, meaning it cannot natively check if a certain state is "possible" (reachability) or compare different behaviors against each other (hyperproperties). The latter is particularly relevant for security and statistical properties, such as verifying that an energy-saving mode consistently uses less power than a standard mode.
While techniques such as using auxiliary variables or self-composition can mimic these behaviors, they act as "hacks" that increase complexity, ruin refinements, or exponentially expand the state space. Ultimately, while TLA+ remains a powerful tool for finding bugs in concurrent logic, it is not a universal solution for the complexities of agentic software development.
Sources
- What TLA+ can and can't check （Hacker News Frontpage, 2026-09-30）