tla-spec

Formal verification of a state machine uses TLC model checking to exhaustively explore all reachable states, detecting deadlocks, invariant violations, and unreachable states that runtime testing may overlook. You generate a TLA+ specification and run the model checker to validate correctness.

Yes, you can generate a TLA+ specification from existing code by applying a generation command to the source file. This process extracts the state machine logic and produces a .tla module, a .cfg configuration file, and an evaluation report for model checking.

Auditing code drift involves auto-detecting state machines in existing code and validating them against previously generated TLA+ specifications. This comparison reports any drift between the implementation and the formal spec, ensuring the deployed code matches the verified design.

You need formal verification when runtime testing is insufficient to guarantee correctness across all possible state transitions. Model checking exhaustively explores the state space to identify impossible states and deadlocks that conventional tests might never trigger during execution.

Yes, formal verification supports end-to-end workflows starting from planning documents. You can generate a TLA+ specification from planning specs, verify the design with TLC before implementation, and subsequently audit the final code against the initial verified specification.

Running TLC model checking requires a .tla module defining the state machine specification and a .cfg configuration file specifying the model parameters. These files are generated automatically from your source code or planning documents to initiate the exhaustive state exploration.