Formal methods assurance levels debated: TLAPS-proven properties can still fail in real systems

moarbugs · x · 2026-11-05

A technical exchange clarifies the assurance boundary of formal verification: TLAPS-Bench doesn't concern the implementation, so even if TLAPS proves property P in a system's model, P can still be violated in the actual system.

maxvonhippel is working on an illustration of the assurance hierarchy across formal methods — where "actual code" means proof semantics equal execution semantics (as in ACL2 and SBLC), alongside weaker guarantees like differentially fuzzed "slop semantics" and "slop translations." moarbugs adds the caveat that every claimed silver bullet is either BS or marketing.

Related event: TLAPS-Bench Authors Clarify: Proving Specs Does Not Mean Bug-Free Implementations(4 posts)→

Original post →

More from Research

Research channel →