What TLA+ can and can't check

TLA+ is a powerful tool for designing concurrent systems and ensuring they are free of bugs. However, it has limitations in what it can check. To verify a property, you must have a property to verify. TLA+ divides the system into behaviors, each being a sequence of states. It uses boolean expressions and temporal logical operators to define invariants, action properties, and liveness properties.

Safety properties, such as invariants and action properties, ensure that something bad never happens. Liveness properties, like the eventual occurrence of a good outcome, are based on eventual properties.

The limitation of TLA+ lies in the types of properties it can express. If you cannot represent your property as a logical formula, TLA+ cannot help. Important properties that are difficult to formalize fall into this category. TLA+ safety properties can only express properties at the level of individual states or single steps, making it impossible to define properties over two or more steps or over real-time.

It also cannot express properties that are true for some behaviors, only those true for all behaviors. Hyperproperties, which deal with sets of behaviors, are also beyond TLA+'s capabilities. Lastly, TLA+ cannot define properties over the entire state space, limiting its ability to prove metaproperties about the system.