Ron Pressler

TLA is one of the systems that are actually very practical. You can go up or down as many abstraction layers as you need . There's a great introduction written by @pron on his blog [1]. However, it's worth pointing out that you don't magically get the final program out of the TLA proof. The proof only works for the abstraction level that you chose to write it at. [1] https://pron.github.io/

> Any rhetorical device that equates Java/C# (any memory safe Turing language ) safety with C is most likely a fallacy. I agree, but I didn't do any of that. If anything my point was that 1. safety is clearly not a binary thing and no one really treats it as such (even those who claim it is a binary distinction) and 2. that trying to extrapolate from one language to another based on choosing some property that we think is the most relevant one may be assuming that which we seek to prove. Saying that C, C++, and Zig are "the same" because they all make fewer guanratees than Rust is as silly as saying C, C++, Zig, and Rust are the same because they all offer fewer guarantees than ATS, or that Rust and Java are the same because they offer similar guarantees but with very different complexity costs. Also, the focus on memory safety is justified because of the security bugs it causes, but the two major kinds of unsafety (out-of-bounds access and use-after free) aren't equally dangerous, and Rust pays most of its complexity cost to prevent the less dangerous of the two (https://cwe.mitre.org/top25/archive/2024/2024_cwe_top25.html). There's even more nuance here, because some techniques focus on reducing the risk of exploitable use-after-free bugs without preventing it or even making it easier to detect at all (https://www.cl.cam.ac.uk/~tmj32/papers/docs/ainsworth20-sp.pdf). It's all a matter of degree, both when it comes to the risk as well as to the cost of avoiding it. Not…

1. Unfortunately the set of "some" programs is unknown and most probably really small. 2. Even proving anything about finite state machines is NP hard so the problem is harder than just using weaker model of computation. 3. Proofs are not reuable: proving something about one program does not tell us anything about other programs. See excellent https://pron.github.io/posts/correctness-and-complexity for more details.

Yep yep, I totally agree with that. Obviously there are subjects where it would be extremely difficult (if not impossible) to express in a short format, and obviously if it requires it, then take the amount of space that you need. I think the goal should be "aim for brevity, but be clear." One of my favorite examples of this are Ron Pressler's "TLA+ in Practice and Theory" posts. It's four extremely long blog posts, but it contains what feels like multiple textbooks' worth of information in there. By comparison to how long it could be, I think it's incredible how concise it is. [1] https://pron.github.io/tlaplus

OP is perhaps being a bit modest, but his own website https://pron.github.io/tlaplus is a fantastic resource.

To get an overview of what all are involved in "Formal Methods" see Understanding Formal Methods by Jean-Francois Monin. The book gives an overview of both the various mathematical models and some of the tools implementing them. There is a lot here and it may seem haphazard but that is only because we haven't yet grasped the "full picture". I have been reading this for a while but still have a long way to go. A four-part TLA+ in Practice and Theory by user "pron" - https://pron.github.io/posts/tlaplus_part1

This three-part series of (long) posts is a very thorough and fascinating counterpoint to the idea that computation was discovered and that there is anything surprising about the confluence of lambda calculus, Turing machines etc, mostly using primary sources from Leibniz onwards: "Finite of Sense and Infinite of Thought: A History of Computation, Logic and Algebra" https://pron.github.io/posts/computation-logic-algebra-pt1

I agree with you here but I get to a happy conclusion. The (self- or culturally imposed) constraint on computation to be semantically meaningful for humans does not apply for genomes. But this is already useful, because it means we at least have a hint about where to dig more in programming. There is Theory of Computation and there is Theory of Programming. Your arguments apply to TOP but not to TOC. https://pron.github.io/posts/what-we-talk-about-when-we-talk-about-com…

> (and have written much about it, e.g. https://pron.github.io/posts/correctness-and-complexity) Wow, thanks for that link. I only made it through the first part for the moment but it is an incredible read. You clearly thought about this more deeply and carefully than I did. Edit: I'm not entirely sure how that came across so I want to explicitly say that this is not a dry ironic statement (communication is hard, and I am a poor writer).

Whether or not it's incredibly stupid, you're in good company: it occurred to Leibniz, too. Search for 'prime' at https://pron.github.io/posts/computation-logic-algebra-pt1 (though for him the unique IDs were for concepts rather than individuals).

Ron Pressler (the presenter) is an active contributor to HN [1], and he blogs at blogs at https://pron.github.io [2]. There he has a multi-part blog post under the same name as the presentation, and if he chimes in here, he may be able to provide ptrs to additional resources (else ping him on Twitter [3]). [1] https://news.ycombinator.com/user?id=pron [2] https://pron.github.io, http://www.paralleluniverse.co [3] https://twitter.com/pressron, https://twitter.com/puniverseco

Not that unreasonable, depending on what your use case is. There are some good, very approachable guides out there like this one[0]. [0] https://pron.github.io/posts/tlaplus_part1

> I recently watched your video citing all the mathematical evidence that correctness may not decompose For myself and others, are you referring to the video here: https://pron.github.io/posts/correctness-and-complexity ?

This is not limited to software development. Try being involved in Wikipedia and you'll eventually have the displeasure of experiencing the same lack of structure and rigor in arguments. (I'll say, though, that the author mentions GitHub, which does seem particularly bad in comparison to the average Bugzilla instance, say, 10+ years ago, and it's part of why I avoid GitHub, purely for my own sanity and productivity.) It's these experiences that make you appreciate the role of a judge if you've ever sat in court or read through trial transcripts. What we're all really aching for is a solution to the ratiocination problem. pron put together a nice overview of some of the history of thought in that area a couple years back[1]. There's also the Toulmin model[2]. 1. https://pron.github.io/computation-logic-algebra 2. https://en.wikipedia.org/wiki/Stephen_Toulmin#The_Toulmin_Model_of_Arg…

here you go; https://pron.github.io/posts/tlaplus_part1

https://www.youtube.com/watch?v=hhGnMbw98u8 https://www.youtube.com/watch?v=tfnldxWlOhM https://www.youtube.com/watch?v=HnOix9TFy1A https://pron.github.io/posts/tlaplus-curryon-talk https://learntla.com/introduction/ https://leanprover.github.io/theorem_proving_in_lean/ https://rise4fun.com/dafny