Back to Devoured - August 13, 2026
DEVOURED
Specula: Scaling formal specifications for autonomous model checking of system code

Specula: Scaling formal specifications for autonomous model checking of system code

AI Murat Buffalo
Specula automates bug detection by deriving TLA+ formal specifications from code and reproducing concurrency bugs through precise integration testing.
What: Specula identifies potential concurrency issues by validating code against automatically generated specifications and then using timing-sensitive tests to confirm the bug's presence.
Why it matters: Formal verification is traditionally labor-intensive; automating the creation of specs moves the practice closer to becoming a standard part of the CI/CD pipeline.
Deep dive
  • Automatically derives TLA+ specifications from source code to model system behavior.
  • Uses trace validation to check if the implementation conforms to the derived model.
  • Specifically targets concurrency bugs that are notoriously difficult to reproduce.
  • Reproduces identified bugs by constructing test cases with carefully controlled timing triggers.
  • Lacks the ability to perform compositional analysis, meaning it cannot guarantee system-level safety by checking individual components.
Decoder
  • TLA+: A formal specification language used for modeling, documenting, and verifying concurrent systems.
  • Concurrency bugs: Software defects that occur when multiple threads or processes interact in unintended ways, often resulting in race conditions or deadlocks.
  • Formal specification: A mathematically rigorous description of a software system's behavior used to prove its correctness.
Original article

Specula is an agentic system that automates the process of software bug finding through authoring and model-checking a spec for the code. It derives TLA+ specifications automatically from the code, checks code-spec conformance through trace validation, model checks the spec to find concurrency bugs, and reproduces the bug at the code layer by writing integration tests with precise timing. This post looks at what Specula gets right, its major contributions, and unresolved questions about the terrain. Specula is a great pragmatic idea, and it works for what it does, but it still skirts the real hard problem of composition, so it cannot say anything about whether per-module guarantees add up to a system-level guarantee.

Explore all 54 articles in today's digest

Fresh dev news, AI-digested daily. Never miss a trend at devoured.fyi