--- title: Why Antithesis? | daily.dev description: Formal methods and deterministic simulation testing (DST) make different tradeoffs for verifying software correctness, Hillel Wayne argues, explaining his move... canonical: https://daily.dev/posts/why-antithesis--kdv3rx93y twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Why Antithesis? | daily.dev og:description: Formal methods and deterministic simulation testing (DST) make different tradeoffs for verifying software correctness, Hillel Wayne argues, explaining his move... og:url: https://daily.dev/posts/why-antithesis--kdv3rx93y og:image: https://api.daily.dev/og/posts/kDV3rx93Y.png og:image:alt: Why Antithesis? og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Why Antithesis? **[Antithesis](https://daily.dev/sources/antithesis)** · 10 min read · 0 upvotes · 0 comments ## Summary Formal methods and deterministic simulation testing (DST) make different tradeoffs for verifying software correctness, Hillel Wayne argues, explaining his move to Antithesis. Formal methods prove properties across all possible executions but only for a low-fidelity abstraction of the system. DST, run inside a deterministic hypervisor, tests the actual codebase but only across a subset of executions. In a demo, running a C++ race condition test 100 million times never caught a 3-thread race, but Antithesis found a 64-thread race a hundred times in five minutes. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What's the difference between formal methods like TLA+ and deterministic simulation testing? Formal methods like TLA+ verify a simplified, abstracted model of a system across all possible executions, catching design-level bugs but missing implementation details. Deterministic simulation testing (DST) runs the actual codebase inside a deterministic hypervisor that can control nondeterminism, inject errors, and rewind to previous states, testing the real system across a large but not exhaustive subset of executions. _Weigh verification strategies like these before picking a testing approach, something daily.dev readers track closely._ ### How effective is deterministic simulation testing at finding rare race conditions compared to brute-force test runs? Running a 64-thread race condition test one hundred million times with plain execution never surfaced even a 3-thread race. Using Antithesis's deterministic simulation testing for five minutes found the 64-thread race one hundred times, because the hypervisor can deliberately inject interrupts and rewind to explore unlucky thread interleavings instead of relying on chance scheduling. _Developers chasing flaky concurrency bugs can follow results like this on daily.dev._ ### Why didn't my TLA+ model catch a race condition that exists in my actual C++ code? The TLA+ model likely treated a compound action, like 'check a counter then increment it', as a single atomic step, so the model checker never explored a thread being interrupted in the middle of it. When that same check-and-increment block was split into two separate steps in the model, the checker immediately found a counter-incremented-twice bug matching the real C++ race condition. _Anyone debugging formal spec gaps can compare notes on modeling pitfalls via daily.dev._ ## Similar posts on daily.dev - [Hypothesis, Antithesis, synthesis](https://daily.dev/posts/hypothesis-antithesis-synthesis-adkxphviv) · Hacker News · 1 upvotes · 0 comments - [Testing Distributed Systems Under Chaos](https://daily.dev/posts/testing-distributed-systems-under-chaos-zmikzoshx) · Tigris · 3 upvotes · 0 comments - [Why we taught agents to break distributed safety properties](https://daily.dev/posts/why-we-taught-agents-to-break-distributed-safety-properties-jgrqpy3fl) · Antithesis · 1 upvotes · 0 comments - [How etcd Solved Its Knowledge Drain With Deterministic Testing](https://daily.dev/posts/how-etcd-solved-its-knowledge-drain-with-deterministic-testing-gf8tocgkb) · The New Stack · 0 upvotes · 0 comments --- [View this post on daily.dev](https://daily.dev/posts/why-antithesis--kdv3rx93y) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Why Antithesis?","url":"https://daily.dev/posts/why-antithesis--kdv3rx93y","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/why-antithesis--kdv3rx93y"},"datePublished":"2026-10-30T16:21:10.262Z","dateModified":"2026-10-30T16:53:41.030Z","description":"Formal methods and deterministic simulation testing (DST) make different tradeoffs for verifying software correctness, Hillel Wayne argues, explaining his move...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7645bfd9fc046867b00496d17ddbab96?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7645bfd9fc046867b00496d17ddbab96?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Antithesis","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Antithesis","logo":"https://media.daily.dev/image/upload/s--17qPGZ9J--/f_auto,q_auto/v1788684980/logos/antithesis?_a=BAMAMicg0","url":"https://daily.dev/sources/antithesis"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/why-antithesis--kdv3rx93y","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Antithesis","item":"https://daily.dev/sources/antithesis"},{"@type":"ListItem","position":3,"name":"Why Antithesis?"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/why-antithesis--kdv3rx93y#faq","mainEntity":[{"@type":"Question","name":"What's the difference between formal methods like TLA+ and deterministic simulation testing?","acceptedAnswer":{"@type":"Answer","text":"Formal methods like TLA+ verify a simplified, abstracted model of a system across all possible executions, catching design-level bugs but missing implementation details. Deterministic simulation testing (DST) runs the actual codebase inside a deterministic hypervisor that can control nondeterminism, inject errors, and rewind to previous states, testing the real system across a large but not exhaustive subset of executions. Weigh verification strategies like these before picking a testing approach, something daily.dev readers track closely."}},{"@type":"Question","name":"How effective is deterministic simulation testing at finding rare race conditions compared to brute-force test runs?","acceptedAnswer":{"@type":"Answer","text":"Running a 64-thread race condition test one hundred million times with plain execution never surfaced even a 3-thread race. Using Antithesis's deterministic simulation testing for five minutes found the 64-thread race one hundred times, because the hypervisor can deliberately inject interrupts and rewind to explore unlucky thread interleavings instead of relying on chance scheduling. Developers chasing flaky concurrency bugs can follow results like this on daily.dev."}},{"@type":"Question","name":"Why didn't my TLA+ model catch a race condition that exists in my actual C++ code?","acceptedAnswer":{"@type":"Answer","text":"The TLA+ model likely treated a compound action, like 'check a counter then increment it', as a single atomic step, so the model checker never explored a thread being interrupted in the middle of it. When that same check-and-increment block was split into two separate steps in the model, the checker immediately found a counter-incremented-twice bug matching the real C++ race condition. Anyone debugging formal spec gaps can compare notes on modeling pitfalls via daily.dev."}}]} ```