Proof. Request demo

Topic · formal methods

Formal methods

Gist

Formal methods ask a solver whether a written property holds for every legal input, not for the three fixtures in the suite. Proof's command for that on authored variable semantics is proof verify-properties specs/system. Z3 is the solver. Coq still owns the assistant. SPARK still owns Ada. A green unit test is not this family. Jama still authors. Proof does not infer the property for you.

proof verify-properties specs/system

Keep Coq if you write Gallina. Keep SPARK if you write Ada. A proved property is not a proof of the Go.

Request demo Last three fixtures vs this property

01 · The examples that never asked Z3

A passing suite is not a universal claim.

You can merge three green cases and still have never asked whether the merge algebra holds for every host list.

The family is old. You write a spec in a language a machine can refuse. You ask a solver, a model checker, or a proof assistant. Either every legal assignment satisfies the claim, or you get a counterexample. Coq does that on Gallina. SPARK does it on Ada. Dafny does it on its own language. Z3 does it on SMT-LIB. Proof does not replace those tools. It takes properties: and data_constraint: you authored on variables and asks Z3, so CI can fail when the claim has a counterexample.

The lemma on a Go function lives on Z3 / Kind2 on one function. The loop obligations live on loop invariant. The Kind2 contract lives on model checking. This page is the family those three sit under: a solver, not another fixture. It is not a second Z3 lecture.

proof verify-properties specs/system
proof verify-properties --solver z3,cvc5 specs/system
proof verify-properties specs/system --format json

Until that command runs, the YAML is prose plus a schema. The solver has not spoken.

02 · The exhibit

Same claim. Three cases, or every legal assignment.

The suite still walks examples. The property is the thing that can fail the build. Click the tabs.

Suite

  • case A hosts = {a}
  • case B hosts = {a,b}
  • case C empty list
Examples held

This push

No properties: block. No data_constraint. No Z3 process. The merge still went green.

Fixtures only

Suite

Still three cases. Still not a claim over the domain. Keep the tests.

Keep the fixtures

Proof

  • Author properties.merge: union
  • Ask Z3, optionally cvc5
  • Gate counterexample or skip listed
SAT assignment

Same claim. Three cases, or every legal assignment. Click the tabs.

Surface What they do What Proof does What we lose
Coq / Isabelle Interactive proof assistant. You write the term. The kernel checks it. Not this command. Proof does not read Gallina or Isar. No assistant. Keep Coq.
SPARK / Dafny Contracts in the language, discharged by a prover. Not this command. Go lemmas live on Z3 / Kind2 on one function. No SPARK frontend. No Dafny frontend.
Galois / MathWorks Explain the family, or sell a toolchain around it. Not an essay mill. Not Simulink. The command proves authored YAML. No Simulink model. No Galois engagement.
Z3 lemma SMT on one function. PROVED means no falsifying assignment. That H1 lives on Z3 / Kind2 on one function. verify-properties does not discharge a lemma. A property is not a lemma. This command does not prove the Go.
Model checking Search every run of a finite-state model. That H1 lives on model checking. Kind2 is a different solver family. SMT is not model checking. No Promela. No SMV.
Unit tests Execute chosen inputs. Green means those inputs held. Keep the suite. This command is the universal claim those cases never asked. Not a test runner. Three greens are not UNSAT.
Jama / DOORS Author and store the programme, including free prose about properties. Jama still authors. Proof holds the claim as a file Z3 can re-read. IBM DOORS stays a mention on Proof vs Jama. Not an ALM. Jama still authors.

The teaching graph is still a variable with properties: or a boolean with data_constraint:. Z3 still has to say whether any assignment falsifies that claim. The suite can stay. CI needs the file.

proof verify-properties specs/system
proof verify-properties --solver z3,cvc5 specs/system
proof verify-properties specs/system --format json

Z3 is the default backend. Pass --solver z3,cvc5 when you want a differential check and a disagreement report. The command proves authored semantics. It does not infer them. Variables that do not emit SMT checks are listed as skipped, not silently counted as proved. Conservative: a skip is not a pass.

03 · The honest loss

Proof asks Z3. Z3 is the solver.

A proved property is not a proof of the code. Jama still authors.

Proof does not implement Coq, Isabelle, SPARK, Dafny, or a proof assistant. It does not implement Z3. Those engines live in the tools you already keep for Gallina, Ada, and SMT-LIB. A proved property means the authored claim had no counterexample in the solver on that run. It is not a proof of the Go you ship. It is not a lemma. It is not Kind2 realizability. Unknown, timeout, skip, or solver error stay non-positive. We have not run this against a frozen Coq, SPARK, Dafny, or Z3 corpus, and we have not scored it against those tools on the same pack. The loss is named, not scored.

proof verify-lemma is a different command. It discharges // reqproof:lemma on a function. That H1 lives on loop invariant and Z3 / Kind2 on one function. Do not treat a clean verify-properties as a lemma verdict.

The Kind2 H1 stays on model checking. The engine H1 stays on k-induction. Jama still authors.

Request demo How the install is bought

04 · Nearby questions

What people type next.

What are formal methods? Same question. Same URL.

What is a theorem prover? A tool that checks a proof term or an SMT query. Z3 is an SMT solver. Coq is an assistant. This command asks Z3. It is not Coq.

What is symbolic execution? Walk the program by formula, not by concrete input. KLEE still owns that family. Not this command.

Is a Z3 lemma formal methods? Yes, one surface. That H1 lives on Z3 / Kind2 on one function.

Is model checking formal methods? Yes, another surface. Model checking.

Is Proof Coq? No. Jama still authors. Proof takes the authored claim and asks Z3 so CI can fail when a counterexample exists.