Topic · inconsistent requirements

Inconsistent requirements

Gist

Two shalls are inconsistent when there is an input on which they cannot both hold. Proof fails the merge with proof check consistency specs/system admin when a pair is UNSAT, and with consistency_pair_coverage when the run examined zero pairs. MathWorks still tables the block. Jama still authors.

proof check consistency specs/system admin

Keep Jama if you store the programme. Keep Kind2 if you need realizability of the whole set. A SATISFIABLE pair is not a proof of the function, and a skip is not a pass.

Request demo Last silent skip vs this gate

01 · The skip that looked like a pass

Exit 0 can mean nothing was examined.

Pairwise pruning is sound for conflict detection. It is not assurance. A component whose shalls share no output vocabulary gets zero pairs, and the command still exits 0.

On a 152-requirement e-commerce spec in this install, proof check consistency printed Total Pairs: 3, Checked: 0 and exited 0. A permission-matrix contradiction between two source documents sailed through every gate. The merge stayed green because nothing asked whether a pair had been examined.

MathWorks still identifies inconsistent rows in a Requirements Table block. IBM ODM still checks business-rule conflicts. fsck still means a filesystem. This page is the repo gate: FRETish guarantees, pairwise Kind2, and a structural count of which pairs the solver would actually see. consistency_pair_coverage fails when every pair was pruned and no mutex group or independence attestation explains why.

The missing-class H1 lives on requirements completeness. The realizability H1 lives on k-induction. The assume/guarantee match H1 lives on design by contract.

proof check consistency specs/system admin
proof audit --check consistency_pair_coverage --verbose
proof audit --check cross_spec_consistency_clean --verbose

On this install the teaching miss is a silent skip: three candidate pairs, zero examined, exit 0. The permission matrix stayed contradictory because disjoint vocabularies never reached the solver.

02 · The exhibit

Same corpus. A green skip, or a named gap.

The shalls still contradict on the permission matrix. The last run never put them in one pair. The gate will fail until a human shares vocabulary, declares a mutex, or attests independence. Click the tabs.

This push

reqs 152 FRETish guarantees
pairs Total 3, Checked 0
exit 0

Merge stayed green

Finding

No invariant. The permission-matrix pair never entered the solver. Exit 0 did not mean consistent.

Silent skip

This push

Still last week's shalls. Still disjoint vocabularies. Still no mutex until someone shares a variable, declares a group, or attests independence.

Keep the SYS-REQs

Proof

Ask proof check consistency specs/system admin
Kind NOTHING CHECKED: 0 of 3 pairs

share, mutex, or attest

Same corpus. A green skip, or a named gap. Click the tabs.

Invariant	What they do	What Proof does
MathWorks Requirements Table	Flags a requirement set as inconsistent when one data item can equal more than one value during simulation.	Not Simulink. Proof does not open that block. Keep MATLAB if the model lives there.
IBM ODM consistency checking	Checks whether business rules contain semantically conflicting elements.	Not a rules engine. Proof does not author ODM.
fsck / FileMaker / Domino	A filesystem or database repair pass named consistency check.	Not this URL. Proof does not scan disks.
Pairwise Kind2	A coincidental green run on disjoint vocabularies.	`proof check consistency` on shared outputs. UNSAT is a named pair. Zero examined is a banner, not a pass.
Mutex across components	Two shalls on the same event that demand exclusive modes, spotted by eye.	`cross_spec_consistency_clean` when a declared `domain.mutex` or one-hot idle clause makes the joint consequent unsatisfiable. Single-atom consequents only.
Independence	An implied pass because nothing overlapped.	A reviewable attestation in the vars file, reason at least 16 characters, or a mutex group that actually connects the pair.
Jama / DOORS	A review comment that two objects look related.	Jama still authors. IBM DOORS stays a mention on Proof vs Jama.

Every silent skip admits three resolutions: restructure the shalls onto variables they genuinely share, declare a mutex group with proof var mutex add, or record an independence attestation. They are alternatives, not steps. Do not add dummy variables to create connectivity. That is vocabulary theater and lands as variable_orphans_clean.

proof var mutex add admin tenancy --members admin_ok,admin_suspended --reason "one response at a time"
proof check consistency specs/system admin
proof audit --check consistency_pair_coverage --verbose

We have not run MathWorks Requirements Table and Proof on the same frozen corpus, and we have not claimed this gate is IBM ODM or a proof of the Go. The loss is named, not scored.

03 · The honest loss

A SATISFIABLE pair is not a proof of the code.

Proof fails when two guarantees cannot both hold, or when the run examined nothing. It does not invent the shall you never wrote. Jama still authors.

The check does not decide that the system can be implemented. That gate is k-induction and proof realize, not this URL. It does not fill missing classes. That H1 lives on requirements completeness. cross_spec_consistency_clean ignores compound consequents by design. Mixed assume/guarantee pairs are different sides of a contract, not a contradiction. Pairwise Kind2 does not carry cross-component mutex unless a group is declared.

The assume/guarantee match H1 stays on design by contract. Jama still authors.

Request demo How the install is bought

04 · Nearby questions

What people type next.

What is consistency checking? IBM ODM, fsck, FileMaker, and Domino own that SERP as rules or disks. Same cluster as this URL only when the shalls are software requirements. Not a twin for filesystems.

What is requirements completeness? Declared classes and catalog ids, not pairwise UNSAT. requirements completeness.

What is k-induction? Realizability of the whole set, not a pair conflict. k-induction.

What is design by contract? Matching assumes to guarantees across a cut. design by contract.

What is an assume guarantee? Later, on the design-by-contract URL. Not this H1.

Is Proof a Jama alternative for spotting contradictory objects? No. Jama still authors. Proof fails the merge when a pair is UNSAT or when nothing was examined.