Topic · k-induction

What is k-induction, and how do I keep the traces true in CI?

Gist

k-induction is two SMT queries on a transition system: a base that the property held for k consecutive steps, and a step that it still holds at k+1. Kind2 runs that engine. Proof asks Kind2. proof realize specs/system autopilot --diagnose compiles the shalls to Lustre and returns realizable, or a counterexample. BMC still finds short bugs. Jama still authors. Proof does not implement k-induction, and you cannot set k.

proof realize specs/system autopilot --diagnose

Keep CBMC if you need k-induction on C. Keep Kind2's own CLI if you need to pick the engine. A realizable contract is not a proof of the code.

Request demo Last BMC bound vs this engine

01 · The bound that ended

A property that held for eight steps is not a property that holds.

Bounded model checking unrolls the transition relation k times and looks for a failing prefix. When the bound is exhausted, the search stops. k-induction is the extra query that asks whether that prefix can be extended forever.

Kind2 documents the split. The base is ordinary BMC: does the property fail in the first k steps? The step assumes it held for k consecutive states and asks whether the next state can break it. If the step is unsatisfiable, the property is inductive at that k. If the base is satisfiable, you already have a counterexample. Proof does not run those queries itself. It emits a Lustre contract from the FRETish shalls and hands the contract to Kind2. Kind2 may also switch to IC3/PDR. You do not pick the engine from this command.

The one-function lemma H1 lives on Z3 / Kind2 on one function. The temporal-formula H1 lives on linear temporal logic. The railway-document H1 lives on EN 50128. This page is the engine Kind2 uses on the contract, not a lecture on induction in arithmetic.

proof realize specs/system autopilot --diagnose
proof realize specs/system autopilot --solver kind2 --format json
proof realize specs/system autopilot --dump-lustre

On this install the teaching graph is SYS-REQ-014. Autopilot shall keep mode_safe whenever sensor_valid holds. Until Kind2 runs, CI cannot fail when the shalls have no implementation.

02 · The exhibit

Same shalls. A bound that ended, or a named unrealizable.

SYS-REQ-014 already names the guarantee. BMC can hold for eight steps and then stop. Kind2 k-induction is the extra query. Click the tabs.

Requirement file

id SYS-REQ-014
component autopilot
guarantee mode_safe

Held for k = 8

This push

The bound ended. No step query. No named unrealizable. The merge still went green.

BMC only

Requirement file

Still last week's shall. Still one guarantee. Still no named finding until Kind2 runs.

Keep the SYS-REQ

Proof

Ask Kind2 on the Lustre contract
Gate UNREALIZABLE + diagnose

Step failed · no implementation

Same shalls. A bound that ended, or a named unrealizable. Click the tabs.

query	asks	SAT	UNSAT
BMC / base	fails in the first k steps?	counterexample prefix	holds on that bound
k-induction step	if it held for k consecutive, can k+1 break it?	not inductive at this k	inductive: holds for all time
IC3 / PDR	an invariant from the property	Kind2 may switch engines	not selectable here

Surface	What they do	What Proof does	What we lose
k-induction	Kind2: base BMC plus a step query on a Lustre node.	`proof realize` emits the contract and asks Kind2. Default solver is Kind2.	Proof does not implement the engine. You cannot set k.
BMC	Unroll k steps. Stop when the bound ends or a prefix fails.	Not this command. The base is inside Kind2, not a Proof flag.	No bounded-only mode. Short bugs still belong to BMC tools.
CBMC / ESBMC	k-induction on C, including combined-case variants.	Not this command. Proof lemmas on Go live on Z3 / Kind2 on one function.	No C frontend. No ESBMC portfolio.
Kind2 CLI	Pick engines, set k, inspect Lustre.	`--dump-lustre` prints the contract without invoking the solver. Engine choice stays inside Kind2.	No engine flag. No k flag.
Z3 lemma	One function, every input. PROVED means no falsifying assignment.	That H1 lives on Z3 / Kind2 on one function. Realizability is not a lemma.	This command does not discharge a lemma.
Linear temporal logic	One formula, one finite boolean trace.	That H1 lives on linear temporal logic. Realize does not simulate a handwritten trace.	This command does not walk a user trace.
Jama / DOORS	Author and store the programme, including free prose about safety properties.	Jama still authors. Proof holds the shall as a file Kind2 can re-read. IBM DOORS stays a mention on Proof vs Jama.	Not an ALM. Jama still authors.

The teaching requirement is SYS-REQ-014. Autopilot still shall keep mode_safe when sensor_valid holds. Kind2 still has to say whether any implementation can keep that contract.

id: SYS-REQ-014
component: autopilot
guarantee: mode_safe

proof realize specs/system autopilot --diagnose
proof realize specs/system autopilot --solver kind2 --format json
proof realize specs/system autopilot --dump-lustre

Kind2 is the default. JKind remains a compatibility backend, mainly for witness-trace workflows. --diagnose runs diagnosis on an unrealizable result. --dump-lustre prints the generated contract and exits without invoking a solver. That dump is the first artifact to inspect when a terminal verdict is unexpected. A FRETish -> is boolean implication; Lustre -> is initialization. The emitter rewrites the operators before Kind2 sees the contract. Conservative connected-component decomposition is on by default. Use --monolithic only when one solver invocation is specifically needed for diagnosis.

03 · The honest loss

A realizable contract is not k-induction you can inspect.

Proof asks Kind2. Kind2 runs the engine. You do not set k. Jama still authors.

Proof does not implement k-induction. It does not implement IC3. It does not implement BMC. Those engines live in Kind2 (and in CBMC, ESBMC, Caésar when you use those tools). A REALIZABLE verdict means some implementation of the shalls exists. It is not a proof of the code you ship. It is not a lemma on a Go function. Unknown, timeout, incomplete, malformed, cancelled, or solver error stay non-positive. We have not run this against a frozen Kind2, CBMC, or ESBMC corpus, and we have not scored it against those tools on the same pack. The loss is named, not scored.

The one-function lemma H1 stays on Z3 / Kind2 on one function. The temporal-formula H1 stays on linear temporal logic. The railway-document H1 stays on EN 50128. Jama still authors.

Request demo How the install is bought

04 · Nearby questions

What people type next.

What is k induction? Same cluster, hyphen optional. Same URL. Do not mint a twin.

What is bounded model checking? The base query. Not this H1. BMC still finds short bugs. Proof has no BMC-only flag.

What is IC3 / PDR? Kind2 may switch to property-directed reachability. Not selectable here.

What is realizability? The question Kind2 answers on the contract: does any implementation exist. The English word also names a proof-theory cluster we do not own. This URL is the engine, not Kleene.

What is linear temporal logic? One formula, one finite trace. LTL.

Is Proof Kind2? No. Jama still authors. Proof compiles the shalls and asks Kind2 so CI can fail when the contract has no implementation.