Topic · linear temporal logic

What is linear temporal logic, and how do I keep the traces true in CI?

Gist

Linear temporal logic is a formula over one path: always, eventually, next, until. Proof evaluates that formula on a finite boolean trace. proof simulate "G (req -> F ack)" --signals traces.json --length 10 names the first step where the formula is false. Kind2 still proves the contract. A lecture slide still defines the operators. Jama still authors.

proof simulate "G (req -> F ack)" --signals traces.json --length 10

Keep SPIN if you model-check a Promela program. Keep Kind2 if you need realizability. Proof does not turn a true step on one trace into a proof for every trace.

Request demo Last lecture vs this graph

01 · The step nobody replayed

A formula on a slide is not a verdict on a trace.

You can write G (req implies F ack) and still never load the ten steps where req rose and ack never followed.

The Kind2 / one-function H1 lives on Z3 and Kind2 on one function. The DO-333 H1 lives on DO-333. This page is the evaluator: one LTL string, one finite trace, a table of true and false at each step.

The engine is a pure Go parser. No solver is installed for this command. Operators are G, F, X, U, plus boolean connectives. Signals are boolean arrays. If you omit --signals, random traces are generated for the variables in the formula. Results are emitted only by the explicit proof simulate command. A true result means this trace satisfied the formula. It does not mean every trace will.

proof simulate "G (req -> F ack)" --signals traces.json --length 10
proof simulate "F x" --length 5
proof simulate "G (x -> F y)" --format json

On this install the teaching formula is handshake liveness: globally, a request is followed eventually by an ack. The miss is a request that never sees an ack before the trace ends.

02 · The exhibit

Same formula. A silent miss, or a named step.

The lecture still matches the operators. The command will name the step where req rose and ack never followed. Click the tabs.

Source document

formula G (req → F ack)
operators G always, F eventually
listed the handshake, on a slide

Operators the author remembered

This push

req at step 2. No ack after it. The slide never said so.

Silent miss

Source document

Still last week's operators. Still no loaded trace.

Keep the slide

Proof

Ask the formula on this trace
Gate FALSE at the failing step

step 5 · req at 2 never acked

Same formula. A silent miss, or a named step. Click the tabs.

Surface	What they do	What Proof does
Linear temporal logic	Modalities over one path. Wikipedia, CMU notes, IEEE.	`proof simulate` on a finite boolean trace. A false step is named.
SPIN / NuSMV	Model-check a program or a Kripke structure against LTL/CTL	Not this command. Proof does not ingest Promela. Kind2 is a different H1.
Kind2 / model checking	Prove a Lustre contract, or find a counterexample for all traces in the encoding	That H1 lives on Z3 and Kind2 and on DO-333. A true simulate run is not that proof.
Runtime verification	A monitor on a live execution, often LTL3 over infinite / unfinished traces	Not this product. Proof does not ship a runtime monitor.
Property based testing	Random inputs against a property, shrink a counterexample	That H1 lives on property based testing as `proof proptest`. A boolean trace is not a Hypothesis suite.
Jama / DOORS	Author and store the programme	Jama still authors. Proof holds the formula to a named trace and prints the failing step.

The teaching trace is ten steps of req and ack. The formula is handshake liveness. When ack never follows a request before the end of the trace, the evaluator reports FALSE and the step.

{
  "length": 10,
  "signals": {
    "req": [true, false, true, true, false, false, true, false, true, false],
    "ack": [false, true, false, true, true, false, false, true, false, true]
  }
}

proof simulate "G (req -> F ack)" --signals traces.json --length 10

TRUE on this file would mean the handshake held on these ten steps. It would not mean it holds on the next file, and it would not mean Kind2 proved the contract. We have not run this against a frozen SPIN / NuSMV corpus, and we have not claimed the evaluator is a model checker. The loss is named, not scored.

03 · The honest loss

A green simulate run is not a proof.

Proof evaluates one finite boolean trace. It does not quantify over every trace. Kind2 still proves. Jama still authors.

Signals are booleans. There is no integer domain here. There is no past-time fragment. Random traces without --signals are a smoke test, not evidence. Simulation results are emitted only by the explicit command; nothing else in the audit pretends it ran LTL. Runtime verification stays unpaged: Proof does not ship a monitor on a live process. Object-code coverage on C still wants the qualified toolchain. That H1 lives on MC/DC for Go and on Proof vs LDRA.

The Kind2 H1 stays on Z3 and Kind2 and on DO-333. Jama still authors.

Request demo How the install is bought

04 · Nearby questions

What people type next.

What is LTL? Same cluster, acronym head. Same command. Not a twin. Do not rank the three-letter SERP.

How do I prove a specific function meets its specification using Z3 or Kind2? That is the solver H1, not a finite-trace evaluator. Z3 and Kind2.

What is DO-333? Formal methods supplement to DO-178C. Kind2 on the contract, not simulate on a JSON file. DO-333.

What is property based testing? Fixtures from authored variable semantics. property based testing.

What is runtime verification? A monitor on a live execution. Proof does not ship one. Do not mint that URL.

Is Proof a SPIN alternative? No. SPIN model-checks Promela. Proof names a false step on a finite trace.