Topic · model checking

What is model checking, and how do I keep the traces true in CI?

Gist

Model checking asks whether every run of a finite-state model satisfies a specification. Kind2 is the checker Proof asks. proof realize specs/system autopilot --diagnose compiles the shalls to a Lustre contract and returns realizable, or a counterexample. SPIN still owns Promela. CBMC still owns C. A Z3 lemma is SMT on one function, not this family. Jama still authors. Proof does not implement the checker.

proof realize specs/system autopilot --diagnose

Keep SPIN if the model is Promela. Keep nuXmv if the model is SMV. Keep CBMC if the model is C. A realizable contract is not a proof of the Go.

Request demo Last lecture vs this contract

01 · The model that never left the slide

A definition is not a verdict on the shalls.

You can recite Clarke, Emerson, and Sifakis and still merge a FRETish contract Kind2 has never seen.

The family is old. You build a finite-state model. You write a spec, usually in temporal logic. The checker searches the state space and either proves the spec on every path, or returns a counterexample path. SPIN does that on Promela. nuXmv does it on SMV. CBMC does a related search on C. Kind2 does it on a Lustre node. Proof does not replace those tools. It emits the Lustre from the shalls and asks Kind2, so CI can fail when the contract has no implementation.

The engine Kind2 may pick on that contract lives on k-induction. The formula you can replay on one finite boolean trace lives on linear temporal logic. The lemma on a Go function lives on Z3 / Kind2 on one function. This page is the family those three sit under, not a second k-induction lecture.

proof realize specs/system autopilot --diagnose
proof realize specs/system autopilot --solver kind2 --format json
proof realize specs/system autopilot --dump-lustre

Until that command runs, the shalls are prose plus a compiler. The checker has not spoken.

02 · The exhibit

Same family. A lecture, or a file Kind2 can decide.

The slide still defines the search. The contract is the thing that can fail the build. Click the tabs.

Slide

model finite-state concurrent system
spec temporal formula
tools named SPIN, nuXmv

Definition held

This push

No Lustre file. No Kind2 process. No named unrealizable. The merge still went green.

Lecture only

Slide

Still the family. Still SPIN on Promela. Still not a file in this repo.

Keep the lecture

Proof

Emit Lustre from the shalls
Ask Kind2
Gate UNREALIZABLE + diagnose

No implementation

Same family. A lecture, or a file Kind2 can decide. Click the tabs.

Surface	What they do	What Proof does	What we lose
SPIN	Model-check a Promela program against an LTL or never-claim.	Not this command. Proof does not read Promela.	No Promela frontend. Keep SPIN.
nuXmv / SMV	Symbolic model checking on an SMV model.	Not this command. Proof does not read SMV.	No SMV frontend. Keep nuXmv.
CBMC / ESBMC	Bounded search and k-induction on C.	Not this command. Go lemmas live on Z3 / Kind2 on one function.	No C frontend. No ESBMC portfolio.
Kind2 CLI	Pick engines, set bounds, inspect Lustre.	`--dump-lustre` prints the contract without invoking the solver. Engine choice stays inside Kind2.	No engine flag. No k flag.
k-induction	One engine Kind2 may run on that contract.	That H1 lives on k-induction. This URL is the family, not the engine.	You still cannot set k.
Z3 lemma	SMT on one function. PROVED means no falsifying assignment.	That H1 lives on Z3 / Kind2 on one function. Realize does not discharge a lemma.	SMT is not model checking. This command does not prove the Go.
Linear temporal logic	One formula, one finite boolean trace.	That H1 lives on linear temporal logic. Realize does not simulate a handwritten trace.	This command does not walk a user trace.
Jama / DOORS	Author and store the programme, including free prose about safety properties.	Jama still authors. Proof holds the shall as a file Kind2 can re-read. IBM DOORS stays a mention on Proof vs Jama.	Not an ALM. Jama still authors.

The teaching graph is still a FRETish shall set compiled to Lustre. Kind2 still has to say whether any implementation can keep that contract. The lecture can stay. CI needs the file.

proof realize specs/system autopilot --diagnose
proof realize specs/system autopilot --solver kind2 --format json
proof realize specs/system autopilot --dump-lustre

Kind2 is the default. JKind remains a compatibility backend, mainly for witness-trace workflows. --diagnose runs diagnosis on an unrealizable result. --dump-lustre prints the generated contract and exits without invoking a solver. That dump is the first artifact to inspect when a terminal verdict is unexpected. Conservative connected-component decomposition is on by default. Use --monolithic only when one solver invocation is specifically needed for diagnosis.

03 · The honest loss

Proof asks Kind2. Kind2 is the model checker.

A realizable contract is not a proof of the code. Jama still authors.

Proof does not implement model checking. It does not implement SPIN, nuXmv, CBMC, IC3, or BMC. Those engines live in Kind2 and in the tools you already keep for Promela, SMV, and C. A REALIZABLE verdict means some implementation of the shalls exists. It is not a proof of the Go you ship. It is not a lemma. Unknown, timeout, incomplete, malformed, cancelled, or solver error stay non-positive. We have not run this against a frozen Kind2, SPIN, nuXmv, or CBMC corpus, and we have not scored it against those tools on the same pack. The loss is named, not scored.

proof verify-model is a different command. It sanity-checks a // reqproof:model field projection against a Go struct. That is drift detection on an SMT abstraction, not this family. Do not treat a clean verify-model as a model-checking verdict.

The engine H1 stays on k-induction. The formula H1 stays on linear temporal logic. The lemma H1 stays on Z3 / Kind2 on one function. Jama still authors.

Request demo How the install is bought

04 · Nearby questions

What people type next.

What is model checking? Same question. Same URL.

What are formal methods? The family this sits under. SMT on authored properties lives on formal methods.

What is bounded model checking? A search that unrolls k steps and stops. Not this H1. Kind2 may use BMC as a base. Proof has no BMC-only flag. The extra query lives on k-induction.

What is symbolic model checking? BDD or SAT search over sets of states. nuXmv still owns SMV. Not this command.

Is Kind2 a model checker? Yes. Proof asks it. Proof is not Kind2.

Is a Z3 lemma model checking? No. SMT on one function. That H1 lives on Z3 / Kind2 on one function.

What is linear temporal logic? One formula, one finite trace. LTL.

Is Proof SPIN? No. Jama still authors. Proof compiles the shalls and asks Kind2 so CI can fail when the contract has no implementation.