Topic · software verification plan

What is a software verification plan, and how do I keep it true in CI?

Gist

A software verification plan here is the per-requirement list of how the shall will be substantiated, written before the code exists. Proof fails the merge with proof verify-plan status SYS-REQ-007 --check when a planned strategy or expected evidence id does not resolve on disk. NASA NTRS still hosts the PDF. Jama still authors.

proof verify-plan status SYS-REQ-007 --check

Keep Jama if you store the programme. Keep the Word SVP if the DER asked for one. A green plan status is not a proof of the function, and Proof is not DO-330 qualified.

Request demo Last paper SVP vs this gate

01 · The plan nobody checked

A passing state is not a present strategy.

You can mark the requirement passing while every planned strategy classifies missing. The merge stayed green because nothing asked whether the evidence shape existed yet.

NASA NTRS still hosts a 1990 Software Verification Plan for GCS. ChipVerify and Cadence still mean a hardware Vplan. IEEE 829 still means a test-plan document. This page is the repo gate: each shall carries a closed verification_strategy list and free-form expected_evidence ids, authored before implementation. proof verify-plan status walks the trace graph and the on-disk evidence families. verification_plan_evidence emits a finding when a planned item is missing or partial, with the next command named.

The vector H1 lives on requirements based testing. The pack-after-the-fact H1 lives on software accomplishment summary. The lemma H1 lives on Z3/Kind2 on one function.

proof verify-plan add --req SYS-REQ-007 --strategy code_test --strategy docs_review --evidence pkg/foo/foo_test.go:TestFoo --evidence docs/help/concepts/foo.md
proof verify-plan status SYS-REQ-007 --check
proof audit --check verification_plan_evidence --verbose

On this install the teaching miss is docs_review with no matching review record. The merge stayed green because passing did not mean present.

02 · The exhibit

Same shall. A paper SVP, or a named gap.

The requirement still names two strategies. The review file is not on disk. The gate will fail until a human records the review or retracts the strategy. Click the tabs.

This push

state verification_state: passing
plan code_test, docs_review
review no REVIEW yaml

Merge stayed green

Finding

No invariant. The missing review never entered CI. Passing did not mean present.

Silent skip

This push

Still last week's shall. Still two strategies. Still no review record until someone writes one or drops docs_review.

Keep the SYS-REQ

Proof

Ask proof verify-plan status SYS-REQ-007 --check
Kind docs_review missing

record it or retract it

Same shall. A paper SVP, or a named gap. Click the tabs.

Invariant	What they do	What Proof does
NASA NTRS / Word SVP	A document that outlines reviews, analyses, and tests for the programme.	Not this check. Proof does not write that PDF. Keep the Word file if the DER asked for one.
Cadence / ChipVerify Vplan	A hardware verification plan: features, coverage, testbench success criteria.	Not this URL. Proof does not plan pre-silicon tests.
IEEE 829 software test plan	A project-level test document: scope, resources, schedule.	Not a generator. The shall-derived cases live on requirements based testing.
code_test present	A coincidental passing state, or a test that does not name the shall.	A `verified_by` edge to a test path. Missing until the edge exists.
docs_review present	A help topic path in expected_evidence with no review record.	A `documented_by` edge and a `proof/reviews/REVIEW-*.yaml` with `kind=docs_review`.
known_issue strategy	A sticky-note KI without evidence_manifests, treated as substantiation.	An open or reviewed KI that names the requirement and carries evidence_manifests. A KI is not a substitute for AcceptedRisk.
Jama / DOORS	A verification-method field on the requirement object in the ALM.	Jama still authors. IBM DOORS stays a mention on Proof vs Jama.

Every missing item admits two resolutions: supply the evidence shape, or retract the strategy. They are alternatives, not steps. --check exits non-zero on missing or partial. The audit check defaults to warning. Projects may set it to info in proof.yaml. Do not mark the requirement passing to clear the finding. Do not point expected_evidence at a neighbouring test. That produces a plan that passes while verifying something nobody intended.

proof review record --kind docs_review --reviewer human:lb --subject SYS-REQ-007 --decision approved
proof verify-plan add --req SYS-REQ-007 --remove-strategy docs_review
proof verify-plan status SYS-REQ-007 --check

We have not run Jama verification-method fields and Proof on the same frozen corpus, and we have not claimed this gate is a DO-178C SVP or a DO-330 qualification pack. The loss is named, not scored.

03 · The honest loss

A green plan status is not a proof of the code.

Proof fails when a planned strategy does not resolve to the required evidence shape. It does not invent the shall you never wrote. Jama still authors.

The check does not write the NASA Software Verification Plan PDF. It does not qualify the tool under DO-330. Named on DO-333 and DO-178C-style verification. It does not generate IEEE 829 test-plan sections. It does not run Cadence coverage. present on code_test is a trace edge, not a Z3 lemma. That H1 lives on Z3/Kind2. Carve-outs are narrow: accepted_risk, or ship_with_known_issue plus a matching AcceptedRisk. A KnownIssue alone does not satisfy a planned strategy.

The pack you hand the reviewer after the fact stays on software accomplishment summary. Jama still authors.

Request demo How the install is bought

04 · Nearby questions

What people type next.

What is a verification plan? ChipVerify and Cadence own that SERP as a hardware Vplan. Same cluster as this URL only when the shall is software. Not a twin for pre-silicon work.

What is a software test plan? IEEE 829 / GeeksforGeeks / TestRail. Proof does not generate that document. The shall-derived cases live on requirements based testing.

What is DO-330? Tool qualification. Proof is not qualified. Named loss, not a page that pretends otherwise.

What is a software accomplishment summary? The pack after the work, not the plan before it. software accomplishment summary.

What is IEEE 730? A software quality assurance plan. Proof does not author that template. Not this URL.

Is Proof a Jama alternative for the verification method field? No. Jama still authors. Proof fails the merge when the planned strategy does not resolve.