Topic · Z3 / Kind2

How do I prove a specific function meets its specification using something like Z3 or Kind2?

Proof hangs a lemma on the Go function and hands it to Z3. PROVED means no input falsifies the property. Kind2 is the other solver: it asks whether the shalls have any implementation at all.

proof verify-lemma --solver z3 ./pkg/numeric/...

SPARK, Frama-C, and CBMC still win on C. Dafny and TLA+ still win when the spec is an arbitrary language. Proof lemmas live next to the function you ship.

Request demo One lemma, every int

01 · The distinction

A unit test is a sample. A lemma is the whole type.

You write Abs(-3) == 3 and the suite is green. You did not ask about zero, or MaxInt, or the values nobody typed. Z3 does.

The lemma is a comment on the production function. There is no second file the prover can drift from. Read it as: for every int x, Abs(x) >= 0.

// reqproof:lemma abs_nonneg func(x int) bool {
//   return Abs(x) >= 0
// }
func Abs(x int) int {
    if x < 0 {
        return -x
    }
    return x
}

Kind2 does not prove that function. It takes the FRETish shalls, compiles them to a Lustre contract, and answers realizability: given the assumptions, does any implementation exist? If the shalls contradict, the code is not the problem yet.

02 · The exhibit

The suite hit three values. Z3 asked the rest.

Drawn from the lemma in the help pages. Not a score from someone else's analyzer.

The suite

Hits Abs(5), Abs(-3)
Misses 0, MaxInt, the rest

Sample

Not asked. The lemma is not in the test file.

Waiting

The suite

Still three values.

Sample

Proof

Lemma Abs(x) >= 0 for every int
Command proof verify-lemma --solver z3

PROVED

Same function. Two denominators. Click the tabs.

Input	Unit test	Z3 lemma `Abs(x) >= 0`
`x = 5`	Hit	In the model
`x = -3`	Hit	In the model
`x = 0`	Often unwritten	In the model
Every other `int`	Not in the suite	In the model

Change the lemma to Abs(x) > 0 on purpose. Z3 returns a counterexample you can paste into a test: x = 0. Revert to >= 0. PROVED again. That is the load-bearing UX.

[ok] abs_nonneg                  PROVED (z3, 12ms)

1 lemma checked, 1 proved, 0 failed, 0 unknown.

proof verify-lemma --solver z3 ./pkg/numeric/...
proof realize specs/system autopilot --solver kind2

Put the first command in CI. A later commit that breaks the property fails the build. The second command is the shall-set check: Kind2, not Z3. Formal proofs in a normal pipeline are those two exit codes, not a research notebook.

Job	Z3 lemma	Kind2 realize
This function, every input	Yes. The host is the Go source.	No. Kind2 never sees the function.
The shalls have an implementation	No. A lemma is not a contract set.	Yes. Lustre from FRETish.
A falsifying input you can copy	Yes, when the lemma fails.	A conflict set among shalls, not a Go input.

03 · The honest loss

PROVED is only the property you wrote.

Z3 will not invent the lemma you forgot. A green lemma is not a proof that the function does what the product promised. It is a proof of the comment.

We have not run Z3 or Kind2 against CBMC, SPARK, or Dafny on a frozen corpus. If you certify C, keep their toolchain. Proof does not instrument C, and it does not speak SPARK contracts.

Kind2 realizability is not a proof of the Go. Dafny, Alloy, and TLA+ still keep specs that are not 288 FRETish templates. Jama still wins at programme authoring. The shalls themselves are the FRETish compiler. Coverage of conditions is MC/DC for Go.

Request demo Instruments