How to write a definition of the non-dependent product using Pi types in Lean?...

Proving the 100 Prisoners and a lightbulb with Dafny...

Refinement of a B specification...

Safety via external formal proofs...

Reason for difference in number of reachable states...

Count using # not working in Fact (Alloy)...

Use model checker to check one particular trace...

Model checking with NuSMV...

atomic sequences in Promela. Contradictory in documentation...

Proving properties of sets in Inox/Welder...

Build formal model of UART in NuSMV?...

Isabelle/HOL using addition/subtraction associativity...

How to model variable swap in SMT (Z3)?...

Coq variable exists in list...

Solving equality / inequality in goal, coq code...

How do constraints defined in Alloy result in better software?...

Can I say that a state space is a formal specification of some system's behaviour?...

Why does lean add implicit variables to lemmas from eq?...

Loop invariant not strong enough when manipulating (array) fields of this...

Is there a way to ignore combinational loop error in HDL code?...

Verifying a Dafny method that shifts a region of an array...

How can I prompt Dafny to perform induction on a sequence?...

Dafny insert method, a postcondition might not hold on this return path...

Dafny "no terms found to trigger on" error message...

Spin: error, the version of spin that generated this pan.c assumed a different wordsize (4 iso 8)...

How can abstract intepretation in static analysis be used without formal specification...

Is static analysis really formal verification?...

Inconclusive Assertion in Synopsys VC Formal...

Dafny: rotated region of an array method verification...

how to write a restore reset formal test which has a long timing...