The model check command decides predicates by exhaustively
considering all possible combinations of values for its local declarations.
It is applicable to universal and existential quantification predicates
in which all variables are constrained to finite integer ranges using ..
or to enumerated free types by reference to the type
or to set extensions of integers or enumerated elements.
The constraints on those variables must involve
only first-order logical connectives
(,
,
,
,
,
),
the predicates true and false,
the ordering relations (<,
, =,
, >,
),
the arithmetic functions (+, -, *, div, mod),
number literals,
and variables bound by the quantifiers.
The model check command works by interfacing the Z predicate to the freely available SMV model checking tool.
All the numeric functions and relations used must have been declared in the prelude, or in sections called numdefs or numkit or toolkit.
"model check" p1 p2
This example applies the model check command to predicates p1 and p2.