[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-83597-en":3,"doc-seo-83597-105":30,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":21,"is_downloadable":21,"audit_status":21,"page_count":22,"language":23,"language_code":24,"site_id":25,"html_lang":24,"table_of_contents":26,"faqs":27,"seo_title":13,"seo_description":14,"update_tm":28,"read_time":29},83597,8796095360427,"Lucas Martin","https://ap-avatar.wpscdn.com/davatar_994ba38a5ba835b3df7d355c54d3ed8d",8,"Research & Report","Kani: A Model Checker for Rust","Rust’s ownership type system prevents many memory errors in safe code, yet key correctness properties remain outside what compilation can prove, including unsafe-operation soundness, functional correctness, and panic-freedom. Kani is an open-source Rust model checker that extends bounded model checking into correctness guarantees. It compiles proof harnesses from Rust’s MIR into CBMC’s bit-precise engine to automatically verify safety properties with no user annotation. A specification language with contracts, loop contracts, quantifiers, and stubbing supports unbounded reasoning, validated on industrial projects with new bug discoveries.","Kani: A Model Checker for Rust  \nRémi Delmas, Zyad Hassan, Qinheping Hu, Rahul Kumar, Felipe R. Monteiro, Thanh Nguyen, Adrián Palacios  \nAmazon Web Services Seattle, WA, USA  \nCelina Val Amazon Web Services Vancouver, BC, Canada  \nMichael Tautschnig  \nAmazon Web Services Seattle, WA, USA Queen Mary University London, United Kingdom  \nJustus Adam∗ Brown University Providence, RI, USA  \nDaniel Schwartz-Narbonne∗  \nDatadog New York, NY, USA  \nCarolyn Zech∗ Massachusetts Institute of Technology Cambridge, MA, USA  \narXiv :2607 .0 1504v 1 [ cs . SE] 1 Jul 2026  \nAbstract  \nRust’s ownership type system prevents memory errors in safe code, but certain desirable properties remain orthogonal to compilation: the soundness of unsafe operations (e.g., raw pointer dereferences), functional correctness, and absence of runtime panics. We present Kani, an open-source model checker for Rust that pushes bounded model checking beyond bug-finding to provide correctness guarantees for these properties. Kani compiles proof harnesses from Rust’s Mid-level Intermediate Representation (MIR) into CBMC’s bit-precise verification engine, automatically checking a comprehensive set of safety properties with no user annotation. To extend verification from bounded to unbounded, Kani provides a specification language comprising function contracts, loop contracts, quantifiers, and function stubbing. We demonstrate feasibility through case studies on industrial Rust projects, where contracts upgraded verification from panic-freedom to functional correctness, uncovering six previously unknown bugs. Kani operates at scale in production CI, with over 16,000 harnesses verified per code change in the Rust standard library verification campaign.  \nCCS Concepts  \n• Software and its engineering → Software verification and validation; Formal software verification.  \nKeywords  \nmodel checking, Rust, formal verification, specification language  \nACM Reference Format:  \nRémiDelmas, Zyad Hassan, Qinheping Hu, RahulKumar, Felipe R. Monteiro, Thanh Nguyen, Adrián Palacios, Celina Val, Michael Tautschnig, Justus Adam, Daniel Schwartz-Narbonne, and Carolyn Zech. 2026. Kani: A Model Checker for Rust. In Proceedings of 39th IEEE/ACM International Conference on Automated Software Engineering (ASE ’26) . ACM, New York, NY, USA, 12 pages.  \n1 Introduction  \nRust has become the language of choice for safety-critical systems software, from embedded operating systems [12, 36] and crypto  \ngraphic protocols [9] to cloud infrastructure [1] . Its ownership type ∗ All work done while at Amazon Web Services.  \nASE’26, Munich, Germany 2026.  \nsystem statically prevents data races and many classes of memory errors [29], but there are three classes of correctness properties that the compiler cannot prove: (1) the correctness of unsafe operations (e.g., raw pointer dereferences, calls to unsafe functions, access to mutable statics, unsafe trait implementations, and union field access) where the compiler still enforces borrow checking and type safety but the developer assumes responsibility for the additional safety invariants these operations require [5, 18]; (2) functional correctness properties such as algorithmic correctness and protocol conformance; and (3) absence of runtime panics from operations like unwrap(), integer overflow, and out-of-bounds access, in contexts where panics are undesirable. Testing and fuzzing can expose some of these failures, but they explore only a finite sample of the input space and provide no completeness guarantee.  \nDeductive verification tools for Rust, including Prusti [4], Creusot [22], and Verus [34], can prove rich functional properties. However, they require substantial proof engineering (e.g., separation logic or ghost state) that limits adoption outside specialist teams [26] . At the other end of the spectrum, dynamic tools like Miri [30] detect undefined behavior at runtime but cannot prove its absence. There is a gap between these extremes: develop","cbCaiiFpCoeAjSVk","https://ap.wps.com/l/cbCaiiFpCoeAjSVk","pdf",760785,3,1,12,"English","en",105,"# Introduction\n## Rust correctness properties beyond compilation\n## Verification approaches and their limitations\n## From bounded model checking to correctness guarantees\n# Kani overview\n## Architecture: MIR to CBMC\n## Specification language for unbounded reasoning\n## Case study results","[{\"question\":\"What correctness properties can the Rust compiler not fully prove, and why does Kani target them?\",\"answer\":\"The compiler cannot prove the soundness of unsafe operations, functional correctness properties, and absence of runtime panics in contexts where panics are undesirable. Kani is designed to provide verification guarantees for these properties beyond what compilation alone can ensure.\"},{\"question\":\"How does Kani perform verification for Rust programs?\",\"answer\":\"Kani compiles proof harnesses from Rust’s MIR into CBMC’s bit-precise verification engine, enabling automated checking of safety properties.\"},{\"question\":\"How does Kani extend bounded model checking to unbounded correctness guarantees?\",\"answer\":\"Kani adds a specification language that includes function contracts, loop contracts, quantifiers, and function stubbing, allowing verification to scale from bounded checking toward unbounded reasoning.\"}]",1784189102,30,{"code":4,"msg":31,"data":32},"ok",{"site_id":25,"language":24,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":28},"kani-a-model-checker-for-rust","",{"@graph":36,"@context":85},[37,53,68],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,50],{"item":41,"name":42,"@type":43,"position":21},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":20},"https://docshare.wps.com/document/research-report/",{"item":51,"name":13,"@type":43,"position":52},"https://docshare.wps.com/document/kani-a-model-checker-for-rust/83597/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":24,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":41,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-26","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"What correctness properties can the Rust compiler not fully prove, and why does Kani target them?","Question",{"text":75,"@type":76},"The compiler cannot prove the soundness of unsafe operations, functional correctness properties, and absence of runtime panics in contexts where panics are undesirable. Kani is designed to provide verification guarantees for these properties beyond what compilation alone can ensure.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"How does Kani perform verification for Rust programs?",{"text":80,"@type":76},"Kani compiles proof harnesses from Rust’s MIR into CBMC’s bit-precise verification engine, enabling automated checking of safety properties.",{"name":82,"@type":73,"acceptedAnswer":83},"How does Kani extend bounded model checking to unbounded correctness guarantees?",{"text":84,"@type":76},"Kani adds a specification language that includes function contracts, loop contracts, quantifiers, and function stubbing, allowing verification to scale from bounded checking toward unbounded reasoning.","https://schema.org",{"og:url":51,"og:type":87,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":89,"canonical":51},"index,follow",{"doc_id":7,"site_id":25},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,122,127,130,134],{"id":21,"doc_module":4,"doc_module_name":46,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":46,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":46,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":46,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":46,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":29,"slug":121},"research-report",{"id":123,"doc_module":4,"doc_module_name":46,"category_name":124,"show_sort_weight":125,"slug":126},9,"Religion & Spirituality",20,"religion-spirituality",{"id":125,"doc_module":4,"doc_module_name":46,"category_name":128,"show_sort_weight":125,"slug":129},"World Cup","world-cup",{"id":131,"doc_module":4,"doc_module_name":46,"category_name":132,"show_sort_weight":131,"slug":133},10,"Lifestyle","lifestyle",{"id":135,"doc_module":4,"doc_module_name":46,"category_name":136,"show_sort_weight":106,"slug":137},19,"General","general"]