Kani: A Model Checker for Rust Verification
Kani compiles Rust's MIR into CBMC's engine to prove unsafe-code soundness, functional correctness and panic-freedom, running thousands of harnesses in production CI for the Rust standard library.
Kani is an open-source bounded model checker for Rust that goes beyond compiler guarantees to prove the soundness of unsafe operations (such as raw pointer dereferences), functional correctness, and absence of runtime panics. It compiles proof harnesses from Rust's MIR representation and feeds them into CBMC's bit-precise verification engine, automatically checking a broad set of safety properties without requiring user annotations.
To extend verification from bounded to unbounded scope, Kani offers a specification language featuring function contracts, loop contracts, quantifiers, and function stubbing. Case studies on industrial Rust codebases show these contracts elevating verification from mere panic-freedom to full functional correctness, surfacing six previously unknown bugs.
Kani now operates at production scale, with over 16,000 harnesses verified per code change as part of the Rust standard library's verification effort. This demonstrates that formal verification tooling can be practically integrated into large, real-world systems software, pushing Rust's safety guarantees well beyond what the compiler alone provides.