Not automatically. A successful formal proof can provide strong evidence that code satisfies a precisely stated property under stated assumptions. It cannot show that the property captures what users actually need, nor does it cover code, dependencies, or behavior outside the analysis boundary. Bend 2 and Ada/SPARK both support formal reasoning, but they use different languages and workflows, and there is no controlled head-to-head evidence here showing that one makes AI-written software categorically more trustworthy.
What a proof does—and what it leaves unanswered
A proof connects a formal claim to a model of the code. For example, a contract might state that a function returns a value within a specified range whenever its precondition holds. If the proof succeeds, the analyzed implementation satisfies that claim within the tool’s model and assumptions.
As an Amazon Associate I earn from qualifying purchases.
That result is meaningful, but narrower than “the program is correct.” A proof does not invent requirements, determine whether they are sensible, or establish properties that were never specified. If a requirement is incomplete or wrong, code can satisfy its formal version and still fail its intended purpose.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →- What is the exact property? Is the goal freedom from selected run-time errors, compliance with a function contract, or something else?
- What code is analyzed? Identify which modules and operations are inside the proof boundary and what is called through external interfaces.
- What assumptions does the result depend on? These may include preconditions, models of dependencies, compiler behavior, and the proof tool’s trusted components.
- What remains outside it? Integration behavior, deployment configuration, security properties, and requirements not encoded in the specification may still need testing, review, or separate analysis.
Formal proof is therefore one kind of evidence—not a blanket warranty of security, fitness for purpose, or absence of every bug.
#1 Best Overall
How Bend 2 and Ada/SPARK approach proof
Bend 2 expresses laws in Bend and requires corresponding proof code for properties checked this way. Ada/SPARK uses Ada contracts and SPARK annotations, with GNATprove analyzing properties such as data flow, initialization, run-time safety, and contract conformance. The approaches share a need for explicit claims, but their language ecosystems and workflows differ.
| Question | Bend 2 | Ada/SPARK |
|---|---|---|
| How are properties specified? | Laws are expressed in Bend, with corresponding proof code required for checked properties. | Ada contracts and SPARK annotations describe properties such as preconditions, postconditions, and data flow for GNATprove. |
| What can the proof support? | That checked laws hold for the modeled code when the relevant proof succeeds and the checker and assumptions are trusted. | Analysis of flow and initialization, targeted run-time safety properties, and conformance to specified contracts in analyzed SPARK code, under the analysis assumptions. |
| What must people contribute? | Choose relevant laws, formalize them accurately, inspect assumptions and coverage, and address behavior beyond the proof. | Mark code for analysis, write relevant contracts and invariants, inspect assumptions, and resolve or account for unproved checks. |
| What maturity caveat applies? | The Bend project describes Bend 2 as a new language and lists limitations. It also says the checker itself has no proof, while --verdict uses a proven kernel. |
AdaCore documents a contract-based workflow, while noting prover limitations, unsupported properties, and potentially significant effort for stronger functional proofs. |
Neither column means “AI code is safe by default.” In both, people remain responsible for selecting the properties, understanding what is included in the analysis, and dealing with anything the tools do not establish.
What SPARK can prove—and why contracts matter
AdaCore describes SPARK as allowing programmers to prove absence of run-time errors and functional correctness of code. Those are distinct targets. GNATprove can analyze flow and initialization and prove targeted run-time safety properties; a functional claim depends on the contracts that express the intended behavior. More demanding proofs can require additional annotations, including loop invariants.
A successful absence-of-run-time-errors analysis should not be read as proof of functional correctness: code might execute without the targeted run-time faults yet produce an undesired result. Conversely, a contract can define a desired result, but the proof only addresses the contract actually written and the code within the analysis scope.
AdaCore’s SPARK practice guide also describes boundaries and limitations: some properties are difficult to express, prover heuristics can fail to discharge checks, and its stated analysis guarantee does not cover every possible run-time error, including Storage_Error. Teams need to inspect what was analyzed and what assumptions were made rather than treating a tool’s overall status as a universal certification.
What Bend 2’s proof status means
The Bend project calls Bend 2 “a new language” and documents limitations and missing ecosystem features. That is a project self-description, not an independent assessment of language quality. Its documentation also distinguishes the checker from the kernel used by --verdict: the project says the checker itself has no proof, while --verdict uses a proven kernel.
That distinction matters when evaluating what a green result means. A proven kernel can strengthen confidence in the final checking step, but it does not make the specification correct, eliminate assumptions, or show that every relevant part of an application was checked. The Bend project publishes benchmark examples on its site; those are project claims, not an independent comparative evaluation of correctness or proof speed.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteAI-written code adds a separate specification problem
Generating an implementation and generating a useful formal specification are separate tasks. An AI may produce code that appears plausible while omitting edge cases or misreading a requirement. It may also produce annotations that are incomplete or incorrect. A prover can check consistency with encoded claims; it cannot decide on its own whether those claims capture the user’s intent.
Best Value
A 2025 SciTePress paper reported that Marmaragan with GPT-4o generated correct SPARK annotations for 50.7% of cases in the paper’s benchmark. That is a result for that system and benchmark—not a production correctness rate, a probability that arbitrary AI-written programs are correct, or a comparison with Bend.
A 2026 arXiv preprint, “The Prover Is the Judge,” reports 49,280 discharged proof obligations in its Ada/SPARK project. The authors describe functional correctness for selected primitives and absence of run-time errors for the rest. The count describes that project’s reported scope; it is not a universal trust score, and it should not be compared directly with the annotation benchmark’s percentage.
What to do when a proof obligation is unproved
An unproved obligation is not evidence that the code is wrong, but it is also not evidence that the property holds. The tool has not established the claim. The cause may be a real defect, a missing or inaccurate contract, an invariant the prover needs, unsupported analysis, or limits in the prover’s ability to find a proof.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Identify the exact claim. Read the failed obligation and determine whether it concerns a precondition, postcondition, run-time check, flow property, or another stated condition.
- Check the implementation and specification together. Look for defects in the code as well as missing cases or incorrect assumptions in the contract.
- Add justified annotations where needed. An invariant or stronger contract can help, but it must reflect the intended behavior rather than merely silence a failure.
- Record what remains unresolved. Keep unproved checks visible and decide whether to change the implementation, narrow a claim, use other evidence, or accept a documented residual risk.
Do not relabel an unproved property as proven because tests pass. Tests can provide valuable evidence for exercised inputs and scenarios, but they do not discharge a formal proof obligation.
Choosing between Bend 2 and SPARK
The practical choice starts with the code and ecosystem you need to support, not with a claim that one approach is inherently more trustworthy. Bend 2 is a new language designed around laws and proof; SPARK is an Ada subset with a GNATprove contract workflow. The available evidence does not provide a controlled head-to-head trial.
Quick Recap
- Consider SPARK when the project can use its Ada-based workflow and you want contract-driven analysis of specified behavior and targeted safety properties. Plan for the work of writing contracts, adding invariants where needed, and understanding prover limitations.
- Consider Bend 2 when the project is suited to Bend’s language and law-and-proof approach, and your team is prepared to work within the project’s documented limitations and ecosystem maturity.
- For either choice, make the target property, code boundary, assumptions, tool trust basis, and treatment of unproved checks explicit before relying on a proof result.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
