Imandra Protocol Language

Mathematical models of complex APIs

A protocol-independent language for system connectivity specifications — turning FIX specs into precise API models that engineers, formal tools, and LLMs can reason about, including the edge cases prose specs leave ambiguous.

Language
Formal DSL for expressing logic of complex APIs.
Reasoning
Designed for analysis by automated reasoning engines.
IDE
Powerful IDE support and APIs.

Powered by:

Protocol-independent connectivity specs

IPL expresses how systems connect and behave — starting with FIX, extensible to other protocols.

IPL was designed as a protocol-independent language for system connectivity specifications. Today's libraries focus on FIX; the framework generalizes to other protocols.

Markets depend on interconnected systems understanding each other safely. IPL provides a rigorous way to specify and verify trading behaviour — making machine-reasonable regulations actionable.

Read the full Getting started article.

IPL source code in VS Code with a hover tooltip showing FIX field documentation
A formal digital twin of your FIX gateway

An IPL model is more than documentation — it can be co-simulated against your production environment so spec and implementation stay in lock-step.

From tangled onboarding to an orderly digital twin of a FIX gateway

Unlike a PDF of a FIX spec or “rules of engagement,” an IPL model is a program. Imandra FIX Wizard, audit tooling, and onboarding flows all read from the same model, and the model itself can be exercised against the live endpoint.

Every team works from the same source of truth, and divergence between what you document and what you run becomes observable rather than something customers report.

Co-simulated against production
The IPL model is executable and can be run against the live gateway — what your customers read matches what they connect to.
One source of truth
Onboarding, QA, product, and client teams query the same digital twin instead of stitching together PDFs, tickets, and tribal knowledge.
Drift is detectable
Differences between the spec and the running system surface as concrete failures, not customer-reported bugs months later.
IPL digitizes specifications

The same field that takes a paragraph of prose in a FIX PDF becomes a few lines of typed, machine-checked IPL — easy to encode, hard to introduce errors.

Side-by-side: a typical FIX PDF specification and the equivalent IPL code

A field tag, its allowed values, and the cross-field rule (“required if OrdType = Pegged”) are all expressed directly in IPL — and the type checker catches mistakes before the spec ever reaches a counterparty.

Infinite state machines, not just FSMs

IPL models a system interface as an infinite state machine — expressive enough to capture real protocols, while still amenable to automated reasoning.

Finite state machines run out of room as soon as state carries quantities, prices, or identifiers. IPL keeps the structure of an FSM but lets state, messages, and actions range over rich data — so you can specify behaviour without flattening it.

IPL model: client and internal events feed inbound messages, system state, actions, and outbound messages
What IPL gives you

Strong typing, protocol libraries, and reasoning-ready models for connectivity.

Type inference
Strongly statically typed language where the type checker deduces types and ensures validity in context.
Machine-reasonable
Not only machine readable — enables automated verification, test generation, and regulatory reasoning.
Protocol libraries
Built-in FIX protocol libraries with support for multiple versions and extension points for other protocols.
State management
Model state and transitions as state machines — the basis for automated reasoning over connectivity.
Validity checking
Internal validity construction ensuring specifications return messages with all required fields.
IDE integration
Language server with context-aware completion and hover documentation via the IPL VS Code extension.
From model to test cases, automatically

One of the most-requested IPL features: symbolic decomposition of the model state space, turned into runnable tests that exercise every distinct path through your protocol.

ImandraX analyses each symbolic trace through the model, then generates source code that drives your implementation into the same state transitions and checks the result against expectation.

The output is more than test data — it is a certification artefact that ties a piece of the spec to a concrete, runnable check.

Read about the analysis API and CLI.

Symbolic trace through the IPL state space, on the left, expanded into generated test-driver code on the right
Decompose the state space
ImandraX walks the IPL model symbolically, producing distinct regions of behaviour and the symbolic constraints that characterise each one.
Generate concrete inputs
For every region, the constraint solver synthesises concrete sample points — message field values, state, and event sequences that satisfy the path.
Drive your implementation
The same regions yield runnable test scripts that push your real system through each transition and compare its behaviour against the model.
A function's input domain is carved by ImandraX into distinct regions, each described by constraints and an invariant
Use IPL directly in your editor

Install the Imandra Protocol Language extension to get language-aware editing and documentation generation in VS Code.

Start with the Visual Studio Marketplace listing, then use the GitHub repository for source code, issues, and release details.