  Model checkers use automated state exploration in order to prove various
properties such as reachability, non-reachability, and bisimulation over state
transition systems. While model checkers have proved valuable for locating
errors in computer models and specifications, they can also be used to prove
properties that might be consumed by other computational logic systems, such as
theorem provers. In such a situation, a prover must be able to trust that the
model checker is correct. Instead of attempting to prove the correctness of a
model checker, we ask that it outputs its "proof evidence" as a formally
defined document--a proof certificate--and that this document is checked by a
trusted proof checker. We describe a framework for defining and checking proof
certificates for a range of model checking problems. The core of this framework
is a (focused) proof system that is augmented with premises that involve "clerk
and expert" predicates. This framework is designed so that soundness can be
guaranteed independently of any concerns for the correctness of the clerk and
expert specifications. To illustrate the flexibility of this framework, we
define and formally check proof certificates for reachability and
non-reachability in graphs, as well as bisimulation and non-bisimulation for
labeled transition systems. Finally, we describe briefly a reference checker
that we have implemented for this framework.
