One control intent often forks across requirements, models, software, and tests, so failures appear late. This talk presents checkable models: keep the same meaning executable and reviewable. AI drafts a TAD specification. Tools parse it, check types and semantics, and run the model against written criteria. Engineers own thresholds, priorities, observation windows, and acceptance. A 10 ms power-window anti-pinch case walks from a complete natural-language requirement through TAD and a real model to model-level scenes on state, priority, timing, and reset.

• Understand how one control intent forks across requirements, models, software, and tests, and the five facts a checkable model must answer: inputs, states, time, outputs, and criteria.
• Learn the division of work: AI drafts TAD, tools perform deterministic checks and execute criteria, and engineers own boundaries and acceptance.
• See how a 10 ms power-window anti-pinch case moves from a natural-language requirement through TAD and a real model to model-level scenes.
• Take away three practices: write inputs, states, time, outputs, and criteria; use TAD to connect requirement, model, and tools; let AI draft, tools check and run, and engineers accept