Section: New Results

Modular SMT Proofs for Fast Reflexive Checking inside Coq

Participants : Frédéric Besson, Pierre-Emmanuel Cornilleau, David Pichardie.

Satisfiability Modulo Theory (SMT) solvers are efficient automatic provers for combination of theories. Those solvers have proved very successful in program verification because they discharge automatically and efficiently challenging verification conditions. SMT solvers are therefore de facto part of the Trusted Computing Base of many program verification methodologies. A consequence is that a soundness bug in a SMT solver can make the whole program verification process unsound.

To tackle this problem, we propose a new methodology for exchanging unsatisfiability proofs between an untrusted SMT solver and a sceptical proof assistant with computation capabilities like Coq. We advocate modular SMT proofs that separate boolean reasoning and theory reasoning; and structure the communication between theories using Nelson-Oppen combination scheme.

We present the design and implementation of a Coq reflexive verifier that is modular and allows for fine-tuned theory-specific verifiers. The current verifier is able to verify proofs for quantifier-free formulae mixing linear arithmetic and uninterpreted functions. Our proof generation scheme benefits from the efficiency of state-of-the-art SMT solvers while being independent from a specific SMT solver proof format. Our only requirement for the SMT solver is the ability to extract unsat cores and generate boolean models. In practice, unsat cores are relatively small and their proof is obtained with a modest overhead by our proof-producing prover. We present experiments assessing the feasibility of the approach for benchmarks obtained from the SMT competition.

This work has been presented at the CPP conference  [15] and the international PxTP workshop [21] , [20] .