International audienceWe describe a fully portable, open source certifier for traces of SAT problems produced by zChaff. It can also be easily adapted for MiniSat, PicoSat or BooleForce, and we have done it for PicoSat. Our certifier has been developed with the proof assistant Coq. We give some figures based on the pigeon hole, comparing both PicoSat and zChaff on the one hand, and our certifier with another certifier also developed with Coq

Jouannaud, Jean-Pierre

Strub, Pierre-Yves

Zhang, Lianyi

INRIA a CCSD electronic archive server

HAL Id: inria-00516906https://hal.inria.fr/inria-00516906Submitted on 13 Sep 2010HAL is a multi-disciplinary open accessarchive for the deposit and dissemination of sci-entific research documents, whether they are pub-lished or not. The documents may come fromteaching and research institutions in France orabroad, or from public or private research centers.L’archive ouverte pluridisciplinaire HAL, estdestinée au dépôt et à la diffusion de documentsscientifiques de niveau recherche, publiés ou non,émanant des établissements d’enseignement et derecherche français ou étrangers, des laboratoirespublics ou privés.Certification of SAT Solvers in CoqJean-Pierre Jouannaud, Pierre-Yves Strub, Lianyi ZhangTo cite this version:Jean-Pierre Jouannaud, Pierre-Yves Strub, Lianyi Zhang. Certification of SAT Solvers in Coq.Guangzhou Symposium on Satisfiability in Logic-Based Modeling, Yuping Shen, Institute of Logicand Cognition Sun Yat-sen University, Guangzhou., Sep 2010, Zuhai, China. ￿inria-00516906￿Certification of SAT Solvers in CoqJean-Pierre Jouannaud, Pierre-Yves Strub, and Lianyi ZhangINRIA-Tsinghua Project FORMESINRIA-LIAMA and Tsinghua University, BeijingAbstract. We describe here a fully portable, open source certifier for tracesof SAT problems produced by zChaff [6]1. It can also be easily adapted forMiniSat [4]2, PicoSat [2]3 and Booleforce4, which we have done forPicoSat. Our certifier has been developped with the proof assistant Coq5.We give some figures based on the pigeon hole, comparing both PicoSat andzChaff on the one hand, and our certifier with another certifier developped withCoq.1 IntroductionThe importance of SAT solvers has grown over the years in verification, for twomajor reasons: because bit blasting allows to transform many verification prob-lems in a formula of propositionnal logic ; and because SAT solvers have madeenormous progress, making them efficient for many practical problems which areindeed seldom in the NP-hard area.But the sophistication of modern SAT solvers, usually written in C for efficiency,usually not proved correct because of the size and the sophistication of the code,makes them error-prone. Stories are many, and well-known. On the other hand,most modern SAT solvers do not output a bare Yes/No answer, but a trace whichis an easily checkable satisfying assignement in the positive case, and can beinterpreted as a resolution proof in the negative case. The idea has therefore beenaround for a while to certify such a trace with a theorem prover in order to beconfident that the output, in the case of a negative answer, is indeed a valid trace.This seems a rather trivial problem, but it is indeed not. On the one hand, prov-ing a program correct is never a trivial task even with the modern provers on themarket. On the other hand, and this is the real difficulty, bit blasting produceslarge inputs, which in turn produce very large traces, measured in terms of hun-dred of megabites, or even gigabites. A consequence is that such simple things1 zChaff can be doawnloaded at urlhttp://www.princeton.edu/˜chaff/zchaff/index1.html2 MiniSat can be doawnloaded at the url http://minisat.se/MiniSat+.html3 PicoSat can be downloaded at url http://fmv.jku.at/picosat/4 The Booleforce website is at url http://fmv.jku.at/booleforce5 The Coq website is at url http://coq.inria.fr/as parsing the trace within the theorem prover becomes an impossible task. Andof course, the proof object obtained from the trace becomes even larger, makingproof-checkig extremely delicate. Certifying the trace obtained by a SAT solveris a quite non-trivial task, which requires expertise in using the chosen theoremprover.We are aware of several attempts of solving this problem by using the Coq proofassistant, and there has been other attempts with various provers, in particularwith HOL 6, and Isabelle 7. A first approach is to avoid reflection and code SATdirectly in Coq [5]. The second was not very conclusive, and the Coq develop-ment is not available [3]. The third was very conclusive, and the obtained devel-opment is available [1]. However, in order to process very large traces, the authorshad to compromise the Coq kernel by introducing impure non-fonctional featuresin Coq in order to make proof-checking more efficient for their application. Itfollows that the proof-term produced by their code cannot be proof-checked bythe official Coq kernel.In this paper, we describe our own certifier, which produces a trace checkableby Coq 8.2, without using any impure extension of Coq (we do use machineintegers, available in Coq 8.2). We believe that our certifier is the first efficient,portable certifier for both PicoSat and zChaff which were our targets. Itsefficiency is comparable to that of [1], although a little bit less. It would be pos-sible to optimiwe it, still, and approach the efficiency of [1], to the price of a lesselegant development. So far, we resisted following this path.In the following, we describe first the problem format in Section 2, the trace for-mats of zChaff and PicoSat (MiniSat has a very similar one) in Section 3,the encoding in Coq in Section 4, and the checking itself in Section 5. We con-clude in Section 7.2 Problem formatThe problem file format is the standard DIMAC format.A DIMAC file is line oriented. It starts with comments, i.e. with lines beginningwith the letter c. Then the number of variables and clauses may be defined by aline beginning with the letter p followed by the word cnf, the number of variables,and the number of clauses. Then, each of the next lines describes a clause: theyare composed of a sequence of non null integers, followed by the integer 0. Eachnon-null integer defines a literal. For PicoSat, a positive (resp. negative) integern defines the positive literal xn (resp. the negative literal ¬xn).For a simple example, the problem {x1 ∨ x2,¬x1, x1 ∨ ¬x2} can be defined bythe following DIMAC file:c My Simple PicoSat Problemp cnf 2 31 2 06 The HOL website is at urlhttp://www.cl.cam.ac.uk/˜jrh13/hol-light7 The Isabelle website is at urlhttp://www.cl.cam.ac.uk/research/hvg/Isabelle2-1 01 -2 0zChaff uses a slightly different encoding: the positive literal xn is encoded as2n, whereas the negative literal ¬xn is encoded as 2n + 1. The same examplebecomes:c My Simple zChaff Problemp cnf 2 31 4 03 01 5 0In real practical problems, there may be thousands of litterals and clauses.3 Trace formats3.1 zChaffzChaff uses a line oriented trace. The trace is split into 3 parts: a (possiblyempty) set of learned clauses, a (possibly empty) set of variable assignments anda conflict description. Clauses of the problem are not part of the trace.Learned clauses The first part of the trace defines a set of learned clauses. Forexample, a line of the formCL: 9 <= 6 1 0indicates that a new clause, indexed by 9, can be deduced by resolutionsof the clauses indexed by 6, 1 and 0, that is, by first resolving the clausesindexed by 6 and 1, and then resolving the resolvent with the clauses indexedby 0. The clauses 6, 1 and 0 are called the antecedent of 0.All clauses of the problem are indexed by starting from the index 0 for thefirst clause. Clauses that do not appear in the trace are indexed as well.Note that the final resolvent is not given, nor the pivot variables used in theresolutions. zChaff ensures that the result does not depend on the chosenpivot variable.8 Only the resolution order - from left to right - is given.In the zChaff implementation we used, the learned clauses appear in thecorrect order, i.e. the antecedents of a learned clauses are either clauses ofthe problem or learned clauses appearing above in the trace. This is a majorpractical difference with PicoSat.Variables assignments Then come variables assignments. Each variable assign-ment is described by a line of the form:VAR: 3 L: 5 V: 1 A: 1 Lits: 6 88 Similarly to Booleforce, zChaff must use linear resolution, but we were not able to con-firm this point.3This tells us that the variable x3 (VAR: 3) must be assigned to true (V: 1).This is because of the clause of index 1 (A: 1), which literals are x3 andx4 (Lits: 6 8). We also know that this assignment has been made at thedecision level 5 (L: 5).If the clause 1 is - as stated by the trace - x3 ∨ x4, then, for this clause to betrue, one of the variables x3 and x4 must be assigned to true. Hence, theremust exist a variable assignment with a lower decision level assigning falseto x4. At some point, the trace should contain variables assignments whichantecedents are unit clauses, and which decision levels are minimal, that is,a variable assignment of the formVAR: 5 L: 0 V: 0 A: 9 Lits: 11Here, the clause of index 9 is of the form ¬x5, implying that the variable 5must be assigned to false.Conflict The conflict is a single line of the form:CONF: 3 == 3 7which indicates that a conflict comes from the clauses 3, which literals are¬x2 and ¬x4. Therefore, there must be variables assignments assigning trueto x2 and x4, hence implying the non-satisfiability of the clause indexed by3.3.2 PicoSatThe traces are quite similar in spirit, with the exception that clauses are not sortedin the output trace of PicoSat: a clause index may be used before the clauseis indeed defined. Since the ordering of clauses is crucial in the Coq proof, theoutput trace must be ordered before the proof-term can be generated. The Coqlibraries provide with various, efficient, proved sorting algorithms. However, theyslow down the whole proof checking process which makes comparisons betweenzChaff and PicoSat almost senseless. We have therefore hardcoded the sort-ing algorithm in the reader of the PicoSat output trace.4 Encoding of the problem into CoqInefficient, easy to reason about encoding We first defined all the necessarydata structures for reasoning about SAT problems in Coq. Here, the aim isnot to have data structures for computing efficiently, but to have data struc-tures that fit with our need to reason about. For example, a literal is simplydefined as a pair of a positive integer (the variable index) and a boolean (thesign of the literal). Likewise, a clause is a list of literals, and a SAT prob-lem a list of clauses. The valuation is then simply defined as a function fromintegers to boolean, and we defined the interpretation of clauses (or set ofclauses) by list folding. The notion of satisfiability and validity is then de-fined with respect to this notion of interpretation.With these structures, we can prove that the resolution rule is correct withrespect to the interpretation function.4Data structures for computation We then defined the same data structures, butin a more efficient way. For example, Peano integers are replaced by in-ductive binary integers or machine binary integers. We defined a transla-tion function from this representation to the previous one. The interpretationfunction of this clauses representation is defined as the interpretation of theirtranslation to the previous representation.Reflection We also defined a reflection function translating the inefficient repre-sentation of clauses to the propositional level of Coq. We proved that theyare equivalent, that is, that an encoded clause is valid if and only if its trans-lation to the proposition level of Coq is a provable Lemma.Encoding of the trace For this encoding, we use the previously defined efficientencoding of clauses. The set of initial clauses is stored into a Patricia tree,where the indexes of the clauses are the key used in the tree. The trace isa list of clauses to be learned. Each element of this list is a pair composedof the index of the clause and of the list of its antecedents. The variablesassignments, and the conflict description, are encoded as learned clauses, anencoding to be explained later.Trace verification We defined a function taking a set of initial clauses (the Pa-tricia tree previously described) and a trace, and returning the set of all thelearned clauses (along with the initial ones). This final set is simply obtainedby iterating a function on the trace which take the antecedents, find the cor-responding clauses, compute the final resolvent and adds this resolvent tothe Patricia tree. In case of an error (one of the antecedent clauses cannot befound, there are no possible resolutions, ...), an error value is returned.How to compute the resolvent If the two clauses to be resolved are sorted, oneof the resolvent can be efficiently computed by a slight modification of themerge function (of the merge-sort algorithm) which must discard the firstpair of opposite literals it encounters. Note that the resolvent is then alsosorted. As a consquence, we need to sort the set of initial clauses.Adequation Finally, if for a given problem and trace, the final set of learnedclauses contains the empty clause, then we can prove that the translation ofthe problem into the propositional level of Coq implies False, implying thatthe initial problem is not satisfiable.5 Checking a trace in practiceWe start from a SAT problem and a zChaff trace.– We first generate a Coq Lemma representing the UNSAT problem. E.g.,from the DIMAC file given above, we generate the following Coq Lemma:Definition UNSAT : Prop := forall (X : nat -> Prop),(X 1) \/ (X 2) -> ˜(X 1) -> (X 1) \/ ˜(X 2)-> False.– We then post-process the zChaff trace, removing the variables assignmentsand the conflict descriptions. Note that a variable assignment is simply theencoding of a unit clause. For example, the variable assignmentVAR: 3 L: 5 V: 1 A: 1 Lits: 3 6 8 105is translated into the unit clause x3, which can be learned by resolving theantecedent 1 with the unit clauses related to the literals ¬x1, x4 and x5,that is the literals 3, 8 and 10 in the encoding. Note that the literal 6 is notconsidered as it corresponds to the variable 3, which is the target variableof this variables assignment. Likewise, the conflict is encoded as the emptyclause.– We load the problem and the trace using a dedicated Coq tactic.– We can then compute the set of learned clauses and check that the emptyclause is part of this set.– Using the adequation Lemma, we conclude that the UNSAT Lemma definedat the very beginning is a valid Coq Lemma.6 ComparisonsThe figures will be presented during the talk.7 ConclusionAcknowledgements: Our colleague professor Bow-Yaw Wang helped us under-stand learning in PicoSat by rewriting it in Caml9.References1. Michaël Armand, Benjamin Grégoire, Arnaud Spiwack, and Laurent Théry.Extending Coq with Imperative Features and its Application to SAT Verifica-tion. In Interactive Theorem Proving, Edinburgh Royaume-Uni, 2010.2. Armin Biere. Picosat essentials. JSAT, 4(2-4):75–97, 2008.3. Ashish Darbari, Bernd Fischer 0002, and João P. Marques Silva. Industrial-strength formally certified sat solving. CoRR, abs/0911.1678, 2009.4. Niklas Eén and Niklas Sörensson. An extensible sat-solver. In EnricoGiunchiglia and Armando Tacchella, editors, SAT, volume 2919 of LectureNotes in Computer Science, pages 502–518. Springer, 2003.5. Stéphane Lescuyer and Sylvain Conchon. Improving coq propositional rea-soning using a lazy cnf conversion scheme. In Silvio Ghilardi and RobertoSebastiani, editors, FroCos, volume 5749 of Lecture Notes in Computer Sci-ence, pages 287–303. Springer, 2009.6. Yogesh S. Mahajan, Zhaohui Fu, and Sharad Malik. Zchaff2004: An efficientsat solver. In Holger H. Hoos and David G. Mitchell, editors, SAT (SelectedPapers, volume 3542 of Lecture Notes in Computer Science, pages 360–375.Springer, 2004.7. Tjark Weber and Hasan Amjad. Efficiently checking propositional refutationsin hol theorem provers. Journal of Applied Logic, 7(1):26 – 40, 2009. SpecialIssue: Empirically Successful Computerized Reasoning.9 The Caml website is at url http://caml.inria.fr/download.en.html6

Certification of SAT Solvers in Coq

HAL-CIRAD

Certification of SAT Solvers in CoqJean-Pierre Jouannaud, Pierre-Yves Strub, Lianyi ZhangTo cite this version:Jean-Pierre Jouannaud, Pierre-Yves Strub, Lianyi Zhang. Certification of SAT Solvers inCoq. Guangzhou Symposium on Satisfiability in Logic-Based Modeling, Sep 2010, Zuhai,China. 2010, Proc. Guangzhou Symposium on Satisfiability in Logic-Based Modeling. <inria-00516906>HAL Id: inria-00516906https://hal.inria.fr/inria-00516906Submitted on 13 Sep 2010HAL is a multi-disciplinary open accessarchive for the deposit and dissemination of sci-entific research documents, whether they are pub-lished or not. The documents may come fromteaching and research institutions in France orabroad, or from public or private research centers.L’archive ouverte pluridisciplinaire HAL, estdestine´e au de´poˆt et a` la diffusion de documentsscientifiques de niveau recherche, publie´s ou non,e´manant des e´tablissements d’enseignement et derecherche franc¸ais ou e´trangers, des laboratoirespublics ou prive´s.Certification of SAT Solvers in CoqJean-Pierre Jouannaud, Pierre-Yves Strub, and Lianyi ZhangINRIA-Tsinghua Project FORMESINRIA-LIAMA and Tsinghua University, BeijingAbstract. We describe here a fully portable, open source certifier for tracesof SAT problems produced by zChaff [6]1. It can also be easily adapted forMiniSat [4]2, PicoSat [2]3 and Booleforce4, which we have done forPicoSat. Our certifier has been developped with the proof assistant Coq5.We give some figures based on the pigeon hole, comparing both PicoSat andzChaff on the one hand, and our certifier with another certifier developped withCoq.1 IntroductionThe importance of SAT solvers has grown over the years in verification, for twomajor reasons: because bit blasting allows to transform many verification prob-lems in a formula of propositionnal logic ; and because SAT solvers have madeenormous progress, making them efficient for many practical problems which areindeed seldom in the NP-hard area.But the sophistication of modern SAT solvers, usually written in C for efficiency,usually not proved correct because of the size and the sophistication of the code,makes them error-prone. Stories are many, and well-known. On the other hand,most modern SAT solvers do not output a bare Yes/No answer, but a trace whichis an easily checkable satisfying assignement in the positive case, and can beinterpreted as a resolution proof in the negative case. The idea has therefore beenaround for a while to certify such a trace with a theorem prover in order to beconfident that the output, in the case of a negative answer, is indeed a valid trace.This seems a rather trivial problem, but it is indeed not. On the one hand, prov-ing a program correct is never a trivial task even with the modern provers on themarket. On the other hand, and this is the real difficulty, bit blasting produceslarge inputs, which in turn produce very large traces, measured in terms of hun-dred of megabites, or even gigabites. A consequence is that such simple things1 zChaff can be doawnloaded at urlhttp://www.princeton.edu/˜chaff/zchaff/index1.html2 MiniSat can be doawnloaded at the url http://minisat.se/MiniSat+.html3 PicoSat can be downloaded at url http://fmv.jku.at/picosat/4 The Booleforce website is at url http://fmv.jku.at/booleforce5 The Coq website is at url http://coq.inria.fr/as parsing the trace within the theorem prover becomes an impossible task. Andof course, the proof object obtained from the trace becomes even larger, makingproof-checkig extremely delicate. Certifying the trace obtained by a SAT solveris a quite non-trivial task, which requires expertise in using the chosen theoremprover.We are aware of several attempts of solving this problem by using the Coq proofassistant, and there has been other attempts with various provers, in particularwith HOL 6, and Isabelle 7. A first approach is to avoid reflection and code SATdirectly in Coq [5]. The second was not very conclusive, and the Coq develop-ment is not available [3]. The third was very conclusive, and the obtained devel-opment is available [1]. However, in order to process very large traces, the authorshad to compromise the Coq kernel by introducing impure non-fonctional featuresin Coq in order to make proof-checking more efficient for their application. Itfollows that the proof-term produced by their code cannot be proof-checked bythe official Coq kernel.In this paper, we describe our own certifier, which produces a trace checkableby Coq 8.2, without using any impure extension of Coq (we do use machineintegers, available in Coq 8.2). We believe that our certifier is the first efficient,portable certifier for both PicoSat and zChaff which were our targets. Itsefficiency is comparable to that of [1], although a little bit less. It would be pos-sible to optimiwe it, still, and approach the efficiency of [1], to the price of a lesselegant development. So far, we resisted following this path.In the following, we describe first the problem format in Section 2, the trace for-mats of zChaff and PicoSat (MiniSat has a very similar one) in Section 3,the encoding in Coq in Section 4, and the checking itself in Section 5. We con-clude in Section 7.2 Problem formatThe problem file format is the standard DIMAC format.A DIMAC file is line oriented. It starts with comments, i.e. with lines beginningwith the letter c. Then the number of variables and clauses may be defined by aline beginning with the letter p followed by the word cnf, the number of variables,and the number of clauses. Then, each of the next lines describes a clause: theyare composed of a sequence of non null integers, followed by the integer 0. Eachnon-null integer defines a literal. For PicoSat, a positive (resp. negative) integern defines the positive literal xn (resp. the negative literal ¬xn).For a simple example, the problem {x1 ∨ x2,¬x1, x1 ∨ ¬x2} can be defined bythe following DIMAC file:c My Simple PicoSat Problemp cnf 2 31 2 06 The HOL website is at urlhttp://www.cl.cam.ac.uk/˜jrh13/hol-light7 The Isabelle website is at urlhttp://www.cl.cam.ac.uk/research/hvg/Isabelle2-1 01 -2 0zChaff uses a slightly different encoding: the positive literal xn is encoded as2n, whereas the negative literal ¬xn is encoded as 2n + 1. The same examplebecomes:c My Simple zChaff Problemp cnf 2 31 4 03 01 5 0In real practical problems, there may be thousands of litterals and clauses.3 Trace formats3.1 zChaffzChaff uses a line oriented trace. The trace is split into 3 parts: a (possiblyempty) set of learned clauses, a (possibly empty) set of variable assignments anda conflict description. Clauses of the problem are not part of the trace.Learned clauses The first part of the trace defines a set of learned clauses. Forexample, a line of the formCL: 9 <= 6 1 0indicates that a new clause, indexed by 9, can be deduced by resolutionsof the clauses indexed by 6, 1 and 0, that is, by first resolving the clausesindexed by 6 and 1, and then resolving the resolvent with the clauses indexedby 0. The clauses 6, 1 and 0 are called the antecedent of 0.All clauses of the problem are indexed by starting from the index 0 for thefirst clause. Clauses that do not appear in the trace are indexed as well.Note that the final resolvent is not given, nor the pivot variables used in theresolutions. zChaff ensures that the result does not depend on the chosenpivot variable.8 Only the resolution order - from left to right - is given.In the zChaff implementation we used, the learned clauses appear in thecorrect order, i.e. the antecedents of a learned clauses are either clauses ofthe problem or learned clauses appearing above in the trace. This is a majorpractical difference with PicoSat.Variables assignments Then come variables assignments. Each variable assign-ment is described by a line of the form:VAR: 3 L: 5 V: 1 A: 1 Lits: 6 88 Similarly to Booleforce, zChaff must use linear resolution, but we were not able to con-firm this point.3This tells us that the variable x3 (VAR: 3) must be assigned to true (V: 1).This is because of the clause of index 1 (A: 1), which literals are x3 andx4 (Lits: 6 8). We also know that this assignment has been made at thedecision level 5 (L: 5).If the clause 1 is - as stated by the trace - x3 ∨ x4, then, for this clause to betrue, one of the variables x3 and x4 must be assigned to true. Hence, theremust exist a variable assignment with a lower decision level assigning falseto x4. At some point, the trace should contain variables assignments whichantecedents are unit clauses, and which decision levels are minimal, that is,a variable assignment of the formVAR: 5 L: 0 V: 0 A: 9 Lits: 11Here, the clause of index 9 is of the form ¬x5, implying that the variable 5must be assigned to false.Conflict The conflict is a single line of the form:CONF: 3 == 3 7which indicates that a conflict comes from the clauses 3, which literals are¬x2 and ¬x4. Therefore, there must be variables assignments assigning trueto x2 and x4, hence implying the non-satisfiability of the clause indexed by3.3.2 PicoSatThe traces are quite similar in spirit, with the exception that clauses are not sortedin the output trace of PicoSat: a clause index may be used before the clauseis indeed defined. Since the ordering of clauses is crucial in the Coq proof, theoutput trace must be ordered before the proof-term can be generated. The Coqlibraries provide with various, efficient, proved sorting algorithms. However, theyslow down the whole proof checking process which makes comparisons betweenzChaff and PicoSat almost senseless. We have therefore hardcoded the sort-ing algorithm in the reader of the PicoSat output trace.4 Encoding of the problem into CoqInefficient, easy to reason about encoding We first defined all the necessarydata structures for reasoning about SAT problems in Coq. Here, the aim isnot to have data structures for computing efficiently, but to have data struc-tures that fit with our need to reason about. For example, a literal is simplydefined as a pair of a positive integer (the variable index) and a boolean (thesign of the literal). Likewise, a clause is a list of literals, and a SAT prob-lem a list of clauses. The valuation is then simply defined as a function fromintegers to boolean, and we defined the interpretation of clauses (or set ofclauses) by list folding. The notion of satisfiability and validity is then de-fined with respect to this notion of interpretation.With these structures, we can prove that the resolution rule is correct withrespect to the interpretation function.4Data structures for computation We then defined the same data structures, butin a more efficient way. For example, Peano integers are replaced by in-ductive binary integers or machine binary integers. We defined a transla-tion function from this representation to the previous one. The interpretationfunction of this clauses representation is defined as the interpretation of theirtranslation to the previous representation.Reflection We also defined a reflection function translating the inefficient repre-sentation of clauses to the propositional level of Coq. We proved that theyare equivalent, that is, that an encoded clause is valid if and only if its trans-lation to the proposition level of Coq is a provable Lemma.Encoding of the trace For this encoding, we use the previously defined efficientencoding of clauses. The set of initial clauses is stored into a Patricia tree,where the indexes of the clauses are the key used in the tree. The trace isa list of clauses to be learned. Each element of this list is a pair composedof the index of the clause and of the list of its antecedents. The variablesassignments, and the conflict description, are encoded as learned clauses, anencoding to be explained later.Trace verification We defined a function taking a set of initial clauses (the Pa-tricia tree previously described) and a trace, and returning the set of all thelearned clauses (along with the initial ones). This final set is simply obtainedby iterating a function on the trace which take the antecedents, find the cor-responding clauses, compute the final resolvent and adds this resolvent tothe Patricia tree. In case of an error (one of the antecedent clauses cannot befound, there are no possible resolutions, ...), an error value is returned.How to compute the resolvent If the two clauses to be resolved are sorted, oneof the resolvent can be efficiently computed by a slight modification of themerge function (of the merge-sort algorithm) which must discard the firstpair of opposite literals it encounters. Note that the resolvent is then alsosorted. As a consquence, we need to sort the set of initial clauses.Adequation Finally, if for a given problem and trace, the final set of learnedclauses contains the empty clause, then we can prove that the translation ofthe problem into the propositional level of Coq implies False, implying thatthe initial problem is not satisfiable.5 Checking a trace in practiceWe start from a SAT problem and a zChaff trace.– We first generate a Coq Lemma representing the UNSAT problem. E.g.,from the DIMAC file given above, we generate the following Coq Lemma:Definition UNSAT : Prop := forall (X : nat -> Prop),(X 1) \/ (X 2) -> ˜(X 1) -> (X 1) \/ ˜(X 2)-> False.– We then post-process the zChaff trace, removing the variables assignmentsand the conflict descriptions. Note that a variable assignment is simply theencoding of a unit clause. For example, the variable assignmentVAR: 3 L: 5 V: 1 A: 1 Lits: 3 6 8 105is translated into the unit clause x3, which can be learned by resolving theantecedent 1 with the unit clauses related to the literals ¬x1, x4 and x5,that is the literals 3, 8 and 10 in the encoding. Note that the literal 6 is notconsidered as it corresponds to the variable 3, which is the target variableof this variables assignment. Likewise, the conflict is encoded as the emptyclause.– We load the problem and the trace using a dedicated Coq tactic.– We can then compute the set of learned clauses and check that the emptyclause is part of this set.– Using the adequation Lemma, we conclude that the UNSAT Lemma definedat the very beginning is a valid Coq Lemma.6 ComparisonsThe figures will be presented during the talk.7 ConclusionAcknowledgements: Our colleague professor Bow-Yaw Wang helped us under-stand learning in PicoSat by rewriting it in Caml9.References1. Michae¨l Armand, Benjamin Gre´goire, Arnaud Spiwack, and Laurent The´ry.Extending Coq with Imperative Features and its Application to SAT Verifica-tion. In Interactive Theorem Proving, Edinburgh Royaume-Uni, 2010.2. Armin Biere. Picosat essentials. JSAT, 4(2-4):75–97, 2008.3. Ashish Darbari, Bernd Fischer 0002, and Joa˜o P. Marques Silva. Industrial-strength formally certified sat solving. CoRR, abs/0911.1678, 2009.4. Niklas Ee´n and Niklas So¨rensson. An extensible sat-solver. In EnricoGiunchiglia and Armando Tacchella, editors, SAT, volume 2919 of LectureNotes in Computer Science, pages 502–518. Springer, 2003.5. Ste´phane Lescuyer and Sylvain Conchon. Improving coq propositional rea-soning using a lazy cnf conversion scheme. In Silvio Ghilardi and RobertoSebastiani, editors, FroCos, volume 5749 of Lecture Notes in Computer Sci-ence, pages 287–303. Springer, 2009.6. Yogesh S. Mahajan, Zhaohui Fu, and Sharad Malik. Zchaff2004: An efficientsat solver. In Holger H. Hoos and David G. Mitchell, editors, SAT (SelectedPapers, volume 3542 of Lecture Notes in Computer Science, pages 360–375.Springer, 2004.7. Tjark Weber and Hasan Amjad. Efficiently checking propositional refutationsin hol theorem provers. Journal of Applied Logic, 7(1):26 – 40, 2009. SpecialIssue: Empirically Successful Computerized Reasoning.9 The Caml website is at url http://caml.inria.fr/download.en.html6

HAL-Rennes 1

https://hal.inria.fr/inria-00516906/file/main.pdf

Certification of SAT Solvers in Coq

Abstract

Similar works

Full text

Available Versions

INRIA a CCSD electronic archive server

HAL-CIRAD

HAL-Rennes 1