Cesare Tinelli

TACAS Conference 2026 Conference Paper

Enumerating Choice Terms in Model-Based Quantifier Instantiation

• Lydia Kondylidou
• Andrew Reynolds
• Jasmin Blanchette
• Cesare Tinelli

TACAS Conference 2026 Conference Paper

Exploring the SMT-LIB Benchmark Library

• Hans-Jörg Schurr
• François Bobot
• Mathias Preiner
• Aina Niemetz
• Clark Barrett
• Pascal Fontaine
• Cesare Tinelli

SAT Conference 2025 Conference Paper

Bit-Precise Reasoning with Parametric Bit-Vectors

• Zvika Berger
• Yoni Zohar
• Aina Niemetz
• Mathias Preiner
• Andrew Reynolds 0001
• Clark W. Barrett
• Cesare Tinelli

The SMT-LIB theory of bit-vectors is restricted to bit-vectors of fixed width. However, several important applications can benefit from reasoning about bit-vectors of symbolic widths, i. e. , parametric bit-vectors. Recent work has introduced an approach for solving formulas over parametric bit-vectors, via an eager translation to quantified integer arithmetic with uninterpreted functions. The approach was shown to be successful for several applications, including the bit-width independent verification of compiler optimizations, invertibility conditions, and rewrite rules. We extend and improve that approach in several aspects. Theoretically, we improve expressiveness by defining a new theory of parametric bit-vectors that supports more operators and allows reasoning about the bit-widths themselves. Algorithmically, we introduce a lazy algorithm that avoids the use of uninterpreted functions and quantified axioms for them. Empirically, we show a significant improvement by implementing and evaluating our approach, and comparing it experimentally to the previous one.

SAT Conference 2024 Conference Paper

Scalable Proof Production and Checking in SMT (Invited Talk)

• Cesare Tinelli

Solvers for Satisfiability Modulo Theories (SMT) have become crucial components in safety- or mission-critical formal methods applications, in particular model checking, verification, and security analysis. Since state-of-the-art SMT solvers are large and complex systems, they are prohibitively difficult to prove correct. Hence, proof production is essential as a way to demonstrate instead the correctness of their responses, making those responses amenable to independent verification. Historically, the main challenges for proof production in SMT have been solver performance and proof coverage, often leading to the disabling of many sophisticated solving techniques when running in proof-production mode, or to coarse-grained, and harder to check, proofs. The first part of this talk presents a flexible proof-production architecture designed to handle the complexity of versatile, industrial-strength SMT solvers, and discusses how it has been leveraged to produce detailed proofs, even for sophisticated reasoning components. The architecture, implemented in the state-of-the-art SMT solver cvc5, allows proofs to be produced modularly, as needed, and with various safeguards for correctness. The architecture supports the generation of textual proof certificates in different formats, for offline proof checking by external tools, as well as a rich API, which is useful for online integration of the SMT solver into other reasoning tools such as, for instance, skeptical proof assistants. Extensive experimental evaluations with both SMT-LIB benchmarks and benchmarks provided by industrial partners have shown that the new architecture results in greater proof coverage than previous approaches, imposes a small runtime overhead, and supports fine-grained proofs in the great majority of cases. The second part of the talk gives an overview of a new generic language for expressing SMT proof certificates that builds on almost two decades of work and experience in proof generation and checking in SMT and combines the benefits of several previous efforts on the topic. While developed to express cvc5’s proof certificates, the language is meant to be useful to other SMT solvers as well. It is in fact a logical framework, based on the syntax and semantics of the upcoming Version 3 of the SMT-LIB standard, that can be customized, as in the case of cvc5, with the specific proof system used by the solver through the definition of new symbols, binders and proof rules. In addition, it features an intuitive syntax for representing natural-deduction-style proofs and the ability to integrate other proof formats (such as, for instance, those currently used by SAT solvers) via the use of oracles. The talk discusses an initial evaluation of the proof language, obtained with a companion checker for it and an instantiation to cvc5’s proof system. The evaluation shows the viability of high-performance, fine-grained proof production and checking for SMT. The talk concludes with a brief overview of future work and new potential applications enabled by scalable proof certificate production and checking.

LPAR Conference 2024 Conference Paper

Verifying SQL queries using theories of tables and relations

• Mudathir Mohamed
• Andrew Reynolds 0001
• Cesare Tinelli
• Clark W. Barrett

We present a number of first- and second-order extensions to SMT theories specifically aimed at representing and analyzing SQL queries with join, projection, and selection op- erations. We support reasoning about SQL queries with either bag or set semantics for database tables. We provide the former via an extension of a theory of finite bags and the latter via an extension of the theory of finite relations. Furthermore, we add the ability to reason about tables with null values by introducing a theory of nullable sorts based on an extension of the theory of algebraic datatypes. We implemented solvers for these theories in the SMT solver cvc5 and evaluated them on a set of benchmarks derived from public sets of SQL equivalence problems.

LPAR Conference 2023 Conference Paper

An Interactive SMT Tactic in Coq using Abductive Reasoning

• Haniel Barbosa
• Chantal Keller
• Andrew Reynolds 0001
• Arjun Viswanathan 0001
• Cesare Tinelli
• Clark W. Barrett

A well-known challenge in leveraging automatic theorem provers, such as satisfiability modulo theories (SMT) solvers, to discharge proof obligations from interactive theorem provers (ITPs) is determining which axioms to send to the solver together with the con- jecture to be proven. Too many axioms may confuse or clog the solver, while too few may make a theorem unprovable. When a solver fails to prove a conjecture, it is unclear to the user which case transpired. In this paper we enhance SMTCoq — an integration between the Coq ITP and the cvc5 SMT solver — with a tactic called abduce aimed at mitigating the uncertainty above. When the solver fails to prove the goal, the user may invoke abduce which will use abductive reasoning to provide facts that will allow the solver to prove the goal, if any.

SAT Conference 2021 Conference Paper

Smt-Switch: A Solver-Agnostic C++ API for SMT Solving

• Makai Mann
• Amalee Wilson
• Yoni Zohar
• Lindsey Stuntz
• Ahmed Irfan
• Kristopher Brown
• Caleb Donovick
• Allison Guman

Abstract This paper presents Smt-Switch, an open-source, solver-agnostic API for SMT solving. Smt-Switch provides simple, uniform, and high-performance access to SMT solving for applications in areas such as automated reasoning, planning, and formal verification. It defines an abstract interface, which can be implemented by different SMT solvers. The interface allows the user to create, traverse, and manipulate terms, as well as dynamically dispatch queries to various underlying SMT solvers.

SAT Conference 2019 Conference Paper

Syntax-Guided Rewrite Rule Enumeration for SMT Solvers

• Andres Nötzli
• Andrew Reynolds 0001
• Haniel Barbosa
• Aina Niemetz
• Mathias Preiner
• Clark W. Barrett
• Cesare Tinelli

Abstract The performance of modern Satisfiability Modulo Theories (SMT) solvers relies crucially on efficient decision procedures as well as static simplification techniques, which include large sets of rewrite rules. Manually discovering and implementing rewrite rules is challenging. In this work, we propose a framework that uses enumerative syntax-guided synthesis (SyGuS) to propose rewrite rules that are not implemented in a given SMT solver. We implement this framework in cvc4, a state-of-the-art SMT and SyGuS solver, and evaluate several use cases. We show that some SMT solvers miss rewriting opportunities, or worse, have bugs in their rewriters. We also show that a variation of our approach can be used to test the correctness of a rewriter. Finally, we show that rewrites discovered with this technique lead to significant improvements in cvc4 on both SMT and SyGuS problems over bit-vectors and strings.

LPAR Conference 2015 Conference Paper

Fine Grained SMT Proofs for the Theory of Fixed-Width Bit-Vectors

• Liana Hadarean
• Clark W. Barrett
• Andrew Reynolds 0001
• Cesare Tinelli
• Morgan Deters

Abstract Many high-level verification tools rely on SMT solvers to efficiently discharge complex verification conditions. Some applications require more than just a yes/no answer from the solver. For satisfiable quantifier-free problems, a satisfying assignment is a natural artifact. In the unsatisfiable case, an externally checkable proof can serve as a certificate of correctness and can be mined to gain additional insight into the problem. We present a method of encoding and checking SMT-generated proofs for the quantifier-free theory of fixed-width bit-vectors. Proof generation and checking for this theory poses several challenges, especially for proofs based on reductions to propositional logic. Such reductions can result in large resolution subproofs in addition to requiring a proof that the reduction itself is correct. We describe a fine-grained proof system formalized in the LFSC framework that addresses some of these challenges with the use of computational side-conditions. We report results using a proof-producing version of the CVC4 SMT solver on unsatisfiable quantifier-free bit-vector benchmarks from the SMT-LIB benchmark library.

LPAR Conference 2008 Conference Paper

(LIA) - Model Evolution with Linear Integer Arithmetic Constraints

• Peter Baumgartner 0001
• Alexander Fuchs 0003
• Cesare Tinelli

Abstract Many applications of automated deduction require reasoning modulo some form of integer arithmetic. Unfortunately, theory reasoning support for the integers in current theorem provers is sometimes too weak for practical purposes. In this paper we propose a novel calculus for a large fragment of first-order logic modulo Linear Integer Arithmetic (LIA) that overcomes several limitations of existing theory reasoning approaches. The new calculus — based on the Model Evolution calculus, a first-order logic version of the propositional DPLL procedure — supports restricted quantifiers, requires only a decision procedure for LIA-validity instead of a complete LIA-unification procedure, and is amenable to strong redundancy criteria. We present a basic version of the calculus and prove it sound and (refutationally) complete.

AIJ Journal 2008 Journal Article

The model evolution calculus as a first-order DPLL method

• Peter Baumgartner
• Cesare Tinelli

The DPLL procedure is the basis of some of the most successful propositional satisfiability solvers to date. Although originally devised as a proof-procedure for first-order logic, it has been used almost exclusively for propositional logic so far because of its highly inefficient treatment of quantifiers, based on instantiation into ground formulas. The FDPLL calculus by Baumgartner was the first successful attempt to lift the procedure to the first-order level without resorting to ground instantiations. FDPLL lifts to the first-order case the core of the DPLL procedure, the splitting rule, but ignores other aspects of the procedure that, although not necessary for completeness, are crucial for its effectiveness in practice. In this paper, we present a new calculus loosely based on FDPLL that lifts these aspects as well. In addition to being a more faithful lifting of the DPLL procedure, the new calculus contains a more systematic treatment of universal literals, which are crucial to achieve efficiency in practice. The new calculus has been implemented successfully in the Darwin system, described elsewhere. The main results of this paper are theoretical, showing the soundness and completeness of the new calculus. In addition, the paper provides a high-level description of a proof procedure for the calculus, as well as a comparison with other calculi.

I&C Journal 2006 Journal Article

A new combination procedure for the word problem that generalizes fusion decidability results in modal logics

• Franz Baader
• Silvio Ghilardi
• Cesare Tinelli

Previous results for combining decision procedures for the word problem in the non-disjoint case do not apply to equational theories induced by modal logics—which are not disjoint for sharing the theory of Boolean algebras. Conversely, decidability results for the fusion of modal logics are strongly tailored towards the special theories at hand, and thus do not generalize to other types of equational theories. In this paper, we present a new approach for combining decision procedures for the word problem in the non-disjoint case that applies to equational theories induced by modal logics, but is not restricted to them. The known fusion decidability results for modal logics are instances of our approach. However, even for equational theories induced by modal logics our results are more general since they are not restricted to so-called normal modal logics.

IS Journal 2006 Journal Article

Intelligent Systems and Formal Methods in Software Engineering

• Bernhard Beckert
• Tony Hoare
• Reiner Hahnle
• Douglas Smith
• Cordell Green
• Silvio Ranise
• Cesare Tinelli
• Thomas Ball

Over the last few years, technologies for the formal description, construction, analysis, and validation of software - based mostly on logics and formal reasoning - have matured. We can expect them to complement and partly replace traditional software engineering methods in the future. Formal methods in software engineering are an increasingly important application area for intelligent systems. The field has outgrown the area of academic case studies, and industry is showing serious interest. We convincingly argue that we've reached the point where we can solve the problem of how to formally verify industrial-scale software. We propose program verification as a computer science Grand Challenge. Deductive software verification is a core technology of formal methods. We describe recent dramatic changes in the way it's perceived and used. Another important base technique of formal methods, besides software verification, is synthesizing software that's correct by construction because it's formally derived from its specification. We discuss recent developments and trends in this area. Surprisingly efficient decision procedures for the satisfiability modulo theories problem have recently emerged. We explain these techniques and why they're important for all formal-methods tools. We look at formal methods from an industry perspective. We explain the success of Microsoft Research's SLAM project, which has developed a verification tool for device drivers

LPAR Conference 2006 Conference Paper

Lemma Learning in the Model Evolution Calculus

• Peter Baumgartner 0001
• Alexander Fuchs 0003
• Cesare Tinelli

Abstract The Model Evolution \(\mathcal{ME}\) Calculus is a proper lifting to first-order logic of the DPLL procedure, a backtracking search procedure for propositional satisfiability. Like DPLL, the ME calculus is based on the idea of incrementally building a model of the input formula by alternating constraint propagation steps with non-deterministic decision steps. One of the major conceptual improvements over basic DPLL is lemma learning, a mechanism for generating new formulae that prevent later in the search combinations of decision steps guaranteed to lead to failure. We introduce two lemma generation methods for \(\mathcal{ME}\) proof procedures, with various degrees of power, effectiveness in reducing search, and computational overhead. Even if formally correct, each of these methods presents complications that do not exist at the propositional level but need to be addressed for learning to be effective in practice for \(\mathcal{ME}\). We discuss some of these issues and present initial experimental results on the performance of an implementation of the two learning procedures within our \(\mathcal{ME}\) prover Darwin.

LPAR Conference 2006 Conference Paper

Splitting on Demand in SAT Modulo Theories

• Clark W. Barrett
• Robert Nieuwenhuis
• Albert Oliveras
• Cesare Tinelli

Abstract Lazy algorithms for Satisfiability Modulo Theories (SMT) combine a generic DPLL-based SAT engine with a theory solver for the given theory T that can decide the T -consistency of conjunctions of ground literals. For many theories of interest, theory solvers need to reason by performing internal case splits. Here we argue that it is more convenient to delegate these case splits to the DPLL engine instead. The delegation can be done on demand for solvers that can encode their internal case splits into one or more clauses, possibly including new constants and literals. This results in drastically simpler theory solvers. We present this idea in an improved version of DPLL( T ), a general SMT architecture for the lazy approach, and formalize and prove it correct in an extension of Abstract DPLL Modulo Theories, a framework for modeling and reasoning about lazy algorithms for SMT. A remarkable additional feature of the architecture, also discussed in the paper, is that it naturally includes an efficient Nelson-Oppen-like combination of multiple theories and their solvers.

LPAR Conference 2004 Conference Paper

Abstract DPLL and Abstract DPLL Modulo Theories

• Robert Nieuwenhuis
• Albert Oliveras
• Cesare Tinelli

Abstract We introduce Abstract DPLL, a general and simple abstract rule-based formulation of the Davis-Putnam-Logemann-Loveland (DPLL) procedure. Its properties, such as soundness, completeness or termination, immediately carry over to the modern DPLL implementations with features such as non-chronological backtracking or clause learning. This allows one to formally reason about practical DPLL algorithms in a simple way. In the second part of this paper we extend the framework to Abstract DPLL modulo theories. This allows us to express—and formally reason about—state-of-the-art concrete DPLL-based techniques for satisfiability modulo background theories, such as the different lazy approaches, or our DPLL(T) framework.

JELIA Conference 2004 Conference Paper

Combining Decision Procedures for Sorted Theories

• Cesare Tinelli
• Calogero G. Zarba

Abstract The Nelson-Oppen combination method combines decision procedures for theories satisfying certain conditions into a decision procedure for their union. While the method is known to be correct in the setting of unsorted first-order logic, some current implementations of it appear in tools that use a sorted input language. So far, however, there have been no theoretical results on the correctness of the method in a sorted setting, nor is it obvious that the method in fact lifts as is to logics with sorts. To bridge this gap between the existing theoretical results and the current implementations, we extend the Nelson-Oppen method to (order-)sorted logic and prove it correct under conditions similar to the original ones. From a theoretical point of view, the extension is relevant because it provides a rigorous foundation for the application of the method in a sorted setting. From a practical point of view, the extension has the considerable added benefits that in a sorted setting the method’s preconditions become easier to satisfy in practice, and the method’s nondeterminism is generally reduced.

TCS Journal 2003 Journal Article

Preface

• Cesare Tinelli
• Teodor Rus

TCS Journal 2003 Journal Article

Unions of non-disjoint theories and combinations of satisfiability procedures

• Cesare Tinelli
• Christophe Ringeissen

In this paper we outline a theoretical framework for the combination of decision procedures for constraint satisfiability. We describe a general combination method which, given a procedure that decides constraint satisfiability with respect to a constraint theory T1 and one that decides constraint satisfiability with respect to a constraint theory T2, produces a procedure that (semi-)decides constraint satisfiability with respect to the union of T1 and T2. We provide a number of model-theoretic conditions on the constraint language and the component constraint theories for the method to be sound and complete, with special emphasis on the case in which the signatures of the component theories are non-disjoint. We also describe some general classes of theories to which our combination results apply, and relate our approach to some of the existing combination methods in the field.

JELIA Conference 2002 Conference Paper

A DPLL-Based Calculus for Ground Satisfiability Modulo Theories

• Cesare Tinelli

Abstract We describe and discuss DPLL( T ), a parametric calculus for proving the satisfiability of ground formulas in a logical theory T. The calculus tightly integrates a decision procedure for the satisfiability in T of sets of literals into a sequent calculus based on the well-known method by Davis, Putman, Logemann and Loveland for proving the satisfiability of propositional formulas. For being based on the DPLL method, DPLL( T ) can incorporate a number of very effective search heuristics developed by the SAT community for that method. Hence, it can be used as the formal basis for novel and efficient implementations of satisfiability checkers for theories with decidable ground consequences.

I&C Journal 2002 Journal Article

Deciding the Word Problem in the Union of Equational Theories

• Franz Baader
• Cesare Tinelli

The main contribution of this paper is a new method for combining decision procedures for the word problem in equational theories. In contrast to previous methods, this method is based on transformation rules. Furthermore, it is not limited to theories with disjoint signatures but it also applies to theories sharing constructors.